{ "Event": { "published": true, "date": "2026-04-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-17", "timestamp": 1776470582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "88bfde3a-136e-4db8-bdda-ff20ef750b49", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870d818e-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455790, "uuid": "c6069d77-ecd7-4fd4-b0c7-977c76834bec", "comment": "Malware payload (Mirai)", "value": "291b3b44ad99ea54ddf82fe5eeeb01d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455790, "uuid": "39eac5d6-31af-48e8-944d-96797cfd50f4", "comment": "Malware payload (Mirai)", "value": "004bf042c3d38a01d4315997586b410966e1d7d886a38e2d4ddb2af874057ed6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455790, "uuid": "83c43cd5-f93b-4e11-a9d9-46d2af45a5f2", "comment": "Malware payload (Mirai)", "value": "eac43aedffa4cc21073f9ce24970bee9bc39fe3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455790, "uuid": "a8c10001-7d9f-481c-b783-bb4869502938", "comment": "Malware payload (Mirai)", "value": "1ac191041d73f36cc48058d17f93498b61c78af0220e74e1d2349e8e13857fc1f16d066d33ca6710b935c3eaf005824f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455790, "uuid": "11852ef1-c6cc-4045-9e9a-356afc5291c7", "value": "T15043D882FD0789F7D8835CF05497F33F9731E9140234A169EF9AAA7DEA33646562220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455790, "uuid": "530feb9d-454a-4f06-9b44-5551b463d4e5", "value": "1536:17UAHV6OfLGiwBzHhA4thghmUhPRANT/lq3T:1p8ZfmiNT/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455790, "uuid": "2164f792-32f6-414a-9134-64f740dec1fc", "value": 58288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455790, "uuid": "ad42f638-02ca-491c-b745-4e785195eb4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455790, "uuid": "01e72292-aa03-4565-b196-1c6e36fe40ea", "value": "octagon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827f570f-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455782, "uuid": "d9679779-67be-4043-9a2f-be956c82a07d", "comment": "Malware payload (Mirai)", "value": "a32bfb358b1fce453413cd8a05e30c60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455782, "uuid": "e0ab6039-21c8-4ea5-bbe2-3ba193a81403", "comment": "Malware payload (Mirai)", "value": "01ee3e31bdafaf0713b4fb28414750a7ba95c98ca11955dc27f9ff28d6619879", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455782, "uuid": "73847291-861b-466d-a444-40bdbb366b48", "comment": "Malware payload (Mirai)", "value": "f5fa481045e8d291ceb239d283c43e738158dd0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455782, "uuid": "95fc4b04-05d9-4c51-ac83-c9d6bb72cd4f", "comment": "Malware payload (Mirai)", "value": "7ec1e325e767205d71a599fe64193032fb116b0c43fed164b1d684e6b84dfd161c4d29f34471c6d8370dbb3c723ab64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455782, "uuid": "39c63bb4-d7f2-4207-a94e-c59bec7de4bc", "value": "T176534B3679B95C17C4C8A67926E34334B6FE4B4534F4C92E7D224EACBB0066026637B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455782, "uuid": "9364f812-7b37-4ea6-98cc-887fc1bb5bcb", "value": "768:j8jTPDfOoFvk55hMn/k21AadVLS9ralO+l+m5EHb7:YXFia/k21DBWSl+uS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455782, "uuid": "b1ea6ba4-89ec-4da8-8e6f-cc102912ab00", "value": 66672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455782, "uuid": "7df723b4-1042-42b6-8b21-deede3460aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455782, "uuid": "bea1423c-661c-479e-bfb6-da5d3356f121", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26591c44-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776423416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423416, "uuid": "e570c650-6666-4936-97c8-3ca8003be451", "comment": "Malware payload (Vidar)", "value": "1d5027c7a4baa0e44ec2f3793c271fcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423416, "uuid": "d783639b-0cbb-4f16-9b01-922c5d07aff8", "comment": "Malware payload (Vidar)", "value": "0360b16112b3cc0e7816bd48c948cbd9a75ef6010010dfffddc77bf1950b95e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423416, "uuid": "376f252e-2e71-4e72-b7ba-5de3208135ff", "comment": "Malware payload (Vidar)", "value": "4281d65e63e3f1eed6db9a31ca1908634f03ce27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423416, "uuid": "60f21c1a-e7d3-4f3d-a0f9-e6e63e397b3c", "comment": "Malware payload (Vidar)", "value": "0eb41b6b4b34d7f5bd1e78e119599ff6f10407abc793b666e46c2145f0c8191de4066394b995d4262357a68c99fd2afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423416, "uuid": "c4bb558e-871a-45b9-90e1-1a5445f26d9c", "value": "T177D40A7DAD10A626F70CD0BAE287D7534FA53801033ABAA3197FD72411068729B677ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423416, "uuid": "37bfa1ec-ab27-4a10-ba29-7d99a951d1cf", "value": "12288:mL+1MJ2KStSAPnrnbBTKiTBj48k13OvykAhAQCAvLALrgE:mCSJ21BDbBTt6lxu03vLALc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423416, "uuid": "c9a40781-3a44-4405-80ad-95527d4d0175", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423416, "uuid": "4a3d36e7-cc61-4390-87b8-66aa71d77e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423416, "uuid": "61c9f80d-8e28-465f-9c92-3d8ab92045e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b1e788-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435793, "uuid": "13ff552b-da45-4ecc-bf71-66ea3722f58c", "comment": "Malware payload", "value": "7ecf3ef2bce1a3aeea7d35864a76d065", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435793, "uuid": "39c04449-5c95-4f89-b433-a47800ccec6b", "comment": "Malware payload", "value": "03fcceec212d8f37b105b9304831fbc3887abef623b883ba2878d002e875fc6e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435793, "uuid": "68c1ad6b-a981-475b-b57f-d17027313098", "comment": "Malware payload", "value": "7b92183da78a0b1ef5c3dec814b1faf6c398d9e4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435793, "uuid": "b3bda36c-0da3-42a1-890c-f39d12b7ca13", "comment": "Malware payload", "value": "4a0b977cb96bb5b70c17351a082e135af3e9593d84c16f1ac1e20580c35697f4e3b1c00c5514b736553b6347c0b0c995", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435793, "uuid": "e5d5b8ac-cd56-4c67-a3a3-77bc133ea5a1", "value": "T1E4015C184D9D0736E1B68E3A84EBA316C93A34D2D6836F7B40A0928931566437DE5F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435793, "uuid": "ed041998-a43c-442a-84e8-905640c24200", "value": "12:830m/VnEXzv1xW4L+mPs7IbiNL4t2Yqlb6oT4:83JtnOm4L+c+p5/phT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435793, "uuid": "4fa81226-d691-4fb3-999b-e2a9a3a71a9d", "value": 702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435793, "uuid": "0359ac01-ee25-4165-ae58-d42340b2c017", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435793, "uuid": "578424fd-a93c-460e-8404-372524e47a35", "value": "file.md.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b645dcbf-3aae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776465748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465748, "uuid": "54d408f9-5669-4427-9ea8-f890ecbda688", "comment": "Malware payload (Mirai)", "value": "b057a960da9cb5c9df57c08eda780e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465748, "uuid": "f435334b-79df-4265-8fbc-82ed93896184", "comment": "Malware payload (Mirai)", "value": "045b1f4610c6b0ff9e787a2cee78f0f0a09c853da59bd4973a29b84645a94443", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465748, "uuid": "043f2198-650a-40d3-a959-a4e73c678395", "comment": "Malware payload (Mirai)", "value": "678da8a53327a9afb0688368214c108f773e91c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465748, "uuid": "b8a121a9-3e18-4368-bb92-6fc69ba6dced", "comment": "Malware payload (Mirai)", "value": "15958b126413437cac54ad4687bf794097d1673861b79736a25370fa0a3391ac41a4e0bedb9656a895ef21ad04a5d089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465748, "uuid": "c0c2bae8-83b7-4a80-92d2-79895395d25a", "value": "T1474301C0D2A39A2DBE7BD0B07DBDF70E1AD1B5946168DAF07ED01004A616F568B607A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465748, "uuid": "4c4d3405-b114-4ef2-b9c5-a546b1293108", "value": "1536:7/R1J8A+SM8Xu8B6bmYQ3ah39aOXqn9OThX4f/fnouy8tyni:7vJ8A+SUK3ap9aq1sXoutei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776465748, "uuid": "0dd14d64-5cba-4c2c-8854-fda657bbe210", "value": 58524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776465748, "uuid": "f7b7f55a-0cf4-4bca-879a-958527975da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465748, "uuid": "2be4ad74-33bb-482c-ba04-906925899486", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6c5fc8-3a79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776443050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443050, "uuid": "4afb87e7-b189-4391-82a9-77320bb218c3", "comment": "Malware payload", "value": "b083e032e4abc4bb17ab74f2339a1bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443050, "uuid": "7e803038-fb6d-404a-8224-98e43ebc269a", "comment": "Malware payload", "value": "04badff52a76f33da8e2045b5273991077aaca69e896f9582126ea6b742e1943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443050, "uuid": "b1d3f4fb-8fab-42aa-8c7f-32d54460b3c8", "comment": "Malware payload", "value": "c42149feaa62d6a39f141ce38a70918a5dcdf026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443050, "uuid": "cbe69d03-6bb5-4eef-9523-3b1894f555ee", "comment": "Malware payload", "value": "92cef0e7407b28d764e8b8aa45a0503d8cee4777520c45395682febbb9764ee6087dbc7a375574e60e1a69df04d6b44e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443050, "uuid": "593c0ef1-0687-41e7-8e41-d9222d3c2eea", "value": "T14454509D726072DFC857D472DEA82DA8FA6074BB931F4213A02715ADAE4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443050, "uuid": "cd06647d-b957-4321-8738-268192013ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443050, "uuid": "e5a26b93-b9a2-4136-a101-87a594c84061", "value": "6144:cc6z0HE71plFg485uttIk1q92ANAPIruoYN36NNzfkOCGmq0AD2Ywx9P:vStDFgR54tI8qhyQruoYN36NNzfkOCGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776443050, "uuid": "d098a98b-174a-4c79-a498-69ad7ed59cbe", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776443050, "uuid": "20db3f2a-59e6-4633-af2b-c3154adc4072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443050, "uuid": "487d7cdd-58e7-4605-9e60-dcd2b40fa6bc", "value": "BrightRaider.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22636a3-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435757, "uuid": "94f948df-35e8-444e-bdd8-f64e33fdca18", "comment": "Malware payload (PhantomStealer)", "value": "f1abca1417f7adefc317923617d167ce", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435757, "uuid": "90dec9ed-7352-44ff-a193-04ee27f9e7fb", "comment": "Malware payload (PhantomStealer)", "value": "05e253c9515f3fe9969786fd5017bede92c9ef6836497eb33b59552154f0e5d4", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435757, "uuid": "5d69a502-f808-4e40-a729-a9d4b3b7be85", "comment": "Malware payload (PhantomStealer)", "value": "683217908d60805b3817fe14e6d717861f04acb1", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435757, "uuid": "3dc83bf4-0258-433b-9430-51bd5fe2b57a", "comment": "Malware payload (PhantomStealer)", "value": "b23a2298f710cfd6ae046c0a05ed68bb3ff5d0b64b9d0d6e24733f67b9bde7480dd7657d6a83d1f45c6d400b4c689cb2", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435757, "uuid": "96eec9e5-1657-4171-a112-a121b53ffe3d", "value": "T1D3338274290C45DB2493EAB4B084A7E3FE6C0A5C9FFD664F525487DA1A3EA8734C39C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435757, "uuid": "d5025982-b2ee-47e4-a171-60af0492680c", "value": "384:kw1mgLzTgDWDkmH5lP/97R25JDBiCUF6vLlgSAWqE:kwN6kkg5h99yJBJvAWqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435757, "uuid": "8b8f1c76-b181-4b1e-8035-7869c58859f0", "value": 52577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435757, "uuid": "be672424-7483-4cb1-adf3-1ed95e21f8f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435757, "uuid": "f41528bc-b62c-4c0e-88c8-ff83313ad005", "value": "DHT AWB #77963465767 SCAN DOCUMENT.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e82a55-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776423650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423650, "uuid": "e6295548-361b-4789-a45f-71d6cb332eee", "comment": "Malware payload (Mirai)", "value": "9a7ba7f93d4d9d101e4f9ff437f31f65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423650, "uuid": "3f1e69e3-b4d7-41fb-88d7-f88c3e0e6eac", "comment": "Malware payload (Mirai)", "value": "076a990494e44b9e1ceb3bfc694dd8a7b68abbb46c30e0449458964c0f7470de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423650, "uuid": "73438d4a-f90d-474b-921d-1f162603a96e", "comment": "Malware payload (Mirai)", "value": "7d4386b2b93ff5ceeb817435364e27813bf726ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423650, "uuid": "50b9a460-c563-481b-b2b2-aab5c7350bf1", "comment": "Malware payload (Mirai)", "value": "61a4f10cf53b17268b62d8b1093aa24f4fcebd7d74dbdecc3624a3cccdf26d3f2b34d24af8d2c648df5681225450a852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423650, "uuid": "2c48f431-9299-475d-8ce7-1b3cb2af136e", "value": "T13F8302BEB2651F81C5FD4C382FB09F119E3616D3B3979B181BD60CDCA9974A1B1480BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423650, "uuid": "7a0436fc-87aa-4a2d-85db-2c003ad7bca8", "value": "1536:ysAE+5LcZV3csiBe5N9epGlNcfOxB62h8Q+GoFXuiPQqt8eFPyQ5Nf+6A:ysA95APcsiEH9VlaMGMyPHt8KBzm6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423650, "uuid": "fee4dac9-8bf1-4e46-a741-5af44d8cb176", "value": 82904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423650, "uuid": "e4cd276d-4eab-4dbb-8ae4-3858b277339b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423650, "uuid": "215d461f-115e-4495-9850-fd5797f6b526", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e71e010-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455829, "uuid": "4a0264da-8306-4bb6-8727-8ec8ba12787e", "comment": "Malware payload (Mirai)", "value": "ea4cb0c8ae0e9c4f91da31ffe1d6b74c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455829, "uuid": "fabb5b1e-dd21-4c44-a6f3-64c36f14722d", "comment": "Malware payload (Mirai)", "value": "0787632c5a42a02fe797e2e593063fa6125ea7b531df90014b2948447776cd8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455829, "uuid": "31e578d4-78d8-4422-bb0b-bfe2b689927e", "comment": "Malware payload (Mirai)", "value": "37059ebf891d42a913fee3954489a7e1867e9b63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455829, "uuid": "cf016032-eba5-47c1-ac8b-b84eafbc3415", "comment": "Malware payload (Mirai)", "value": "04e955463cc0b5d82153e43efec69c9bb9b41b0ed9dfa648ec5f5c6a2a5433c8b671374691c2cdfdf0061eddbbaa85dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455829, "uuid": "0b6840ca-7dd1-464d-a5c1-26425a915e82", "value": "T1B3433C16B892CA56D6C572B97B1F929D331513E8D2EF3303CC096BB47B8781A0E7A5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455829, "uuid": "11220184-4dc9-42dc-919c-12f87259a7d1", "value": "1536:HZmpxA0PwKNKyLdZU/tAeAEieZCEnnesLxH+:HZmpxA0PtdZU/DdieZfHL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455829, "uuid": "67eb3edd-a61b-4183-b5b6-4b8e5949963f", "value": 58472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455829, "uuid": "11ed8407-6b6b-470d-8312-0e15a5d96f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455829, "uuid": "59c300a9-75db-4ecd-9f08-03101739a816", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c6bd64-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455786, "uuid": "b7999767-b92a-403d-b9f3-3e701eace4a4", "comment": "Malware payload (Mirai)", "value": "5c1dcce1d1684344bc77480bab2678b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455786, "uuid": "7b6d4661-fa53-4719-8fc8-61bf640c2397", "comment": "Malware payload (Mirai)", "value": "08d40399a4b63d01fb7aafbd7ff58021e5437a93c8695071e873a23ba4cb8e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455786, "uuid": "8be2a27e-11cc-4fda-b4d2-a31efa328bd6", "comment": "Malware payload (Mirai)", "value": "482762858ab8727a46a1294a6b739b3cf54bdb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455786, "uuid": "b97fcf04-2986-48b6-a66e-2082cc5366ac", "comment": "Malware payload (Mirai)", "value": "c539c75da0a5cb84e894b8c892c02b5157df60e38c9148d8ef8db6a190ed8317bebb8802a5ab43b68724b0266d063335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455786, "uuid": "c83928b7-ecbd-4b69-987e-af86460eacf8", "value": "T10883A44E2E728F7EF72EC33647775E30875423AA2AD0CA45D16DF4065E2020E695FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455786, "uuid": "06b7571f-f275-442d-b1c7-10c5692a99f4", "value": "1536:8mIv0xZeHYauqcBHCCRp0U0tp/spNU1XIfkI9bHvWcp8VBvP1:8mBdpNU1XIfk4PWcpSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455786, "uuid": "416be591-9c87-418e-a9a3-e189f260920f", "value": 84308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455786, "uuid": "1e004232-090b-48db-813f-2ff0d7d25e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455786, "uuid": "0426475d-42d8-4f17-9399-93d48960f76b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666a10f0-3a5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776431683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431683, "uuid": "15503b21-5228-485b-b38f-4b54e93f6091", "comment": "Malware payload", "value": "4a6053835b1d6c5f2aa4091f65f20699", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431683, "uuid": "d9002ade-48c4-47cd-93df-e7f12ab49c99", "comment": "Malware payload", "value": "0ac143da7accb2fa62363146eebc676628d4095614f9d416fdb81ef456348d1c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431683, "uuid": "c89a4272-a52e-4642-ad80-f3dd9a1b36a5", "comment": "Malware payload", "value": "971874e179c2814a999b76275813e7656486fe34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431683, "uuid": "a5a0fa38-a5a3-4f80-9812-44eb5a8c4848", "comment": "Malware payload", "value": "7842b3a5b71d19ee8e97c4fa9a0c97902079974fd7753209470e93be3cac7c48af2f3ff109412eef7733cb3e2457d796", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431683, "uuid": "112836ca-bc7c-4edb-ab7e-f0142ac3da31", "value": "T1CEE18E53E76FA526D9423D3851DCE85E4467D226ACE3C47FC52727562821187002AF79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431683, "uuid": "c1538ccf-80ca-4969-af8c-1c2135062a08", "value": "96:4/UqHbuaJVAk2hq/qn7mRw3hVIQWMw0AkmEY+FP4QHTlYL/I2iDmO54EnxCQWrQp:4/ZSaJV/qLxbJmkP4QxYISXEQQ0Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776431683, "uuid": "8b2b31bf-b0ab-4fcb-a6ca-95fc76744bd4", "value": 6828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776431683, "uuid": "9813fc17-0989-4245-acb7-2ff497b677d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431683, "uuid": "02d7def2-facc-488f-85c3-89badd6e4bf3", "value": "photo-503627059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1efd1d-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404264, "uuid": "c98d48f7-0b8e-41a2-8432-2c353842c08a", "comment": "Malware payload (PureHVNC)", "value": "fdcf4e0fd9e4996823f8db69bc78ace0", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404264, "uuid": "076d334a-4749-44f0-b6eb-14a8986dc4db", "comment": "Malware payload (PureHVNC)", "value": "0b5047ad220c0263f8babf45bf953fec3316d02219d88977f7ed1939765fb156", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404264, "uuid": "9104ca90-5058-4352-b023-91f6d9ed2c42", "comment": "Malware payload (PureHVNC)", "value": "4934e25c32699c7a3b785a77022d17c6a1747e93", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404264, "uuid": "52c960cb-a520-4d91-bdca-4d47e7f30a0c", "comment": "Malware payload (PureHVNC)", "value": "132c7dc42e70bb93041e3f830e8b524254529a8cfe3170cfc177309a9806b5e0a64c15d2cdb617bcdd6bff743fc26a92", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404264, "uuid": "53c2ad79-3f26-4981-a754-2335009db7c7", "value": "T15B84283ECC585279C2FAEA4C99981CE6FCD79F2E240CAA0505F147DA663327272D152F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404264, "uuid": "7f40c194-3ca6-4ff2-9198-dfdef0bc1f8b", "value": "6144:ZkScduNrQ/K2y1hPHhI1px692Lw8d0kR4BBV:ZkScdt/K2mh8xU2Lh0U2BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404264, "uuid": "740f944a-fe0e-402e-9081-71d68b943f74", "value": 406962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404264, "uuid": "8cee566d-8714-4191-bc9e-e5218c1641e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404264, "uuid": "dc2cdb56-5f28-4aaa-8777-bbde468ead2f", "value": "0b5047ad220c0263f8babf45bf953fec3316d02219d88977f7ed1939765fb156.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650bb937-3a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776400757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400757, "uuid": "e991808a-1720-4ea3-b6f3-08de17b0e045", "comment": "Malware payload (Gafgyt)", "value": "a5715fe71993a335f2cbdd486bfd79ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400757, "uuid": "1dfb9911-737c-4571-b67b-0aaf88146422", "comment": "Malware payload (Gafgyt)", "value": "0c21fd92d6daf1d94d376f7f0b72570fc800967fe2a9c64ad6316fcb4cb26aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400757, "uuid": "0a102e26-018f-4607-b536-ca3fcfd7a578", "comment": "Malware payload (Gafgyt)", "value": "13c380c3975d7e8e1839bc47de7f24be9e4098dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400757, "uuid": "bc7a01e5-fffa-49b0-a882-d37a6cd91398", "comment": "Malware payload (Gafgyt)", "value": "489f1e506cec955bc7052681761e9e7824ac9c72a3bf66fbc1c7157b25298a3ed5ced2a94f22f0326683fcf056c98c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400757, "uuid": "e42d95ce-fd5e-4992-a509-7050e1b11603", "value": "T16CA33B5BA741D6B3D14315B216939B240133FE3F195A9A0AF3A97CB8CB390C87522F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400757, "uuid": "171f9a68-270e-4d3d-bc13-fcea808475a0", "value": "3072:MPkRU9AUmH1rfsABYBfTw9w9fM0mqAgcVyZIcBI:VR0AXRpes9w3mqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400757, "uuid": "dc0a74d7-545d-4442-962a-8c37993ec6f6", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400757, "uuid": "25ca48ac-6b67-4fe7-89ea-2631da85f52a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400757, "uuid": "9cb1c45c-5c28-496f-a8a3-776b6d3099d1", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d30b82-3a32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776412384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412384, "uuid": "bd038965-8a88-4ffa-9f9a-86e5c0c01818", "comment": "Malware payload", "value": "a3870ad5f8114ed7d68f5100ea7a4a49", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412384, "uuid": "a48b761e-4887-4934-a4f8-c853d2d210b2", "comment": "Malware payload", "value": "0c31586cd59ccfaf7fb8da14ae4aa28bd7300443b4e17a86aa59cfc921ecd62e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412384, "uuid": "0cbde5f9-269c-45d4-8d3f-9a91c1e61c33", "comment": "Malware payload", "value": "174cc2af1c800b56b45f44b20b1b9b7a0c15a0b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412384, "uuid": "d6892b41-b1e2-4566-ae05-b80045bb3edc", "comment": "Malware payload", "value": "edf62b793176e98b5e1768e5a7a418719e126b5d330c867d1401fc0509ded840fd1dae182622f05d3796376268f31639", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412384, "uuid": "0f627cd4-55e5-422f-a9dd-96186fe1cb1b", "value": "T1DBE4CB6618BA5510820761EB573B93F97573C983BA0435B8F84FF07CEF8AD2C56A0639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412384, "uuid": "cebc06f8-7a30-4b04-b097-1656f9c3c678", "value": "3072:YVt7MrYb/YD7/5DCAiDFa1wViRm0p7vqX18xj4qraerR5HRdaghStivs/t/1tFCP:YVJMaYDV6ClvqXorTrRljCk8/7MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412384, "uuid": "b76e1ad9-674e-4e83-9dd5-ca6433304c6b", "value": 704348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412384, "uuid": "b73fa178-38e0-4c9a-ace0-b79d4cbbb773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412384, "uuid": "08fef2a8-926c-4785-96a7-6fdb52471716", "value": "00886562535_IV.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b00e48-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776426419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426419, "uuid": "b2880252-37f0-41a1-9879-a900c93bf3e8", "comment": "Malware payload (Mirai)", "value": "a51ba6a10ab67b8d36788595a7be55d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426419, "uuid": "7d992a79-2223-4140-9664-2c34c6ad518a", "comment": "Malware payload (Mirai)", "value": "0c684bbb442e5e1a3d36b12c16c173a4767d55d251b293c3db2dfee3ec2e4ff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426419, "uuid": "de1db711-f77f-4e94-891f-d5c210a4eec7", "comment": "Malware payload (Mirai)", "value": "7a8f745430ea5a4e5e41ad026a58258ebe03ea9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426419, "uuid": "b036b050-8268-4460-bde8-bde8a102177c", "comment": "Malware payload (Mirai)", "value": "c2115618debd44ef7249600e7db8c67f49b21986cda034cb9e7d4a8b99f24f6b3638d5e5089c74ea23179c4fb35208fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426419, "uuid": "52b83f73-4715-49d8-8942-b62485686973", "value": "T1DF83026893620A9EDDE8C0FBAB1907C46D620B6264035C1284EBF3D46EF874B6C26D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426419, "uuid": "3df1289d-108c-4a9b-b0e6-adc8186c698e", "value": "1536:ldOrKWwjnaOX5D/VY7vjHMgxDX3mGGsgmYSP7rZ6tC7vguvGCClJaVJuB:lkKWwWOJZYfs8X3mXsfYO/ClJaVQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426419, "uuid": "5efbbf6e-d8c4-4457-8412-3be0c1c8b4e7", "value": 81000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426419, "uuid": "e6eec046-e43e-4c47-a443-351271011309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426419, "uuid": "00d6934f-57fa-442e-ac86-6d977d7885ca", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869ac20e-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404250, "uuid": "41a4579a-a698-4c0f-bae1-ebe1ab6c6df8", "comment": "Malware payload (PureHVNC)", "value": "2e5a975223d0f19876e2f3451fca0379", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404250, "uuid": "cb2dc7eb-5dd4-4eee-a641-dd3c3fa143f2", "comment": "Malware payload (PureHVNC)", "value": "115950f9dfc49feb7152b613f48ea81f1b5940fb7db6bf4cd18ce3b87fb10e7d", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404250, "uuid": "76bc6163-2615-4603-935e-13ba578e730a", "comment": "Malware payload (PureHVNC)", "value": "0e1312c23b7e82bea0cc078211f5eea8c79fa24b", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404250, "uuid": "e2a3ca7c-966d-4a82-8d60-1c399644bcfb", "comment": "Malware payload (PureHVNC)", "value": "2626fc2b238a178ba199f1850d1584f63bfb16200849b758faac019c87077fb6707770d20fffe27dfea3ab786e47960c", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404250, "uuid": "7912f626-66e7-49bd-8e7e-bcd75588d9a1", "value": "T179842A2439EF501DB1B3AF698BE874969E6FFB732B07A05D1051038A4B23E41DDD163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404250, "uuid": "b75c2489-ed7e-42c1-8758-0ea04b1e0942", "value": "6144:dWHPEDCSUSMSwsax4Fs3unj0xxseBpdqbQwkNrXLeLqzuEek1YxqmqZ:dWHMDRUSM3Xukunj0x9pUkNe4Qrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404250, "uuid": "eb6d1b81-ad86-401b-850e-1e8d726c50f0", "value": 400616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404250, "uuid": "c5d4ce07-04e3-457b-87a7-dd7f118abf2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404250, "uuid": "50b4ac04-59cb-437e-af15-16f2e34a0e63", "value": "115950f9dfc49feb7152b613f48ea81f1b5940fb7db6bf4cd18ce3b87fb10e7d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf82624-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456149, "uuid": "a7b9502a-c3ff-4ea7-8cdf-702fc3912787", "comment": "Malware payload", "value": "fb71e473e8c1afc358b162c441864aad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456149, "uuid": "4df2423b-c4dd-4105-b126-b7d423d8cccf", "comment": "Malware payload", "value": "128eb3f2efdd74446cec776cea0b160f501be792d92897ddef78ddd257757bc0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456149, "uuid": "e328a858-1231-4249-a24d-8662feb2cbad", "comment": "Malware payload", "value": "cc84d5a1001996b82fd100114b517b46f3bd21d6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456149, "uuid": "12ae23f0-85cb-4a27-ae77-4f981107252d", "comment": "Malware payload", "value": "7ef22a7cd174e2a477ed67c67be2e3c8044ae0104e29d4487f44cd61c5b6f8385298541d1e8069dad615798be3a359ca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456149, "uuid": "e9f2ad7c-6f29-4d40-81b9-c21276666922", "value": "T101D2E11E90C7638A15E87A6B904AFD930C79734C87790C2E27349D5C2A2CC1EB977A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456149, "uuid": "80f0e964-3d82-4a67-bda8-20a008125af3", "value": "768:UBeavD+e5OjKM+WebTm+fFDoSEsxiXOa0BoFj70o+:+eIUKM+nJBo+xHa0BoFj7p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456149, "uuid": "5680fa06-c56c-4b3f-a138-33a32ba8e174", "value": 29371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456149, "uuid": "818ed8cd-d61f-468a-9084-4f01bf76f344", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456149, "uuid": "bd60e39f-179c-46e2-a56b-7a8a060162d0", "value": "2026\u6d59\u6c5f\u4f53\u5f69\u201c\u8db3\u7403\u5b9d\u8d1d\u9009\u62d4\u8d5b\u201d\u62a5\u540d\u8868.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17185206-3a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776411364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411364, "uuid": "df063942-5b9a-4143-ad5e-0f59310c0c30", "comment": "Malware payload", "value": "a592170b86d97c9c672cc17cf23abd97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411364, "uuid": "8836d0b6-bd4d-4920-9fe4-428a79269fa7", "comment": "Malware payload", "value": "139c668eea1feb2ad0de12db2d59f3e83218c369b04ca64957a6646d21116977", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411364, "uuid": "b2287909-1214-445e-8ca1-00916a4293f7", "comment": "Malware payload", "value": "132cd7c7e35492c80a45a107770bf33b1d822b7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411364, "uuid": "500800e9-ea1c-4242-b152-a5ce65a440ac", "comment": "Malware payload", "value": "eca82cc76b3b82fb19f23c4123158d9e3f1a9e1bc4cb99e5c1d107e79d8fa3c74a27455d4a33757e535efb4501e4722e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411364, "uuid": "77f06d18-f787-4379-9f6a-a2d97c302870", "value": "T161641D38ADFA402AB173EE15AED47493E92FB763370E585D10C10386472394AFD9963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411364, "uuid": "15e8d968-02a6-4114-998a-e71d0c593ea9", "value": "6144:3OMTVgCHM78Y/gpax9cbxEMCtsS5/06x3t0rtK6huB2KS6zOy87EjNY:+M5gCHu8Y/gI9cbxEMC586Vt0r1/GOWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411364, "uuid": "d8e86c96-d7e2-419b-94bb-87d3aed5b975", "value": 311818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411364, "uuid": "beade909-5a73-411a-a39f-be27be4168b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411364, "uuid": "300472d8-7c08-4a4f-ab74-cc995fddec54", "value": "SKM-710595310.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98188e15-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435203, "uuid": "38d93f2b-f931-4f15-927d-0baa619587b3", "comment": "Malware payload (PhantomStealer)", "value": "7bc905d05b977dd45badaefaed263c7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435203, "uuid": "01d2c44f-6584-45f9-8823-7d73e5ab2f41", "comment": "Malware payload (PhantomStealer)", "value": "14eb9cbb99a09dbfe24fca425f8a9310df1e27e4ecc9ef7529159d99656bbe57", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435203, "uuid": "d8790f49-bd18-4b0e-9d44-db9af2731bf1", "comment": "Malware payload (PhantomStealer)", "value": "979bcd3c5cf842d81feb6a53c1fa95e5dcc9c3ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435203, "uuid": "2cf7b088-8720-4648-841e-0acaf36787b3", "comment": "Malware payload (PhantomStealer)", "value": "59acf2695d6128c8d718b50a92fa82dbd26620d8cc05b6d0976901f7983708d54694ead7f7611a267ca83c260341e555", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435203, "uuid": "cf74983b-42d9-467d-bded-a62ee5ebe39d", "value": "T1FB26021189C42FB9CFAC5A1C80FE1A0E93F05A8E5426B589FB33BD46AFE7604511B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435203, "uuid": "8ac3d270-4c95-4dcd-85da-4d297497c557", "value": "49152:rP1gTROuAKLl8MiWZVVNgnvigYYmoAz4R2odFcc0aq9E1szk:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435203, "uuid": "afd8946b-6eca-40d0-a5d1-927294059c1c", "value": 4742349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435203, "uuid": "caec0ca0-e3fa-48d4-a7d5-365cb0ab71df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435203, "uuid": "a9aa3c9b-50ae-4235-8e10-6e35378f634e", "value": "Attorney form .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10dd53d-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776435298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435298, "uuid": "f58bf31e-511f-4d14-9b9d-0e56463eb72e", "comment": "Malware payload (VIPKeylogger)", "value": "6ff29654e6ac43836125013720269828", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435298, "uuid": "f9536d5f-77e5-4ae5-bc3d-83b5a31ff608", "comment": "Malware payload (VIPKeylogger)", "value": "1528a88e0c8b038299c6d35ae711bc9bc8e099ed8c8340180999fb0504598e8c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435298, "uuid": "4d229625-5067-47fe-8075-4eec4cce3cd4", "comment": "Malware payload (VIPKeylogger)", "value": "44eefc72ef1a670549d34450bd82738f1f3bc7e7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435298, "uuid": "65c405f2-f7e4-448b-8bcd-b7762889e561", "comment": "Malware payload (VIPKeylogger)", "value": "0176f13052b171770e8ee486018674d2a50a413ae38cb46a44bbe34c0f5aad48e8f0d406589a9446571fcc5056e6524b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435298, "uuid": "1ba7e815-9713-4131-8190-2ff4eb6f3efb", "value": "T106C2623EC5845FF40BAF51E6298F3A51A5190313B6352A0EF9CED89D3B29350CBE50E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435298, "uuid": "bdbe47d6-0e44-491b-a18f-3b2dad2a3a68", "value": "768:KuS2CRP6s7PdlQBlCudvEFhZ2xsW8XzxuT5AAm:LOP6s71lQLCudvE92xs/Xzw5Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435298, "uuid": "53cfda4e-4963-4040-bd89-d817a1373a31", "value": 27581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435298, "uuid": "bf87f30f-b338-4b51-ac50-cb646263390e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435298, "uuid": "f5f7d481-8fc1-43b1-95a9-0285f7c01bc4", "value": "\u0444\u0430\u043a\u0442\u0443\u0440\u0430.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a54c44-39f9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776387931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776387931, "uuid": "a1dc7cc4-c022-4d34-a4a5-d1fa2e0f630b", "comment": "Malware payload (ValleyRAT)", "value": "89554c7f8ecc5f7cb6e0e258ddcb75bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776387931, "uuid": "1f5d759e-f361-4683-b8ea-cd3b9fcdccf2", "comment": "Malware payload (ValleyRAT)", "value": "15b8d9cfaf97050ef3ec3f3850517d139f8f4908216830eb930d64a59e464a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776387931, "uuid": "bff3d8d2-8679-4868-a090-ee12cce9ddc0", "comment": "Malware payload (ValleyRAT)", "value": "7cdf6fb44f20226cb040bb338768a7aa68033442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776387931, "uuid": "3ac9ceab-4504-4a91-abbc-657318683c23", "comment": "Malware payload (ValleyRAT)", "value": "b71ae4615fd70dc56410a7743c6541215f20ad47e5b4ba0e3489d62f534a137e690c7380d77e35ae6349e13dbb76cbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776387931, "uuid": "d44e5f5a-2d79-4f3f-8b3e-ad444cc60c73", "value": "T1BD846B46F79009B9E177D23CC9630B45EAB27C595720D74F13E843AA1F237A1AA3B724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776387931, "uuid": "fc2d0cc2-78f8-496f-9bfe-b4eb156c1db8", "value": "027c69a5c3a6d1d0fb7ff06b7149d2e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776387931, "uuid": "de4674b8-1c18-4957-a708-a1689a54caf5", "value": "6144:3FC7LlDKYQYFe5Ua0krrTD+M2d5PaPeYC2:VC7BDVQMv5Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776387931, "uuid": "df21e80f-ebab-4c8c-b8ab-8101f1f47a15", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776387931, "uuid": "aa399286-4068-42ec-9ad5-4e9f022644b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776387931, "uuid": "e587028e-3385-424d-b401-98765c838057", "value": "Microsoft.WindowsAppRuntime.Bootstrap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e842cad3-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455953, "uuid": "8ff0fe22-edd4-4434-b6fa-4d4713bdd5dd", "comment": "Malware payload", "value": "eac2e6e150c9c3e649ff3d999c7c292d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455953, "uuid": "12bf2ac3-59aa-4ede-8960-64d9efae61a2", "comment": "Malware payload", "value": "16e5dff97af159b8093c1cc0ad59d12a141bcb6e0c530ed86e22c7f61f049c3d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455953, "uuid": "422db87a-ee02-4192-b821-a38221e0405a", "comment": "Malware payload", "value": "be2d73b72fd32adc47c9cc7d6f8cf3b5d959c287", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455953, "uuid": "aa7b3d89-3256-4f57-a8fc-0681412b4bce", "comment": "Malware payload", "value": "76b4b08316cebd06e71f53a26e3281aa57cf3b0d18864cae510bcaf603b8cc250a6c314cba7f780134c0726188f8011b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455953, "uuid": "ceb777d0-8b6a-4b1f-87d8-d7c2204c8b50", "value": "T15DA6F007F946CAD3C56D83F4AE230FA96E171F0982512AE700653A6F3E7A2D24ED55CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455953, "uuid": "dc0a4906-752d-4d93-9878-febc19779972", "value": "49152:Ozivpx1eyc0zB2dUUclFe97NIvH1JMlxdT2FcmzhzdGGKQTOTpUJYqZ0cgdoiv6:OzivUHUBM7cWow52FcmzhzBlTZ0tdd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455953, "uuid": "1c21f1ab-b5c4-47d4-823c-420f48e6bb04", "value": 9969272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455953, "uuid": "58b4f5d1-4fc5-4f80-93d1-a71cc520f0e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455953, "uuid": "828f9b6c-0f99-4dae-9842-08d5821cbea8", "value": "Among us .apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbca5ff-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456150, "uuid": "060fe3d3-be8e-48e4-a601-fd571c1dea7f", "comment": "Malware payload", "value": "bf16e2bfc1ec84b59406a3fa03fc8a98", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456150, "uuid": "ae66e29b-d1ab-4bdd-af80-36f062f31cae", "comment": "Malware payload", "value": "17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456150, "uuid": "18c08356-05bb-4b2a-bb71-fdf7e1174e2c", "comment": "Malware payload", "value": "a24e6d8ea5593775230dc4c11ab6a69a1c4ebb6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456150, "uuid": "583653c0-033c-425c-a7f3-aab32303eb0e", "comment": "Malware payload", "value": "1ebce10843d0cf2bd9301a49a7f787bf14fde149debab667f43caa1e2e751b38e9c3aabd6194b293f0b082743a4bf820", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456150, "uuid": "7470f502-4f65-4926-912c-b276390c457b", "value": "T19FD5F044FB999E5EC8F793760C396635547AD827C703C383C8792679648BAF40F822E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456150, "uuid": "9effeae7-845a-4294-aefa-2de43b6bedfc", "value": "49152:lcjJbgYzJrksfW5gipFKVKU8d2GtULzFVhpVYTcOWMoUoGtTK596D:lcjhgexLfW+i+VHS9qvFrpVYTcOWHttu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456150, "uuid": "cab31a94-c181-4dc5-955c-4b8fb1964844", "value": 3016259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456150, "uuid": "aff29ebf-1261-474e-871c-abf56a4f24e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456150, "uuid": "98172528-f213-4edd-8f35-9e197e63605c", "value": "sagawa(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c715c5-3a8a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776450094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450094, "uuid": "acb7fb9f-28b6-43fd-9551-bcba108e00d0", "comment": "Malware payload (SantaStealer)", "value": "893a4400d0ac1a50fcbb5eb2c18382b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450094, "uuid": "4532fc68-dfb0-4ec0-8084-ecd5d0517831", "comment": "Malware payload (SantaStealer)", "value": "180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450094, "uuid": "6bdf61d5-4e8e-4e4d-a76a-9657f9852c8e", "comment": "Malware payload (SantaStealer)", "value": "8176000428800beb055f12ed690fb6e45a187ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450094, "uuid": "0fb6d451-880b-4adf-9570-7ced50cfe788", "comment": "Malware payload (SantaStealer)", "value": "ef6e824d151f57b4cd44484f586bc4d9d58d84e576ea6d4d2b302058d856855d5afa57b5b5fbc8622eb7a8e1cc3b58f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450094, "uuid": "ca075f97-7d17-4b79-987d-56d721226c62", "value": "T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450094, "uuid": "2d50e38f-d281-4c98-9935-3276523fc655", "value": "ed13896c19768acfdb259814af1436d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450094, "uuid": "dad1e426-a6ef-41d5-b86f-c6d0bc95889d", "value": "49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776450094, "uuid": "03ed6d88-28c5-4d90-84dd-19cc9f9b3f87", "value": 3183104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776450094, "uuid": "9dafb708-1dd9-412e-a8ce-f8adcdb05158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450094, "uuid": "bd36f0da-2360-4c71-8873-dd199b9d1505", "value": "payload_2026-04-17_10-15-57-336736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec27e93-39f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776384104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776384104, "uuid": "e9ed4ace-cc00-4d97-bbfc-50dda85a4973", "comment": "Malware payload (Vidar)", "value": "719b4758b42b54e95ed2095c3afd6d0d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776384104, "uuid": "5ba644a3-07cd-452e-9b9f-d53de08f9321", "comment": "Malware payload (Vidar)", "value": "182f0c19623a4b59cb266367e4c5acc0a914c66e7b1cb09543d90eecfdfc80c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776384104, "uuid": "b28ab4a2-e5e5-4a9e-9df4-540f994aec4b", "comment": "Malware payload (Vidar)", "value": "39324a3f03551147dffd749f2e6dc7f8ba0661e1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776384104, "uuid": "7f899e9f-ed04-4103-b5f0-1e230f7accb6", "comment": "Malware payload (Vidar)", "value": "8892b90953a28a27c877631075838bc5f66494697e4913e339c25b95312142aee8742ce8e20d9bb74575d5ad596230ab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776384104, "uuid": "7e74729a-3226-4bed-bcc7-52df646c4580", "value": "T165A58D56ACA144F6C0AAA7368CF721967B70F8090B3273C32E90B6792FB27E45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776384104, "uuid": "eb128787-e312-4131-802b-c777dccc4a81", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776384104, "uuid": "c57f0fcf-02c4-4234-931b-22b9ae2b46db", "value": "24576:+bnxEsKWycWcBlBmna7xFzrr4GCXxtRVsEcw+X98y0Fhele5n923ch43t:+bx7KJcBb0Ot4xxtzp+wcTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776384104, "uuid": "05600b7e-ff75-4ba4-9516-54c5eddd4931", "value": 2203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776384104, "uuid": "50239887-46ee-4412-9ea7-820500c2f0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776384104, "uuid": "ea435d98-2d6c-4fff-94fc-5bd2f41e0137", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c375aa-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776458335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458335, "uuid": "f1f4eafe-efec-4613-bf1b-8bc019e7fc80", "comment": "Malware payload", "value": "a75e4ba63db86418595bf4719e95dcda", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458335, "uuid": "437a45e1-51b0-4bd9-9135-345dd21a4644", "comment": "Malware payload", "value": "1a1239b47c22bf71fa5d37377fe6d9a2d71f34ba87542d26434a926002d28590", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458335, "uuid": "70d451a2-7331-468e-821b-226fa00e4e2e", "comment": "Malware payload", "value": "eff67235751e220da615fe14e1480fe653bffb93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458335, "uuid": "4a7f6d13-2a69-4d3c-9856-075f06364301", "comment": "Malware payload", "value": "0a8ccb0d0ba1d962286b122584186ccb73bb703c2a8ab93fd1f803de45a1d5972472bf843dc62f769b3e0c346afe3c78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sz", "colour": "#016329", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458335, "uuid": "f5edf7fe-c1df-4003-9d3d-936a638626cf", "value": "T12394F1017683843ADEFE8A760952E9259B2F74A4D7C1DFCBA35947A97E340C04E33876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458335, "uuid": "bfce725a-c84a-46e7-ae86-6be6f773d305", "value": "e37b247f87f18684fb0a921dea57f737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458335, "uuid": "68d9aa26-f4ef-451f-8814-900a6bf009af", "value": "6144:mGgepcF/nhefrlChgXvoLLcdxXIZUuiIfGdncJo/4S9PBnh5KlSxr:HgepsWCufofCxXjBEpJy4S9H5K0xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458335, "uuid": "fface543-6d43-46ee-9245-a63c237291b2", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458335, "uuid": "e7e66518-8c56-49a0-8f3f-9adf65c0830e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458335, "uuid": "405ceb9c-1072-4736-bd84-bf3b0cc84ccb", "value": "cef_frame.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7ab71a-3a70-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776438888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438888, "uuid": "a028d580-4dde-430c-9847-988c7de10190", "comment": "Malware payload (Mirai)", "value": "2064e33cac1d2984ab6a861bc7e6a1da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438888, "uuid": "cd9f3761-d450-4384-b28e-b73ce7327cd6", "comment": "Malware payload (Mirai)", "value": "1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438888, "uuid": "7ff38a87-aa5c-4dbe-901f-037b4da683d2", "comment": "Malware payload (Mirai)", "value": "fee50e2bf4eec65d54d6012a9fac7a59cf43e2a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438888, "uuid": "ee44b3d4-e226-40bb-9246-6e45544d901a", "comment": "Malware payload (Mirai)", "value": "291e578bc5ef146d99ec7dbf7e721bd974603a1ee14711ef2fb808e56c23efe2899652a9d62c07c5477cc0732d3de7e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438888, "uuid": "03f898e7-48b6-41d1-8312-c4d4fd7dcd22", "value": "T15251FD9A02C49B31D65DD64FB7F4B174610AB0C3ABDF9A04E99C89AD8EC9D4C7385F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438888, "uuid": "e69fe4bb-12be-423b-bb76-48c4bd689751", "value": "96:CovCeC2JMkbabbiBgn7nuZo9b+H676bwH5PPPA3CDA/2fQ6:Cov3ju/n7nuZo9b+H676bwH5PPPA3CD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776438888, "uuid": "75a85f19-9e53-4015-b85b-b4c0d469f22b", "value": 3131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776438888, "uuid": "b95eb304-d30f-4455-b77e-640045dc33c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438888, "uuid": "a3f36767-1cd4-450b-b560-f8aac92f9f5e", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbd46bb-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456066, "uuid": "4b6e6b0e-1d46-483a-a05f-84406fcfa4b2", "comment": "Malware payload", "value": "db8e6601370f1b6d0caa4498a503b361", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456066, "uuid": "95fd1d3d-e8dd-4173-a18b-3f2ef6fe7150", "comment": "Malware payload", "value": "1b521cc0af5d8a5bdede925184b679b546258f28d6234c4988023111439d64e1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456066, "uuid": "0692a376-a283-4b32-99b3-7b21f9a8343c", "comment": "Malware payload", "value": "7892268f65779280a9ed8d8251ff0ca02dbc775e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456066, "uuid": "a0db9aef-4b42-4ed2-8c4b-4ca56639a6c8", "comment": "Malware payload", "value": "ad2c60b94a4fd77c296043fba63e51e765d76d0a10640710b5be7e1cc73b342eeaaecf97f6de55a1e1e35e0c52a9cd32", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456066, "uuid": "a391af02-28a3-48b2-90d8-d0d4856bc8e3", "value": "T1D517F103F906CBE7C56C92F06A130FA56E5B1F08D5816EE710247A6E3E7A2D21ED65CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456066, "uuid": "4cb3aac7-121b-4ce8-a71e-4ca26bc87f41", "value": "98304:kyexKApGO444h3FK4GC1bmzhzB/TP0tliB:ky27pGLIC1KzXA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456066, "uuid": "7ca8c14a-6f4b-4f15-9e23-d4824c46a5df", "value": 20192883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456066, "uuid": "6624dab0-ff65-4591-98f0-3a988b57ac96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456066, "uuid": "7bb92913-f617-4c0d-aa83-9c3d528a5f51", "value": "DELTA-ROBLOX.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958f07ee-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455814, "uuid": "9f75e427-eb4d-436f-b0dc-3cddc5e0c623", "comment": "Malware payload (Mirai)", "value": "8dddc0804fe3c2203320641ed9fa5641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455814, "uuid": "d238cd17-96c2-4a77-abc8-342bf0370117", "comment": "Malware payload (Mirai)", "value": "1b59fae7d89a001171b836489a09481621827cfb400a8551e91f11b50ff6f083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455814, "uuid": "eb16a454-a99d-4121-925f-c86f285dfbb3", "comment": "Malware payload (Mirai)", "value": "e008d251a6677fd3c0c493c1ced6fcbb9bd3af11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455814, "uuid": "b098f76b-76d0-43f4-8bad-16a5f9e45b94", "comment": "Malware payload (Mirai)", "value": "e8fdcd02f2a72668f9a040bb64de00ea9cd23c21d00ef1702c269aa75a03fc53f40918d945ede7256f6ed57d4fbd506f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455814, "uuid": "d4370787-cbc4-4fa9-88a3-11b5ae867b3f", "value": "T1FD334A45E643D8F0CC0114B028BBE732BA71F8351074F957DBE9AE7AEC66A11E90679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455814, "uuid": "77f27831-379e-478e-801b-e3cddf6780f9", "value": "1536:CRsWYHzbEKGDhihchwjhF4bRquW6RGsIliggg:CRFYHvE/swbRpnPIliggg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455814, "uuid": "fa405cfe-72ea-4fee-bffb-871b46901fca", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455814, "uuid": "74cab447-fbe9-4ba8-ac34-a17a39d150aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455814, "uuid": "7420b57c-cdc7-42a9-82c2-d697c569e6d9", "value": "hexagon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c687561-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776434351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434351, "uuid": "ea082da5-add4-44f0-8488-944ecd184b0c", "comment": "Malware payload (RemcosRAT)", "value": "c37a08f1d4f9448f9097d126ddb72a6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434351, "uuid": "2f758e24-bb8a-45d1-9441-283dd0ced5fd", "comment": "Malware payload (RemcosRAT)", "value": "1b74c34fb731f53604a0e2331bcc425a172b4760c9e2d6b21a4acf0f2511f9c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434351, "uuid": "1d07b7ae-9a68-442c-aab2-1f2161b70129", "comment": "Malware payload (RemcosRAT)", "value": "393d7a20ce731cf990274d0c0862d48ca4bb5484", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434351, "uuid": "52906d16-4c54-4173-ab07-4a394628f8ff", "comment": "Malware payload (RemcosRAT)", "value": "0ed7d4575aa4cbc1504d7deb21adb53c8860f513c8de6ab871c443084f1f058aa511fa7965729a536aa318dad0ae4b76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434351, "uuid": "700c8a68-efb6-43c2-b4a8-00948eb46340", "value": "T17A34190AED2CB578BCD0BDDD40F6436349B2B90238E456D75AAB33427D205A381F7B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434351, "uuid": "ba05f84a-5f38-4230-aa2f-d0e9daaf032e", "value": "1536:a732a16Spx7F5E0jVqNVQk+DJ4J6WNHsvYfYIk/YE0jVqNVQk+DJ4J6WNHsvYfYD:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434351, "uuid": "fef4bf48-c03d-48f6-8ca8-653604cbb28f", "value": 242758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434351, "uuid": "41110ccd-a21e-4486-9667-a7fbc221ad4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434351, "uuid": "fb8df9cc-42e1-4d22-8efe-f67ec9280d6c", "value": "Rendeles_HT0010417026_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ced75a-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776435499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435499, "uuid": "a8200926-68e9-45a9-931b-29a703da482b", "comment": "Malware payload (MassLogger)", "value": "30c8615f72c68780848e7a3315f4be66", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "TA2536", "colour": "#7F0DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435499, "uuid": "b4d25bc1-ad0c-4b13-9ac7-5dee891ab9ec", "comment": "Malware payload (MassLogger)", "value": "1ce25579ab6c482c4ef5f6ab65108df53493afd97488979f67c82965339a8730", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "TA2536", "colour": "#7F0DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435499, "uuid": "3267cacb-3fec-4506-8993-5db782023639", "comment": "Malware payload (MassLogger)", "value": "226a6d21837c87673799e0f7166d35060b3d95af", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "TA2536", "colour": "#7F0DF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435499, "uuid": "4f8c821a-636a-42f2-b53d-4a7572dad96a", "comment": "Malware payload (MassLogger)", "value": "2d545c3d1d628d857cb73768686d33b9de4b16fb662c5755932019285a5e5b66fee2f2183e198efc81333ed1dbc43db1", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "TA2536", "colour": "#7F0DF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435499, "uuid": "9ff52ecb-e2e0-4562-83d1-0db82f9e2d36", "value": "T1E9453310FA989DEB0BBC872D70BB2D1C97924AB2B45DE91017DB5141023BFF56637C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435499, "uuid": "be19969c-62b2-4ec1-8af3-bf33dd3c1486", "value": "24576:csSrIJObgccZurTgeoNAUvR6aQ4wwv1NxL4+d:wHbgV4rvU4j4n1f4+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435499, "uuid": "11ea701b-c398-4e19-b544-9d41359ef0e3", "value": 1224397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435499, "uuid": "b0602c17-3497-4dcc-8446-250c14cd7111", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435499, "uuid": "95cd2bbc-6229-40cb-9daa-45529824c7e3", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a619f2-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456137, "uuid": "a86ce1f6-f42e-4d06-9f31-a1580770b1e3", "comment": "Malware payload", "value": "bd4f6c073cc198101cd7f534a51a76ca", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456137, "uuid": "926c3e19-f75c-458b-94af-39c8a39e09bc", "comment": "Malware payload", "value": "1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456137, "uuid": "a2967477-67ed-4b93-b000-b7b864635560", "comment": "Malware payload", "value": "420ce94450a9c601d74e8f582b73e2a3d746b99c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456137, "uuid": "e06bbba3-259d-4636-9192-c1b548384ab1", "comment": "Malware payload", "value": "32ae415f96d6661a77c57eb018175d0fbed4a27214ad99a1777c95e590319e522ca2986cbfe433a0c117ebe1ec278e73", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456137, "uuid": "0e4feea5-4bd9-4b45-b38e-aa7ff2a207e7", "value": "T17FD5F145FB999E1EC8F363760C3966365479D827C703C283DD792679288BAF00F852E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456137, "uuid": "1c23bcda-b43d-4b4a-9564-0ca28508afa7", "value": "49152:vCMv4opCB98uQWetkuwykJgZCYyzBVvkjnY596acjJbgYzJrksfW5gipFKV3:vcokIWc0haZsH8DAlcjhgexLfW+i+V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456137, "uuid": "928435c4-c854-4ec2-8bf3-4bed1b62d130", "value": 3016264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456137, "uuid": "f1962982-9a3c-446f-b6f4-8b7bb9281e87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456137, "uuid": "b4573fe3-9b57-415d-a048-d7cca443500d", "value": "sagawa(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2fc04c-3aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776465895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465895, "uuid": "3bef3bf6-b53b-4d28-81ef-da49784d530e", "comment": "Malware payload", "value": "3cbe71813427b49dfa0398cdb59247c0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465895, "uuid": "e21b9d58-0325-4aac-8628-14f15784c64a", "comment": "Malware payload", "value": "1de4e0d71b201834a2f531cdb6b49b08369c943ade2a30bbc58d5af6884dc47f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465895, "uuid": "919ac67b-a074-44de-bb72-35986c43b9a9", "comment": "Malware payload", "value": "567e5612add82365bc1669cf4e3c203ab51c71cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465895, "uuid": "4cc0e2f9-ddba-469c-98db-8021d8537279", "comment": "Malware payload", "value": "ebeaa0dfe88f38f769347f4a3b7ba3192105d1b7a1cbd12fd649d5aee5ed22e89fa8c48d5ad4275bd1a0566c55062c92", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465895, "uuid": "4b8f8626-bce0-4ef3-8758-84b497401a05", "value": "T1F1B58C0BACD518F6C46A57328DB626917B30BC180B3263D72E41BA783FB6BE05C76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465895, "uuid": "db0c20d2-5eba-4cf8-924b-deb6b63c3578", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465895, "uuid": "85702e75-39dd-4823-9a9e-07b96d518322", "value": "49152:zleCH42RqXiqBTj3GYSUKWvm4mNNE8Eiin9fk:zl7YdV2U1vVp0i1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776465895, "uuid": "625c4776-79b9-4fa3-a2b3-0bd725290210", "value": 2353368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776465895, "uuid": "b194249d-b796-45c7-bfa0-c66fe7dfce23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465895, "uuid": "c1c3fb6d-d7f7-4a4f-8afd-9b2182579739", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47c315f-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435707, "uuid": "e2436ba4-2394-44e2-86fe-6871c15c332b", "comment": "Malware payload", "value": "28b991c5a7a1f3e47a378187ae0fdf43", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435707, "uuid": "f6a78120-8cdb-48b8-b6c2-2b30da804cd7", "comment": "Malware payload", "value": "1efebfa40c0c675012dd148d80ab0f5a6c293423efc73a966ec56b26af64a288", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435707, "uuid": "440952cc-d34e-4497-9516-4dc360513fd7", "comment": "Malware payload", "value": "459263e8755efb9134adc5013c2c66cfee932c29", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435707, "uuid": "84ae9d91-f342-43fb-8526-e64d69cdebec", "comment": "Malware payload", "value": "4ac9e302a1169377257eab97e7f17ace57c7d0288abd9a4194a7b43ce14913fc721008e86e13cb70ecce324000ab9df0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435707, "uuid": "20cc5c35-01db-4b70-9352-4d4f8c7d66ef", "value": "T192F62287FF84E99AC4F75776C57643B240474C624B83CA876D08757C28BB6E09E4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435707, "uuid": "c47e5783-0bc6-4f13-b0ed-86b8ca810767", "value": "393216:S0mV5/Yf1+uuhUmzLjqYHRvjDNEO3in2TK0:S0MWf792j5RvfNG2TK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435707, "uuid": "dc120069-175e-4775-8dc8-444c11521781", "value": 15933410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435707, "uuid": "be43577f-655b-45d3-af8f-a280844f6586", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435707, "uuid": "66a8b55b-ed6b-40f2-8879-5af49da514b6", "value": "1e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15fbfa3-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776423702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423702, "uuid": "5d1adcd8-347f-41ad-be3a-6fbe0813417f", "comment": "Malware payload (Mirai)", "value": "f2dbc6159b6ba9f16008b192d97638dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423702, "uuid": "d9ba2d7a-6e93-4018-af7b-af6a951b5763", "comment": "Malware payload (Mirai)", "value": "1f879484690c2afc6468be00c5d7e5bd720c4c514d3deb04dcada2ec4cb6cfe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423702, "uuid": "a15e93e0-0a3f-41df-9591-1e47dfe1c9e0", "comment": "Malware payload (Mirai)", "value": "290105d0ee4bd70fe01f078b46d246ca4d798938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423702, "uuid": "8b0de157-acb0-47df-8cce-efb8f8cf4fd6", "comment": "Malware payload (Mirai)", "value": "2025af83875886d3fcbe7ec8d5865e305bebb757a4b45582af60d123cfdbdf86249e94bd6cc62f3770df71a46b1127b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423702, "uuid": "178ca5e6-a3da-4d19-b434-54285abae6fa", "value": "T1AA244B45F8818F25C6D412BEFE2D118E33272BB8E1DE72129D205F65378B96B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423702, "uuid": "e0626087-f9fd-414a-96d9-17413e73449c", "value": "3072:Q4zb5glCyxCWEFVolNeR0OqyVUlT1cDXYX6VbaV/1ZRAD2ue52J7th+wDZa:55g1WVo1OnKuDXU6talP22ueS7t0SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423702, "uuid": "fbf37ea9-80ba-4d3c-8d63-e1e5a25148cf", "value": 215868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423702, "uuid": "a209164c-90ef-4603-919f-1d932f07a99c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423702, "uuid": "98f2d90b-0ce3-4b76-8cc3-69dc6f1b1ebd", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edb785c-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776432503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432503, "uuid": "dd5b1d1c-147f-4461-ad93-fc36537d1448", "comment": "Malware payload (ChromElevator)", "value": "bcc5447731b436b798290669b79cb0c6", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432503, "uuid": "0ba078ea-4837-43a8-9353-a0bb21a50d2e", "comment": "Malware payload (ChromElevator)", "value": "2018e54080febdeb6cca8043d6ce8d35f59442f54e67bc1aa55b1ce16fd45dd5", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432503, "uuid": "c3afbdeb-c63c-4f79-bb6c-cdbe7d24345f", "comment": "Malware payload (ChromElevator)", "value": "f1c8c09c9d120728748c09212bafffe09cd5b22e", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432503, "uuid": "aefec2d7-eff7-48a9-b94c-f31ad06882cf", "comment": "Malware payload (ChromElevator)", "value": "3f7fe752f2b7b66b6b0258e017e82047ae016d86a6ccd55f59f817aa497563297eb605200dc02a7511d6ff3d81d5ae54", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432503, "uuid": "0d8fb30b-0985-49bf-95f8-e4193befd44a", "value": "T13F65025B67B500F9D1B7C674CD46990AEB73FC0647A0AB8F03A409971F276A09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432503, "uuid": "6d23aef8-4186-436e-b6f0-1a6e4c368c45", "value": "7e266528ec985c53014ad02d5c6a12f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432503, "uuid": "b64845e0-c5cd-4144-bdf4-9717c9b517f5", "value": "24576:wahCB537BZXKdwE2SK8/1bFbyAWfeGrvktwt2hqQYtSDpNZKbkeZx:waE7LXal2aNFbVTavC2OhYQXTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432503, "uuid": "5084d151-cb8a-4386-acf5-87e02f7ba6ab", "value": 1451520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432503, "uuid": "729f89d4-cb44-444f-bcb4-85f503ba9aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432503, "uuid": "e83db6a0-cb2c-4bc9-a47a-40bf01d9c24b", "value": "chelevat.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928e7772-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455809, "uuid": "c2d18a1c-14fb-4ee5-8b45-8515e7101a28", "comment": "Malware payload (Mirai)", "value": "0d8f760d4c517a0a1eeeb0b3fc5e0f45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455809, "uuid": "ed657ca7-8cda-4638-819e-0e5744932e26", "comment": "Malware payload (Mirai)", "value": "20476fb889d296e9bdd3de1a9407a0b4294afcd0bc93974e5d2044447cd260fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455809, "uuid": "4366fb0e-3d17-41eb-a7ef-286ffa811607", "comment": "Malware payload (Mirai)", "value": "2ba35edd3d39a8a468509d4635efdba600364140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455809, "uuid": "5198de40-6275-4041-ab26-8ac4efcd8049", "comment": "Malware payload (Mirai)", "value": "3559c5ec940d51e105955075401fb0b4c2369d776548cf39ec61ae38c42d23a99f5d6c37230e928fbf6e4f2b2b808f8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455809, "uuid": "9dcf288c-6f2e-49f2-8b62-cfaf3d030c68", "value": "T11643F641FD0789F6D88798F05AA7F3BFA730D9140134B26DFF89DA76DA23646422620D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455809, "uuid": "86e6b1e0-d153-4bd9-af1a-830ffc6f998f", "value": "1536:2Jvja+dSkoSA6srgHFpDh5YsPhChTUhqgOv/qNa/H:SpxdqEOv/qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455809, "uuid": "739e27f7-8a26-4305-abe3-03be3ec926c5", "value": 58288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455809, "uuid": "85ebe5fa-65fd-44c7-9b20-72d52795c78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455809, "uuid": "8327decb-a4ac-4b33-a5e4-65844eea09ec", "value": "h.686i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b608eb5b-3a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776452003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452003, "uuid": "c0b3a5b4-fc4b-406f-a2eb-f627bc379d05", "comment": "Malware payload", "value": "ac561298f993326877c80f021ef7da72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452003, "uuid": "aa74eb5b-6ffa-4e28-a83f-6b0a1c7c10d2", "comment": "Malware payload", "value": "20559c2acfa5bc716d2a5e07ef82d563690b38e7b97cdfc13692ed02734b5ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452003, "uuid": "3bf308d6-b1f0-49f3-a0c0-a3ab181fd9f3", "comment": "Malware payload", "value": "a660b6b7c2fffafe6989eecf3584b6ddd5f26be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452003, "uuid": "3a5e2dbf-cda8-4df5-99fc-79cef2155484", "comment": "Malware payload", "value": "978cd520f25c48084db6ae1780da3680bcadd2f14b7967d0a093c6a62421c73f5fdc35fce1bdc6ff4b32755b79f74f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452003, "uuid": "e223ec44-5fdf-4619-ae75-dc757a4bd62f", "value": "T132559E4BB3B900DDD49BC1788506560BEBB1B41517349BDB16DCCA6A6F23EE11EBE320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452003, "uuid": "f64dac9a-889f-4883-bdc0-5fa1d7016396", "value": "99fc88cb11208f7eed4a4d82169e8c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452003, "uuid": "2d68a9b4-69fe-4821-b426-8ebc57f9d8b1", "value": "24576:iE5x3vj5D2nBeoODf1qg/O1jxU1BfHyOuZhV55bER:i+xfj5SEoOf1h1lwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452003, "uuid": "aa07afff-5e39-4c24-8824-a89662dd1ee8", "value": 1306112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452003, "uuid": "7bcada62-4faf-4a79-a80e-0ca29280133f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452003, "uuid": "00f3882f-6b56-45b2-adae-a3fb1c2e6315", "value": "final_app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e50d3eb-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404236, "uuid": "2edf4441-a523-4104-95df-08aac7440242", "comment": "Malware payload (PureHVNC)", "value": "9bda95a0ac1eb6a52e66d01c867ce6d8", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404236, "uuid": "206a7f20-bb4b-4cf8-be19-3928f70d5f4e", "comment": "Malware payload (PureHVNC)", "value": "21183d0dc7ebfd2520224095b196bf4311eff8eb23318e13115e7ad0313b89a0", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404236, "uuid": "4ff5e805-3a89-448a-921c-8564cdc3c439", "comment": "Malware payload (PureHVNC)", "value": "cc370bb9849f64bb9f97d49fcc4638ff431ab61a", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404236, "uuid": "ce876565-33b2-45d1-b33a-4465aa98417a", "comment": "Malware payload (PureHVNC)", "value": "4b8ad46e00eb959a676ed8cba3b43f9f8289906665207a1e2c8387c56ca8df9bcc890dd3a3cb11eee98dc9b60640517a", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404236, "uuid": "98da7910-1666-4a54-9e77-5c8344c47d79", "value": "T19684E474DDA8232A51B65B2DCDA38642BCE67D0233DDD80B8852270B04A7747E9F763D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404236, "uuid": "8e88b2d6-8a0f-4837-ae89-999faefe8d6c", "value": "6144:2disdHPFLssHJW8xA0+j044cOnO7FJeVKcpJELeLaTVl:2disfIxoB+o44ZPEwaTVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404236, "uuid": "58e0b401-d76e-4ce3-9ff4-e558612d443b", "value": 381442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404236, "uuid": "56b1b01e-2f24-4aec-b72b-4de3b6fd3696", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404236, "uuid": "1b43ae57-a302-48a4-ba32-b02855ecc3b2", "value": "21183d0dc7ebfd2520224095b196bf4311eff8eb23318e13115e7ad0313b89a0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa7611c-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776426456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426456, "uuid": "232a8aba-9fc6-4c63-ba23-e6c781d9195b", "comment": "Malware payload (Mirai)", "value": "e4c5a76101accc4821b599e9babdd614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426456, "uuid": "4e8fcb5d-3360-4091-8093-b29369b4bcde", "comment": "Malware payload (Mirai)", "value": "222f8d423386a8975f14a24805b082c714e02cc5f186ae0ca647e03eec9831c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426456, "uuid": "d5f86f45-2719-4655-9faa-a7e42dcb41ff", "comment": "Malware payload (Mirai)", "value": "8fddb68e8a31bb04da826f97227d459c77275084", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426456, "uuid": "9d845238-4750-4ef9-9910-6473fdaa0f1c", "comment": "Malware payload (Mirai)", "value": "1cdefb7d45525dac052fe079ab14a0d1f4517e6a6966e6170c1dc59cb2336bf78b17ff56fc73bca89c3442510082c42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426456, "uuid": "f7103b78-7f95-4f80-a50e-27ee748f14cb", "value": "T1D8E35BC4E203E4F5E9560275613BF73B5B32A43A412FDE83C7699F32AC92950D61A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426456, "uuid": "b96c86f7-ac85-415f-9502-c65a2acb30e7", "value": "3072:q8KbcVtZ/xLr3WccFi4Tp87Ou0OAGgqgBjctUCZ0cA6BnTsxap:GbKNLr3Wd5Tp87n0OzgqgN6h2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426456, "uuid": "47020432-118e-4383-96ee-ed435c402686", "value": 154312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426456, "uuid": "2102b02e-d1f1-4243-b3b8-aa764aa4e339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426456, "uuid": "aa6c24d9-e12a-43eb-bdf4-21b1956afd89", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ec10d2-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432522, "uuid": "97bc46fd-0ded-49f4-b07e-75c993820f2e", "comment": "Malware payload", "value": "c6423a6fd5094fb54cac9d478e626efa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432522, "uuid": "393f14ce-e573-47ac-9675-bfb8b31d770d", "comment": "Malware payload", "value": "226e93e10bd34d8bc829d92787d3f79fc2072185fd1af6672ff5822e5298524a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432522, "uuid": "b76f4ae0-98cf-4f45-a79a-a02d3b70a925", "comment": "Malware payload", "value": "ee43ddb00497448266e0e749d295554a35bb125e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432522, "uuid": "a72123a1-bac1-4c8c-8f86-e5b730ce668e", "comment": "Malware payload", "value": "b760ab1c10c2021b30077b4b503d279d07f9e853a45f87d02b9841a42ad64c25915be047ae5a9e1787c742f13d34ceda", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432522, "uuid": "e23fb4c3-5408-4d66-b4e6-a7c08e7b3a9f", "value": "T13A815066A4158D2B4BF69653DE83A245FD35017FA1CA280832ACCDDDFF7E4078389863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432522, "uuid": "5b7f416c-a14a-425b-bab1-c6bc688dc2fb", "value": "96:DTSA4Lkxm7mPJpX0B0dFpfhmPfDapPB/L4A:Ym7j5mnDaXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432522, "uuid": "2917ece9-5474-4c6a-82a7-4806f5cde634", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432522, "uuid": "fde50c38-6c10-46dd-95ad-4c689ebc945c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432522, "uuid": "2960bb45-f2bb-494c-b472-1ed1ebbb24f8", "value": "fm_20260413_063919_fixenroll.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5b5403-3a39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776415564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415564, "uuid": "35fdda31-19f4-44da-b3f2-d2bd6d596fd7", "comment": "Malware payload", "value": "a4ecfe9eb697169e9c092f988d164df6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415564, "uuid": "3aa8a48f-9892-4ec7-a6c6-de6391be9598", "comment": "Malware payload", "value": "22bc84261294f6ff39ce079ac046fbdfc92cb5c4f8d2a4e09903221a04ce85eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415564, "uuid": "fb7a3793-c331-4fc4-8486-0ba75dfdcdbe", "comment": "Malware payload", "value": "7c9a27dce761684d32acbb8fb9a51c5d0427ea12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415564, "uuid": "2987bb0b-cc2a-4514-84cc-ed3cf02f9c8d", "comment": "Malware payload", "value": "66ab22a3e8c38c5dbf7576a0a7ca332576066d8e6e3ba11da8be7c3bc5093f57c8d5b7063557983be64407e776b6bb6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415564, "uuid": "db9e3f05-593f-453a-a673-7610f152b584", "value": "T18651C12AA3EC0227E8B34775ADF3432627B4F8549F72535E554003686C107645D71FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415564, "uuid": "04abb1bc-5c43-410e-9628-5f36157d2bdc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415564, "uuid": "6781e3f7-7e06-4f35-a33b-948183182895", "value": "24:etGS7ePBe5ekTR84vVLlg+ALmlttkZfM2QrCZ0WI+ycuZhNeakSWPNnq:6BskW4ZlzATJM2QrCZX1ulea3qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776415564, "uuid": "23815c1e-604e-4755-b73a-78df252c7902", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776415564, "uuid": "f2f5ba11-8d71-42c9-9ce5-3ef824b473b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415564, "uuid": "b770df1f-fcef-4efd-9e98-df775bfabc2a", "value": "kf0l0say.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cce172-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776435229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435229, "uuid": "5562f153-c848-40d7-be07-5e877c8f5586", "comment": "Malware payload (AgentTesla)", "value": "72d07122f6dd763d8a01762cb4ae515c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435229, "uuid": "2f5a783e-d88e-49ee-9b64-3c4230d0c2e7", "comment": "Malware payload (AgentTesla)", "value": "24853fefd3befc1035d5b55dd59b15eb83b51453e011998e7bc8b86b5b323cbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435229, "uuid": "cfc9c926-0e00-46b6-9f41-5ec796eb796a", "comment": "Malware payload (AgentTesla)", "value": "ef7d724a0fa7ce321679d61def1e99664147a201", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435229, "uuid": "f842c629-fa37-4d7e-999e-9164cf69e326", "comment": "Malware payload (AgentTesla)", "value": "4e3e7c2ea4f084751693a7ca3c274a08c8afb44c96eb2ab2bf9ed0aa0ceb7fe0c8b72cea8b72daa8ad7368f894a33c7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435229, "uuid": "1e668a4e-00e5-40d8-a37d-1c6727d420d1", "value": "T145566304D0B4B109A9D2EF5A966295B0488F7A7E1F2D8DB3602FD57C1CA6F935E102CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435229, "uuid": "a3f79115-22e2-46ac-b5ce-a3c1b914d520", "value": "98304:73+bCJTyQ4JY/DTYxuald+318PZoEjNfz6aFdPgmeFtplePjB5+8sYrqKdpKN3:73fJdYxRd+3Mj9zp7gDFtppqnpS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435229, "uuid": "cdef2dab-a20b-4ffe-862a-01f9d02ace0b", "value": 6005300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435229, "uuid": "f5c7fe55-3af2-433b-bd88-bd59e1dcac2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435229, "uuid": "3503e797-64f1-492b-beef-68b3ab688670", "value": "ZENITH SOA 07-04.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a357b90-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440360, "uuid": "9fb4ec32-6eaa-4d72-a1ba-f81da1e36840", "comment": "Malware payload (Mirai)", "value": "c6578bc6fe6bddec559377e34fbc936e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440360, "uuid": "2fc447c9-9ac0-47f0-9dc1-8306c13fc346", "comment": "Malware payload (Mirai)", "value": "2504bb7c770ac142d1fd4d36a8ed504b9f8b111d7c76ae53dda71f04a6185612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440360, "uuid": "c6c44d75-16ae-45bd-a31b-8fe7d7d88f91", "comment": "Malware payload (Mirai)", "value": "f9d78887f71073ff4174ba2cb3a76d1788b05d0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440360, "uuid": "7868ee60-6588-4640-809e-ea7c8edd009b", "comment": "Malware payload (Mirai)", "value": "75fb7b829141b1a3102bd91c6aebc02f1bcd71dd730a78e779d5ea1157507a19cb24108d615d038458107eb7484112cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440360, "uuid": "3bbdfe13-7ae3-4663-b6b1-81370da82858", "value": "T1DF8312D69A8D83A5EE67BC35DB3E8E33A525476D07413189F8C087197DBAA802368353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440360, "uuid": "e83b7b70-dc24-4bcf-912e-d7d011fb28f4", "value": "1536:VdfyC+aPw7a8XSGMFvEOpsBVugBeMKr7oqOzTiufSAxBqK6:3bvw7a8XSGMpXgBS7/pufXqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440360, "uuid": "2158243d-84ee-4b88-9902-465c13854aff", "value": 86924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440360, "uuid": "6aac4db4-8be6-40f9-8b7a-c7fb0c573bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440360, "uuid": "809d15ad-bae9-419d-867d-7bb0e309e057", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76df4812-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404223, "uuid": "e0c4e47e-9dfa-496d-ae11-ead90dc5520a", "comment": "Malware payload (PureHVNC)", "value": "186b84970294e2dcdc426dea59e8f33e", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404223, "uuid": "f6e0ee16-538c-4fac-8ede-40ebe7e9a151", "comment": "Malware payload (PureHVNC)", "value": "25acc0a957b1490d77b3596a2fdad25cef12da270f57483d3ce42b4e2894a9c4", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404223, "uuid": "2c2f17ff-29b9-4624-bb02-b68876b34260", "comment": "Malware payload (PureHVNC)", "value": "d4d7cd1281a82b963e460c4ca3195eb160309a73", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404223, "uuid": "d2c4cd12-8081-45b9-9cfb-3be5bf41aedc", "comment": "Malware payload (PureHVNC)", "value": "341612c4586191bcf33871f2fbcec9d475669df1b61d64564d6fed91073fb16515678c62b323d86a71ead62967fa266c", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404223, "uuid": "b3353d43-1627-482e-b457-798c07c133e0", "value": "T136C4B63DADD4223725BBD6BACAF659CBF952755335126C0E80DB03860913F9B7E8201E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404223, "uuid": "97e3992c-e09c-42ed-856b-9172faa995be", "value": "1536:V3UABf02y9ewSktbjEsSWx9txikSQ/L8gYDFano3Eq3JfQ+ij/Owlfj13IULbv9A:xg8czV96GKEgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404223, "uuid": "095b66f3-9d49-4c1e-9a4e-f7185633d430", "value": 584664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404223, "uuid": "aff54d97-aca1-42d6-a1f7-d9122909e227", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404223, "uuid": "e2367b5d-a82f-4e06-a878-2e1c163933d6", "value": "25acc0a957b1490d77b3596a2fdad25cef12da270f57483d3ce42b4e2894a9c4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e2f64a-3a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776451189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451189, "uuid": "babaf79f-4ecb-475e-8367-a2121cc8eeaf", "comment": "Malware payload (PhantomGate)", "value": "1f939d494c97df2a33549597c2793efe", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451189, "uuid": "8928613e-8748-47ea-bbda-918d705c8923", "comment": "Malware payload (PhantomGate)", "value": "25ad732e9851cad42d1a88c96bb5814c128a3fb73a1ca7d0a37de70d7cd2ac32", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451189, "uuid": "b41054d2-7142-40b1-b741-4dfe955d59e3", "comment": "Malware payload (PhantomGate)", "value": "b4e14ae20c0d9dae20c83d90052e63d333ff9f1b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451189, "uuid": "020313d7-a13e-4bf1-ae94-4b8b4218c52c", "comment": "Malware payload (PhantomGate)", "value": "21dfe21157e23f0d920346a7959982d79c3a2d775600f93159bd0e8d4dc430de93a2ca79bf3f26bcb8cb0ce96891fb05", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451189, "uuid": "c86f0907-9f43-47fd-868b-7c89c4969ca7", "value": "T12C520BBDC9D6BCD0871B62D175E9BBC1018F8B13BE6B2B2CF5D814610741399ABB848C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451189, "uuid": "d669a896-14f2-4577-92f2-25fbc78480d5", "value": "384:ljm4srGzkkIh/Ksob/moCGQDF9yxucKklJUrxe732OW/Ta5+dZhgqsStXZXwrmhc:ljm4w9FjoLBCP9IN3/p5oQStJXwzY8Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451189, "uuid": "5fbc5e7f-2897-4b5b-b2e7-a80ed65513f6", "value": 13492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451189, "uuid": "154534f1-58e6-47a2-9d9f-1aae94fd5af9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451189, "uuid": "f6495142-499a-48c5-9247-4abe0213fa63", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8093ef-3a2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776411296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411296, "uuid": "a887b5d5-7bc6-4ccf-b9d8-b86e5c82b64b", "comment": "Malware payload", "value": "10e5f6450315f57d3242a1939fae0a5a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411296, "uuid": "1e30e75c-bcf6-46e5-9071-369bf2646954", "comment": "Malware payload", "value": "25d1c0e0ed6c869f491a76e3e28694c2a6bf511a3b8b802a900250d196a926f8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411296, "uuid": "f6faac4b-f3b2-4eef-84ac-c3ef99b4f7dc", "comment": "Malware payload", "value": "674a5595edb6bb529d7944c85a7db1e5db135c39", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411296, "uuid": "a577a169-85ef-4476-9dba-461e05025bda", "comment": "Malware payload", "value": "589949684aad0513ec085566448e24a54ec582ccd4f0cc0daef82617545a1f11df6c7b03002d9bbbb5e305dac4597d36", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411296, "uuid": "3ee95950-a6ff-4524-a70b-a025e508d551", "value": "T14E452350F0E4DF06E4D387B559E481CA1A5DFE9A6A09D012B1AC3B963F38F315BEB508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411296, "uuid": "09db56a0-ab7f-4d7b-8a24-1d1a23b17bd3", "value": "24576:NTIF90M1LaexeCnGd4LJ7JYRT80/KadNa5l8NtTlmkh:NTmTFapCGd4LYRTh/hIott", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411296, "uuid": "a25afca3-7325-4709-a5e9-83ae054cdea5", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411296, "uuid": "1b8a5413-71fb-4f0d-ab50-dc9e04f7520d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411296, "uuid": "589ce963-6c5a-4625-8ae8-ca776057df93", "value": "AD2601101063, 9283002.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81d01e1-3a96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455523, "uuid": "62ddc7e6-4172-4652-a561-0cbbd467811f", "comment": "Malware payload", "value": "54fc1423e7ab9c8bb1c0975bacc61897", "object_relation": "md5", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455523, "uuid": "876a4b7d-be3c-4ca6-b9ab-7f02165eb1d0", "comment": "Malware payload", "value": "2607e5958a006f03897c827bc244076aeaf987b018185122c65d181bfc925daf", "object_relation": "sha256", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455523, "uuid": "84974f4b-e9c1-4024-8dfd-75cf8f0216cf", "comment": "Malware payload", "value": "7676ced5584a7c82f280b0aa35cac0693cbd4c09", "object_relation": "sha1", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455523, "uuid": "86b29c12-d953-40a6-a79c-29155d651f9f", "comment": "Malware payload", "value": "7a72f1555a9e4672e2d6d79b47cb9a33f4a3d1a0d256298265b33b146b22874baacaf134ec11cf532af87f4123a906ca", "object_relation": "sha3-384", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455523, "uuid": "4d319ec3-b055-4a3c-a879-1867be91e384", "value": "T137E6328DE43A95D8DC4235F0BC82188C79495DE59FBD422A442CC4A532FB6BD029BBFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455523, "uuid": "de9c495e-321d-482f-a137-6c474e8a29a1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455523, "uuid": "ae627651-b8ad-4a4c-930e-389548991c43", "value": "24576:sLvC7oL5xgtGT6Yt9iluEhEI1Bc6/OPv0LohhHD3p7loPcmf8C688W4QUO7ucgW+:oegzrTrrDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455523, "uuid": "20e23af1-14a7-4904-9e5e-85dd4356d09f", "value": 14638952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455523, "uuid": "cc5e51c7-a2b0-4a31-89ad-a850162c6dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455523, "uuid": "660ccc5a-fa80-4254-bbc0-db38d92d38c9", "value": "libfilezilla-43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b114cb5-39fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776388742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388742, "uuid": "008b5e20-de34-4392-aafb-c2be2484663e", "comment": "Malware payload", "value": "232b028b31eba72949e29db55d563cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "Win64/GameHack.PL", "colour": "#6B69FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388742, "uuid": "1fc41010-74b3-4183-a7f0-538988281f67", "comment": "Malware payload", "value": "26be13b6798dc50c6dd01a5265e174610fe5136f6cf4fb6e2431780a1b3085e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "Win64/GameHack.PL", "colour": "#6B69FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388742, "uuid": "1d0103d9-e6de-4f8c-8658-29e0cf91cd35", "comment": "Malware payload", "value": "8e20a4d054e88f8954c98a9092652a036d350ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "Win64/GameHack.PL", "colour": "#6B69FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388742, "uuid": "d7863889-1856-470b-89ea-95e3ae7de6d7", "comment": "Malware payload", "value": "e1dd37cce7bf21cc34dcae964f4888df10ca5ad2d9b71962f4d7042f013971f2e5cd0383950618742be24b0be56c07e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "Win64/GameHack.PL", "colour": "#6B69FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388742, "uuid": "f8264698-026f-4a9e-85a4-c361f38159cf", "value": "T14AB45A01A3E851E9C0ABC0FC9657A802FBB130455320E7CF67518A597FAB9F42A7FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388742, "uuid": "879f778e-df86-40e5-8383-802de3c74982", "value": "7d58b7508d7bf863029d690a634ecb9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388742, "uuid": "3dc3530d-e2ff-4cac-bee2-a3a313ae5231", "value": "12288:cMcoHMe9WMNY5wsSWAKQMmUyJ+xKwY5wsSWAKQMmUyJ+xK:pcosqrNRsrAKQMmDJ+xKwRsrAKQMmDJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776388742, "uuid": "61b084e1-a8a2-48ad-a9f3-ba382171e3a4", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776388742, "uuid": "395ccba3-8a54-4197-8114-6352c2a58a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388742, "uuid": "b1826383-ae02-425e-9566-a0de92e77642", "value": "CS2\u7eaf\u900f\u89c6\u6ce8\u5165\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30371069-3a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776411406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411406, "uuid": "e6b12a70-4e82-4217-853f-69b1794ff061", "comment": "Malware payload", "value": "22e7c16c6070044de3bc34fd858138f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411406, "uuid": "e3b83396-b775-4edc-8e40-6526993db308", "comment": "Malware payload", "value": "2735b7a0469a5e3da20b25f48c84fa4bd30d6148d02102c12f75bd750c29f8d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411406, "uuid": "de4bcda7-6213-4ed3-82f4-6a3a134576ba", "comment": "Malware payload", "value": "a85bd33e1770c0319df5707f5a69002a6a59e474", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411406, "uuid": "6e537165-830c-4fde-9fdc-defef39d7192", "comment": "Malware payload", "value": "c18201012372211e03aba3c2f4254001014b25462a60399b35bf411a0b1064f2956e3ada58b176058fc8ca1b8b52adbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411406, "uuid": "9dcca5f8-5f9b-4a6d-bbfd-c41aa636a90a", "value": "T178B5D9AAD3CA5F4D4FC891857E4C64B4CB0F13A6EA0EC598FE933694548E8E450F1B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411406, "uuid": "7d6dcaba-69b1-49b7-a0eb-79cf9bc69f15", "value": "24576:99HVH3pjbwOuq1zpA1sp6BjEVg4BIdg/5jyl8wuOxphLEGjtyjODKH4ujkBBmUjL:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411406, "uuid": "486d24eb-4b87-4c0e-8fd5-ede15e9b4e98", "value": 2318087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411406, "uuid": "71104286-490c-467d-a676-69efb688c4b9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411406, "uuid": "10329914-dc38-4091-9609-7f816689f51c", "value": "20260416142404_8604_242.png.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec78999-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432449, "uuid": "3088d971-0f87-4e75-8485-26441d9ac384", "comment": "Malware payload", "value": "5c0076948010551fa836e0939f9e91a2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432449, "uuid": "d66ca03c-e978-473e-aa42-e41000ce3184", "comment": "Malware payload", "value": "27fad46d71e60d82381505856470c83ab318ebca6ee820038e08500d381f45d6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432449, "uuid": "31f1cb6b-6faa-46e3-9a3c-7656601e4ab3", "comment": "Malware payload", "value": "17aba553846b22f3f76c0c0b06fe87675a54aa37", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432449, "uuid": "8a62391c-1f3d-4852-9d8d-fee046203086", "comment": "Malware payload", "value": "c0aceaf4ea5ae90437a82a477f6f323e32fb4d9b08753c0972d18c93241f51acb18b1ce54c953f9b459dda6423791c28", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432449, "uuid": "78d7a2d2-8797-41c9-8382-4cf5682e859a", "value": "T1CF21AF2C79714E0ABD3304027D992468F90A527701EA2434F958C32BBF5B147427AB2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432449, "uuid": "958a96bb-6035-4288-8334-2a3dbc65c485", "value": "24:DTQCtosVD+Ewf/cWXjy0Ov3U43D4mXN+sxOOyN:DTQCtosVDQf/zjEJ1XNnPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432449, "uuid": "234b16d7-e310-4943-b0fe-7ef31b38b4dc", "value": 1390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432449, "uuid": "a15543f4-15cf-49ca-99e5-5cd91c751122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432449, "uuid": "58ddf5cb-127f-4bca-b0d5-a5dc7ce6b228", "value": "fm_20260413_124628_litewebcam.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29aae7b7-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776432011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432011, "uuid": "43187f24-a9a9-46fa-9b2a-d7adce5cf75d", "comment": "Malware payload (RemcosRAT)", "value": "a72e500e5bc3ac3e8232aac814557f0f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432011, "uuid": "d5aef23a-e5a6-41a4-b60b-729443998b2a", "comment": "Malware payload (RemcosRAT)", "value": "2907d74d4bb3ce573ed471b7ddd96f2c49c9dc2b7c7485940651cd9fc1542080", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432011, "uuid": "68ad3604-806b-4ed4-8096-feb9c09b1348", "comment": "Malware payload (RemcosRAT)", "value": "9460b58de606d87978a7398031edd1821704f701", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432011, "uuid": "c3564d05-1e89-4151-8f18-3d7f62f60741", "comment": "Malware payload (RemcosRAT)", "value": "174bbe42c9778b5a0d97a624080dd620b94169983f20d4f715021eb6fee78ca4f6c3f5ab20959afecd2daf2373694854", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432011, "uuid": "e9fe3238-130c-4a27-a780-810f36bac7a3", "value": "T11B65F166F6D9C94DE032C17E883BACC143ADACB4D6A87ED3715B7273DC2770601A6192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432011, "uuid": "26109cf7-8505-4dea-b8ec-c90bf0b74994", "value": "24576:/VteCnGd4LJ7rYRT80/KadhVOeCnGd4LJ7nYRT80/KadRBIUcYXsh3TBMNPf:dUCGd4L6RTh//HCGd4LGRTh/Q7rVTBM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432011, "uuid": "5a1c784e-8ccd-436e-93f3-94c7ed82d2cc", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432011, "uuid": "43fbbbeb-3629-4c93-9ed0-ceda1b2db3d4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432011, "uuid": "3eb87785-0cbd-4af4-9e78-6df3a4792760", "value": "Narud\u017ebenica.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7303a51f-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435141, "uuid": "970a1889-d2d5-4487-be22-b75cfe1611a3", "comment": "Malware payload (PhantomStealer)", "value": "2ff3be8989270f166a7d6d509da344e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435141, "uuid": "980a7745-ef23-46cd-95fa-f7de5ef27298", "comment": "Malware payload (PhantomStealer)", "value": "290869c937ef1451b25e64c206119d0c1f71c0ae09118fa0b86b4cb68fe8bea8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435141, "uuid": "122d7feb-0ba6-4103-a74c-ff96a56be2e6", "comment": "Malware payload (PhantomStealer)", "value": "584a98f0ec37edeb8745d720c84a8471ab5ba463", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435141, "uuid": "55578e78-4575-45b5-a7dc-9625ea64b5ed", "comment": "Malware payload (PhantomStealer)", "value": "485919732d47b3fd1d09f0a72cc679dddc5380c2dd9e5762c5a935e0fb03b41b1c44366fdde1bca3352c88e975850473", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435141, "uuid": "53809f40-51a9-48bc-961d-61a54a393805", "value": "T17286C648C0E661495CC2EFABA5E6D4B048CF6A6B6E0DCC72701FA5B81D51F9384236DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435141, "uuid": "e7caa398-5331-4fee-b9dc-b7af8c317cc0", "value": "196608:Qe8/RGiHsFPuoSNGUKPoazOSfUGeI2wiats9K+FbajBNXvvsw0VR/gpYCvSjSDxh:Qe8Z70PuUNQazOictat1+KBNX8l/gjvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435141, "uuid": "4e07e6d6-2c6d-48da-8d4f-02efde124798", "value": 8043068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435141, "uuid": "5799e887-c424-4db1-b2be-95c6746ccb08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435141, "uuid": "c56880d9-171a-47eb-90dd-b96e499a1bff", "value": "PR03074 Vodafone Site - HQ Lusail.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8327814-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776446853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446853, "uuid": "75cda84e-df22-4a0e-b938-16bd205d3a4b", "comment": "Malware payload (DCRat)", "value": "45b446707d191411515164c2c531e1cd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446853, "uuid": "9296fdbd-3b43-4db6-ac35-8db6646bb739", "comment": "Malware payload (DCRat)", "value": "293e17c6d9ba1a21c6df2ffa65090605ad7cf9ec932525156f70470a574780fd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446853, "uuid": "846b1fc8-62ab-453e-a4c3-abec12e0a9b7", "comment": "Malware payload (DCRat)", "value": "652dabb1bb6d94f8e6dec5fbcaf71715cf1c75a9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446853, "uuid": "05aa7109-f3c4-4336-ba1b-261d962f8acc", "comment": "Malware payload (DCRat)", "value": "72650cf801c29dbee2c03ace1fb9feef7fd050ff4b27539669f8df897697eaffd0367dca68a4841f8dc7d181ba4835dc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446853, "uuid": "fd236a29-6060-4a64-9195-8e0494e3d19c", "value": "T11B4549017E44CA11F0191633C2FF4A0887B4AC51AAA6E72B7EF9376D55123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446853, "uuid": "56ed84ce-c35d-4f7c-934e-a3f08281ff57", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446853, "uuid": "a53b52ae-2ac6-4041-95e8-fbdfc736a3fc", "value": "24576:u2G/nvxW3WieCBur5UolwS3IJMQONeKH2xkjTxAEXz:ubA3jBMZQNS2eVdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446853, "uuid": "dac05c59-834c-48d0-bbd6-dbbc88c6e41b", "value": 1164991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446853, "uuid": "2c352400-98f2-4b61-87e6-0c51d79d7e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446853, "uuid": "4d1210ad-6cbe-4fb4-a2e2-74aedce2899a", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b80414a-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455798, "uuid": "ca3bcbac-aa01-4166-9023-d69d3298b928", "comment": "Malware payload (Mirai)", "value": "9e970cc1d579133652789c33ca7eb675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455798, "uuid": "d0e837a9-1750-4a0f-8b78-a5db4f600142", "comment": "Malware payload (Mirai)", "value": "2a40c69b0acc94521cf1432ace75a528fa6e61254d0d1dbdd915abfec78fa33c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455798, "uuid": "091236a8-01a1-41f0-a040-0a586a19d970", "comment": "Malware payload (Mirai)", "value": "de3e62e1f8ce7a7b185af244dd934b7228b40dc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455798, "uuid": "3f065fe6-8187-468e-b116-e5dec593a820", "comment": "Malware payload (Mirai)", "value": "54168a21f951351325d7dac5d47715c9b92529cb7d4f8f050e86e288656dde5c9b1f6767e0a0faafcab81d0a9ebeb191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455798, "uuid": "aa265d28-1f74-4bca-9b9f-20d3f90790d8", "value": "T1EC432A07A8C150FCC84CC1B84A7BE536D9737ABC13347A5DB798FA66AB56A102E7C704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455798, "uuid": "fbb6755a-4d9e-467b-8576-cf75b1c233f6", "value": "768:aMs4u+/l9/FSkFmfVJZOuHghYQFeVE02MUFdQcSZnrWU0r4JiELRlNhORcO:jvNPcbTwYSxFY0U0PELRlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455798, "uuid": "c12b2c28-abc2-4e40-a133-bfbb1787f6f8", "value": 58720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455798, "uuid": "d6b6b5a6-9be4-433b-a955-c841dde2fc22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455798, "uuid": "675979a4-def7-44ed-b001-d4aeda6b8594", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f81e91e-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776434356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434356, "uuid": "ac985554-759f-49d0-a9f1-482502f7855e", "comment": "Malware payload (RemcosRAT)", "value": "a08eb2a4884cc580b159ac0cd73a932c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434356, "uuid": "3fa48679-6726-45ba-88e5-55674787cbf2", "comment": "Malware payload (RemcosRAT)", "value": "2a843168b37124afc8a8daf552f5f8f5677776f82d85bc1828cffc15035018ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434356, "uuid": "971d72cb-9088-4ea6-9717-dfdc1c2a144c", "comment": "Malware payload (RemcosRAT)", "value": "0c3327a8664b70388883fbedf956ea211c732458", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434356, "uuid": "466a2467-f0c8-4b50-b8d0-585402dacdb3", "comment": "Malware payload (RemcosRAT)", "value": "e0629e7eb1c849274242813ee076b28057c1317dd49a0308d6fa36eb048f5e94f85049a3a8a2889a9d75e1949afee271", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434356, "uuid": "3e38b375-50f4-43d8-b3b7-29cf0f4bf522", "value": "T118765244E2B8A23776D2D78D983AD931484F68572A99CB61302FD22C3D1CF5387646EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434356, "uuid": "cfdaba9a-5b73-4bd5-8301-950ffc13ea6d", "value": "98304:DQsJ+NbrQc6mmNr+mnVQeGgggJhzBVEjsATDnm2aHDZBZNG2m1axz5ojH95gLlB9:Dj+bvyN7y2V0TDm2Y7xzSjHPklBAuOPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434356, "uuid": "5f402c89-82ee-4048-b353-d57dfe0181e9", "value": 7353604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434356, "uuid": "8f6d6bdc-c3de-4761-a4aa-b78cede8949e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434356, "uuid": "c612f9d8-fd30-4f6e-a661-4799b2193161", "value": "SQ09697-PO-06979-PR-00697-MQ-06998-2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc38c46-3a6f-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776438779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438779, "uuid": "0795bbcf-887a-4c64-aec3-7fbee5d0d331", "comment": "Malware payload (SalatStealer)", "value": "1e559932ec0795c93065031d304bc2d0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438779, "uuid": "95c5b658-09d8-4467-8722-a3ddc714dd61", "comment": "Malware payload (SalatStealer)", "value": "2ae58c0f767ea76b811140d93ee5255fa88bf699e48ae419a9fda44100315433", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438779, "uuid": "a8ce12e8-8103-4508-991b-0e6cb2744004", "comment": "Malware payload (SalatStealer)", "value": "019a6cf83075ff55ccf75c99e54c3723196c8d33", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438779, "uuid": "9c7c572f-767a-46cb-bd50-18dc7096597c", "comment": "Malware payload (SalatStealer)", "value": "30ba822474169bcea89ebd5cbeb470013b031c80520cb05a2eb8a9bef6ba3d5715012db78c6f386442b06072aa0cf0b6", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438779, "uuid": "1a8cf74b-ad65-4ace-99a5-12cc2bc19585", "value": "T196863345F7436CBCD57A06B844EFB37BC2721D16001DDE5BCB8AA9A57E3B3112D2A602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438779, "uuid": "db53804f-0e06-4dc6-b2dc-8da396f680f2", "value": "0fdb3d6c9b8168c4a09253948f817cdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438779, "uuid": "fafda4d5-5711-4616-ac2e-14f7b3d76059", "value": "196608:MNJkryjxJhYqLhWedsM2t7IdvGymnfKNG:KSyjxJnLvsMu7yvGnfK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776438779, "uuid": "b4777815-6880-4e92-b3d2-ba1c91c8a0b6", "value": 8445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776438779, "uuid": "c06b90e1-c9df-44b5-b662-7ec0f9f47175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438779, "uuid": "2177955a-9d4c-4742-892d-94acfc36d165", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a07e083-3a7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776444870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444870, "uuid": "4f0294b6-9817-47cd-bdd7-ea95f70a8bab", "comment": "Malware payload (Mirai)", "value": "2975b6bea8e5f061500a81262bf06206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444870, "uuid": "e22a9b1b-5f0b-4918-88d1-fa415ce18630", "comment": "Malware payload (Mirai)", "value": "2b1e93c9767ad7955636a7b1e74328733f7bd1be2b6e27c2003e97c55f94856d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444870, "uuid": "6cb8b388-4fdc-4695-bc9f-2d3bca6ae131", "comment": "Malware payload (Mirai)", "value": "936fcdc86456727cf44ccd7b11463c054a0d015f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444870, "uuid": "3cddc03d-a8cf-4d9a-b3a9-d6cdd357dede", "comment": "Malware payload (Mirai)", "value": "0433677d15b3ad7615951b2cca150692374991721d9356942f01ebea52af02f6090c2de9ef19c3f0fe5b406520030b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444870, "uuid": "2ad3ccd2-243e-49b3-86d4-9e9adfe06498", "value": "T102345C45EA408A13C4D627BEF69F42463333A764D3EB7206D524AFB4378779E4E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444870, "uuid": "69f8781a-a787-4676-a7b9-063d6e442f47", "value": "6144:iKxQue2csqxYwiO0aiWQL5yZUXn37W0p7jg8M/RsZK0v:ioQf9sVwiO0aiWQL5yZUXLtFgR/KKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776444870, "uuid": "0d9847e2-e62a-457e-a99a-e0cf0f04f8c6", "value": 252210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776444870, "uuid": "8db6567f-d406-485a-8425-e773073e3f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444870, "uuid": "bea91279-601a-4fae-adca-7153a190da9a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6031df98-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435109, "uuid": "9eb5f0b7-20c5-4694-82e0-9b2530de8ce9", "comment": "Malware payload", "value": "252e6168a08690c939a6e38203745622", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435109, "uuid": "420df12d-35ac-47a6-aace-e6b7d3659cbd", "comment": "Malware payload", "value": "2b584a5e7c037e9f47fb2c59d4590979ba01536f4fbed010e917b9f35b5be674", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435109, "uuid": "ea0ac97a-1f51-4fd6-8bb5-b30157fb8d57", "comment": "Malware payload", "value": "3555769e1e3b91323378cd1ac14cf23b53928fcd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435109, "uuid": "db74d41f-d11e-490a-a0a0-f383d76ee15e", "comment": "Malware payload", "value": "19db3278db17e3db823562bfb85b1bf8de50bb570523676d5fd1ab8c20c6cf36287453be4c1e77361108d0422e118a82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435109, "uuid": "3621e917-39a3-444c-a9f8-4d92389c676c", "value": "T1EE641138EDEA401AB1B3EF55AED47493E92FBB73370E58581081034A4723949EDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435109, "uuid": "910fbffe-58bd-421e-b440-133369f13f02", "value": "6144:HYrihF3kkfX/NOh5VbWB3Il+UYon3uny92elwszoajD7KRbXH:4rihF3hv/NOhbbWB3I4TNo1n1Yb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435109, "uuid": "06f2cad2-cd3b-4c77-a079-dd40f19cf6eb", "value": 315482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435109, "uuid": "cb56306e-b5f6-4ed0-bd55-7d1b24658528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435109, "uuid": "38d0aaa8-257c-404b-a89a-5dfbed7bd90d", "value": "Request for General Cargo Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d36363f-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456123, "uuid": "0daead9c-355c-459a-bf29-75486365c9c9", "comment": "Malware payload", "value": "42e842d51844b7b9f8e095201c14534f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456123, "uuid": "fcbec51a-1d4e-4077-acaf-7e7f955b1543", "comment": "Malware payload", "value": "2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456123, "uuid": "3c44d777-4630-4bd7-ac9f-9b62f7a9d183", "comment": "Malware payload", "value": "26b13151a6097a32af22da9fe2ac30b39cfb1353", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456123, "uuid": "aab21df9-9a6a-4325-9fa8-f82429b7ed33", "comment": "Malware payload", "value": "053e19c7c0bc9af6907224d922b4a47d0024341c0a7546c03286730db0a92c17357c0bfc3368e09afb027fd9bc407711", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456123, "uuid": "c0f376b5-4e2e-4161-9737-e91950bf317b", "value": "T17AD50145FB989F5EC8F393760C396635547AD827C703C283C9792679248BAF40F862E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456123, "uuid": "5c2366f2-4023-4f51-8876-89defcd7dbdc", "value": "49152:hBlSbQn3j1ZEemqlutKNXef2GKX0+wLpCw9lcjJbgYzJrksfW5gipFKV5p:hBwQJZbmGNOOkf/vcjhgexLfW+i+VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456123, "uuid": "75dc6d97-b81b-4ee9-8b2e-65626a1a1ab1", "value": 3016260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456123, "uuid": "1d452658-f814-450c-bfe8-904bfae64628", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456123, "uuid": "446747d6-501e-4671-8399-f4c2b66005a5", "value": "sagawa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab9bd1b-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434375, "uuid": "3263b768-7595-4d41-8b96-e73374227656", "comment": "Malware payload (Formbook)", "value": "7166bc29581742807549a05101e395e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434375, "uuid": "11e9dd08-876b-4224-8e65-429f6865d2af", "comment": "Malware payload (Formbook)", "value": "2bec28d8646a16ac1481603d33ebb7ed0f2b0d1ef7ce7fad484c71d720950234", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434375, "uuid": "f9076458-e1bb-43ae-925e-c9cad2f09b13", "comment": "Malware payload (Formbook)", "value": "66c33c1098a28bbcf92d3b29288e118552319c81", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434375, "uuid": "f6e2c53a-97a1-40d6-aa51-bfb01e5a79b8", "comment": "Malware payload (Formbook)", "value": "a2c35c77831a4da227928ac8be6cb986894ef50c8dcb32d728d39f86b81f1a3e2139111d74c4be00dfad3d8473161a67", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434375, "uuid": "7d355ca6-629f-45b0-85af-13677c2d9321", "value": "T14DA5021589C42FB8CFEC561890FE160A93F04A8A5517B98EEB73BD57BFE7A04410B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434375, "uuid": "7a55d3cb-45d3-4547-8aa2-1fbdbebef71b", "value": "24576:2YT0oMK58nEg3kUlAicT0G0hLwPGPiqAVR3ruD982b5EWpMFuMT/34yAt5wIsdtz:goPCE3a5wUog912TC2EjgamNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434375, "uuid": "17d04fd1-53a1-4c18-9547-be09f6ece39e", "value": 2090867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434375, "uuid": "b8ed9fa6-767a-4903-981c-a975d8e9268f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434375, "uuid": "8457b864-5952-43d7-843a-16b8298ac22b", "value": "20240108-051513-451604_Merge_453720.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63071aca-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776435114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435114, "uuid": "661a101e-01b5-4aa1-8540-3b9904f50513", "comment": "Malware payload (Formbook)", "value": "b37dfe5e617c828ab542e23ae769c391", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435114, "uuid": "511f1ebf-3723-49e7-8570-6c4f6034b902", "comment": "Malware payload (Formbook)", "value": "2e3ae28c9dafea2925819a823a919b5c8060fffac560260fa2698a044857338d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435114, "uuid": "bdb675a3-faa7-4af3-bcac-a6831733d9aa", "comment": "Malware payload (Formbook)", "value": "f654c6e50a71c875ecc4defdadf9f4f688a8644d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435114, "uuid": "8f78222b-5536-46fd-9361-f6a57446284f", "comment": "Malware payload (Formbook)", "value": "50b5a2e12960783cc13788646e78bfb578c7eab82ddb96cfcd64cd5c85a127b5b542e2340d02b46ff125c7446e0c5c36", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435114, "uuid": "92c8ab65-5616-4b48-aa8b-52a0c86cc8ed", "value": "T13BF2A49B75C6B051464730F72B27E51EB16E8C84790C8420FAD4B89DBC2DF2CD6BA9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435114, "uuid": "cca10b36-61f0-4161-b183-3d184e81c126", "value": "768:EVx36snO7Oo2e4CvdWjJXhscC2buL3wLVWoo/vsaFya3ICUzmNj5+:jYA0nKaRK3wL0/vsaF5ICmuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435114, "uuid": "dabd533f-afb8-4994-a355-e0463dbd2bb4", "value": 34998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435114, "uuid": "843057c1-32d6-4583-9fac-4a4a94095a92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435114, "uuid": "be1537ba-8f8e-4320-b4f7-3ee25fda9cd3", "value": "INSOLUTI FATTURE SCADUTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b681eaf-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440335, "uuid": "61d715ad-f7ce-4406-8004-1f1cf017b829", "comment": "Malware payload (Mirai)", "value": "87e93207eed31f07958c608f23c35bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440335, "uuid": "83e8429b-35dd-469b-9921-c77ff39ca385", "comment": "Malware payload (Mirai)", "value": "2f76237831c36b720f96d8061012f63dd3d4ea1b60772f6d17d7b51e7f81597e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440335, "uuid": "799b8385-0e09-4a94-aa70-4bf85abc12f6", "comment": "Malware payload (Mirai)", "value": "0719f44a30c74ca6c41184e15e1309e39a945126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440335, "uuid": "80214bfe-cb12-4e05-b6e9-7c18f672b15d", "comment": "Malware payload (Mirai)", "value": "f7b7f3d554b41ef52a55df8c2a84a414a819da7e7053729c6b186f1052e31cb1c77951876f800deeb929d12a64874f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440335, "uuid": "bc55887d-1e6b-48b5-a237-458ab7fa9384", "value": "T1A64302717E58327074B93AB478E58B83962E4E85BE7A30705BEE19FC918B046B1FC1D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440335, "uuid": "d042182b-2e31-466a-991c-9ff7945b627c", "value": "1536:XQSaEzpAaza9tw0UVeVMn7sRVoHi9ueY2g9h:gNElA39taOei9nQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440335, "uuid": "c8ed8fb0-e8b5-44bb-801d-822d82860197", "value": 58620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440335, "uuid": "8ccb6a75-9205-41f8-89f8-d140f534435a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440335, "uuid": "a28b088c-5b76-41bb-844c-c06d8caaeb75", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db80bb9-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "54736ef3-b6bf-4a61-a379-aa377863ff37", "comment": "Malware payload (Mirai)", "value": "25e8b4458e73e0ec5c2590f2a9fe9ea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "4c498476-6a9c-4220-b893-d9ade4ebe84d", "comment": "Malware payload (Mirai)", "value": "307a230bf053ff9fa149901f5df4c27222c40bfb6c685eb756c5263f578746e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "a439a79d-0aba-414b-b0ab-8282f0f6e28d", "comment": "Malware payload (Mirai)", "value": "7361b2c71001cf9c9588757e9cd17db68ff3fedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "8f5fc189-c876-4ebe-b93f-3f79eb946c99", "comment": "Malware payload (Mirai)", "value": "cbf3467ec6bc79e07f27d1373682007201d940293288f1599cdbafb6c4c6972a936eae04a651dfac8e26bd72eae416c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "99a83613-a67e-40fa-b8d7-dfe87990b282", "value": "T17AD3C020F0546DC0DC2115BA387997BC0350AEB007EA5686FFFDE96A6477E8439BD7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "31fa0559-fc05-4461-b5d3-6c360147429a", "value": "1536:puiOSlz4Aggt+RTkOwQZkbvkChVDYC86jx2Z++gugeIiEewmHIXAwh0rM:puip4AgTYO9svkWDYC86jxefgMVww86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452338, "uuid": "2b78b3dd-94b8-46d0-91db-6aeffeb8e275", "value": 131624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452338, "uuid": "94919010-204c-4b34-ab70-b2d2511cad81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "6fc8b8a6-bb80-46aa-8dff-6fabd08fe962", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890ce3ba-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455793, "uuid": "1944dea8-843a-4d26-9899-1f7cd08f59a8", "comment": "Malware payload", "value": "80a3a3b6220e85cbfa6f7334ab692848", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455793, "uuid": "c9ed9759-15f5-45c1-baec-cb2bf9f22f9f", "comment": "Malware payload", "value": "30bb4b105e1335105f323bd1f7bae848e26691d39fe3627a11526bf2030335ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455793, "uuid": "2f2b8fbd-cbc1-4482-a41d-e6422973ea71", "comment": "Malware payload", "value": "89b358380ea01b3b5c8329c10618dbc90c3e2503", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455793, "uuid": "c06d77ca-66a5-4f07-9b17-6e909fc4f440", "comment": "Malware payload", "value": "c54dc3eaaf0d57ab68a9b8cbfd36a2f702efef4b3d2af92182f21516a09aa3a8c862658448f57e50dd750d2ece6aa102", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455793, "uuid": "1525f9a7-ca62-44bf-b97a-e1fa7522150e", "value": "T18131B4D971A30AF13DA1ED7372B944D4B388E1F6B1C4AF54BCDC39E9208DE242058A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455793, "uuid": "92d9697b-532f-4a05-a024-e68dddfe3c8c", "value": "48:HehKMph01chVMOhfIehqtEhF/hrlhocjhpdhJRhtaN:HeZpfb6e823rNJ9+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455793, "uuid": "9d5ea344-cf21-4a9c-aedb-6e9d9a899203", "value": 1623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455793, "uuid": "4931cadd-5454-4a87-91d9-875996904e3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455793, "uuid": "f729e702-905b-49e5-9f6c-897c5517706e", "value": "ohshith.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78efe52-3a28-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776408170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776408170, "uuid": "8b908eb8-450a-4113-9825-a28b9d56957f", "comment": "Malware payload (Gafgyt)", "value": "585e7430fe62c53cca5325cd4507e3c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776408170, "uuid": "2e26f97b-461f-41a3-8758-e78cff89414e", "comment": "Malware payload (Gafgyt)", "value": "3263f4af3ca3da90bb43debc46e02109e955b41f9244eb26da28c5b635c6d99f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776408170, "uuid": "1c414670-96ad-451e-9837-32c7be7b996d", "comment": "Malware payload (Gafgyt)", "value": "8050603614a69028cde710414ecb7047a7881a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776408170, "uuid": "902f2f07-957a-4ae6-9e72-165654dec45c", "comment": "Malware payload (Gafgyt)", "value": "2f4980a05c538ec5f8b8a4de350ac188125b33d66b041f1b2586bc8eee36a1e1ff63d5a519e9c8e96c85b030b26f9da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776408170, "uuid": "dcc348af-0c25-42b1-9a4b-6896b61b95b3", "value": "T11EA339829640D5B3D09306B612ABCB150133FB3F4A6BDEA6F35D3DF88B509817225B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776408170, "uuid": "0bdfaab2-888d-4056-ad50-d1780c98f568", "value": "3072:LeFymRRUcUQ9UjjZaLPPpQlwj24/3CI5htTzZ0inF0OzTyoQQub:LqfX9UjjZaLP+FWCI5hdWinF0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776408170, "uuid": "e7a901d1-32ce-490f-aef9-c7aae9a21fe6", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776408170, "uuid": "4473ffc7-2798-4469-a90d-7cf299f84a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776408170, "uuid": "6bc933df-19cf-4d8c-9137-c918d3e498f0", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d7bbd7-3a6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776436546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436546, "uuid": "ae1d37c2-5c86-4a41-92a2-fdf0d8cba90e", "comment": "Malware payload", "value": "4cff3ae835812ec90d603fa14bf7290f", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436546, "uuid": "1b3ae0b2-48b8-45e3-83e7-58da270d334e", "comment": "Malware payload", "value": "327aa44733c9f8d2100e4c3b2fb3dae147f2734ac76cc20e8a8ae506ebb1c85a", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436546, "uuid": "45641977-148e-4aef-ac2a-74d0b4402233", "comment": "Malware payload", "value": "fdd4743eb25de32e1200fa7fd82478a4709b19d0", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436546, "uuid": "14463187-364f-4cbd-82ef-195c0565831b", "comment": "Malware payload", "value": "21b127bfd1c8416b5b01cbea464718bc56d4a92a000a52814921839d9798e28228cda241e82f1f93104d01d73859fd6e", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436546, "uuid": "df4fc073-1124-4768-a8f3-bbdeaf9a8714", "value": "T143363370BF810E570A90033AB16F6F2B6F3E4D638B0DE5EB95D992D3355EA42425F0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436546, "uuid": "95495726-1cea-439a-b23e-6c85cb0c591d", "value": "49152:geOtozvwz4H9w+CRLHee+xnHiWIsdd3aUGhLOChYVFjdHZHCvAJ1egJYBrIN:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776436546, "uuid": "c2d336c3-c1b8-42ea-93a4-ea4efbedbc46", "value": 4971912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776436546, "uuid": "34e58099-b822-4585-a576-b8865ffcd1f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436546, "uuid": "b2ab4b87-4b60-4212-a50e-3bed9b7bfd59", "value": "ArbitrjMA4E2328cbjh-YTKFM8RVL958427ZIXJIL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454e196d-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456109, "uuid": "c08a1e5c-fa30-4bd3-984c-7a1b09b94426", "comment": "Malware payload", "value": "9cbed48497e7301a9a78a40ba87921c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456109, "uuid": "6b1b5fcd-c2aa-4f49-ad59-1b2b31d2137e", "comment": "Malware payload", "value": "33d2ea973f861bb7c46397c4e0f9aedc37ef10fb8ab2f4090f35a335d86ef0b2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456109, "uuid": "642d101a-84d0-4990-a22d-e1bdfc0021d1", "comment": "Malware payload", "value": "21e693f088d788e5b144deb1aa5839466427e4bb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456109, "uuid": "2bcedfee-3f14-4ec8-b60d-777ccfb09e81", "comment": "Malware payload", "value": "259bb60172ca128c7b0bfa8b863df303bdcb83f2b6a7d73ff85227710eef699c1458ce34ac1d3fea93e94fbfec31c5cb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456109, "uuid": "7d325ebe-0fdd-4e2b-887a-15fafe7a990d", "value": "T126560103EB48CA97D86EC3F26F730CA56A170F1896426BD745253AAD2D770D60EC1ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456109, "uuid": "2fab21cd-fb7a-499e-a3f5-0de803589121", "value": "98304:hI8853hBalvmUIfWz4bRduLPLgGnjDmzXaLEXlKyzBVFc/0ma92mFrN72uI:FW4lNIesWjg8jizXaLEX7y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456109, "uuid": "2f39c92f-038a-49bf-9166-2dc54743b9da", "value": 6315559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456109, "uuid": "3ea88bf8-b70e-47a8-9ab5-0a3579e57b2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456109, "uuid": "9c667853-4d3c-41f6-9c12-625d1bafedfe", "value": "poporo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd80838-3a19-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776401681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401681, "uuid": "e9f4e6cd-3fdb-4e40-90ae-161387f2960a", "comment": "Malware payload (PureHVNC)", "value": "5fa2c27cf209175deaa0a3a5691935e1", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401681, "uuid": "ec9d1768-4cd6-48ec-a851-6980d0c727ae", "comment": "Malware payload (PureHVNC)", "value": "36658e7f8f72f4f915896d597564339a5bf69b1c6595b5f03c885988b4f342f7", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401681, "uuid": "14c1ce26-a43e-41ea-bc99-624bcff93588", "comment": "Malware payload (PureHVNC)", "value": "a1b091953176957bc2e97aea50b648f317e70eef", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401681, "uuid": "e64dff01-ab20-497b-89b2-5aa8d5062824", "comment": "Malware payload (PureHVNC)", "value": "cbf74350c134ab14702c43b21eefdc876bc8a376a7465a2b27a24915bad83a9d5e2442d376d173fd9f83bf73bb1c0a66", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401681, "uuid": "cd5c812a-506d-4060-b403-d57b11a19ff0", "value": "T1BAC3121A81A3C71096CD6A67E663A4C313DF2B5893BF904BD4B6E90C40B2B17177F4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401681, "uuid": "dd1a3833-77bc-4ab6-bdd6-8471e8668796", "value": "3072:M+sVLmgj2sceqXi38t8BOZ9cwDPrjwahQf:MjVLrDce78t8++wbrE7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401681, "uuid": "174b3fe8-a8d9-4aae-8d35-8a0a21e8b19a", "value": 118293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401681, "uuid": "19976e71-6573-430f-ac21-405805502a1c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401681, "uuid": "b3c55459-32a4-4b1b-9357-16d71a443e36", "value": "TT COPY 5041122904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc53ba-3a23-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776406104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406104, "uuid": "7f94cab4-a207-4c08-8b9d-07b99228651d", "comment": "Malware payload (LummaStealer)", "value": "b14e1f03686f3c28ab6d4018d270be32", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406104, "uuid": "08c73f1a-a2a0-4ea8-ac46-ea5cb2150dcf", "comment": "Malware payload (LummaStealer)", "value": "36b0e08f440fd80a46b81e25d833765c1f0e224de629e8ca6a5e771c32200088", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406104, "uuid": "be09d5a3-cccb-4e33-ba01-767ff0222669", "comment": "Malware payload (LummaStealer)", "value": "82ee6353a068c7100a1a73d2859a9f2e763e3ddc", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406104, "uuid": "a19bb0eb-d6b8-424e-9b24-ed1b0c02bc64", "comment": "Malware payload (LummaStealer)", "value": "31ea5449b76b61d04c76024b5e492b778a8902cabe8d7044d4952e689d416cf539c369eebaa967c63bef68b291580718", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406104, "uuid": "3c61aba4-f3e0-431a-a728-eff7c32a6f59", "value": "T18F954B00FD9354F2E50B163694AB72FF2735AC064F76BA87EA653E7DB9723910822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406104, "uuid": "758f5246-c64a-459c-b64b-7c033b2d21f5", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406104, "uuid": "08c386b1-d6b4-48f4-8de0-073814a09986", "value": "24576:/mdJXgYaEwZQ/LjQDKQedBMwuGiIZxtuJVFaNwb5neGN+cv6hzqspwCQwb3gQso6:/ypb1Bub5PGVbQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776406104, "uuid": "6690305f-aebb-40f3-a31d-674a40e91904", "value": 1945088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776406104, "uuid": "8270daab-5670-4cdf-897c-76f866645edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406104, "uuid": "ba34b240-9907-4437-9995-db7d14c3b288", "value": "appFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33330ca5-3ab0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776466387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466387, "uuid": "4b968906-2474-4916-ad66-d75de283ea61", "comment": "Malware payload (Mirai)", "value": "cc4dc08629ed0c6e842a200e7b464ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466387, "uuid": "8a1f6891-50e0-415b-8ff2-a1b125b2568c", "comment": "Malware payload (Mirai)", "value": "38dad8f0d38d95d8ba435ae7a345bc095ec2850cd8f91103f12df690251a735c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466387, "uuid": "e9fdc7a0-5aca-4925-afd1-997a63d0bda0", "comment": "Malware payload (Mirai)", "value": "1508c2755c3a813473f733d24e367b68967ac970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466387, "uuid": "35d3843c-de53-49b2-91b5-a8cc0b7c34d8", "comment": "Malware payload (Mirai)", "value": "27796efe1c942f3e5fdb4a1558cb0dfb60a6ad6439b0699fa38d2f5338e468d5f6dc54d82bff19b57bdc7892ce00a8b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466387, "uuid": "66fd8e39-54f0-4cf5-b5ae-b608fbd7e464", "value": "T1C5049D73C829BED9C56484B4B0B1DB791B93B49041971FBF29E6C2764087E48FA067F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466387, "uuid": "c53b34c9-dea3-4197-ab3a-7cd50e92e6f9", "value": "3072:j7vtMdVtYiK3ObHI605hZ5u69ELQyqPEhtN9Wqfx0Oami:j7VMdV+ONA9ELusIquOa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776466387, "uuid": "961f1d8f-6d15-4818-9e75-945e511e19ea", "value": 173120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776466387, "uuid": "b22f4616-8ed1-4fad-8172-aec777a55051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466387, "uuid": "13988754-3ae1-428e-bc93-6efa05b79e47", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12c78c1-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776434440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434440, "uuid": "632ac924-71a3-463c-b743-c2da11cd3d98", "comment": "Malware payload (PureHVNC)", "value": "ae130e74d4c99f288e951e3e841eb49d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434440, "uuid": "28e5cee0-253d-4087-ae59-1e8425e2cb5c", "comment": "Malware payload (PureHVNC)", "value": "390a96bc575b9a25b2816ff40ec0659f92827f13b080332f678dd38b6bca895d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434440, "uuid": "af728ce7-da4b-4de1-a5db-2fb45de24b52", "comment": "Malware payload (PureHVNC)", "value": "2e09bfb2c177b5862c9feac641ed8a54613169bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434440, "uuid": "4cc9632c-347a-46c5-9ef7-c2c2908900d9", "comment": "Malware payload (PureHVNC)", "value": "d1e4727ac57179b68bb60d1a82f4d3f0e1fd07692550d4a875fbce875c20265a88337968b2d284140303326737f27b9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434440, "uuid": "f75e9968-7fc2-4a01-8769-443f010b3d6b", "value": "T156341A3DDAD80416E0B2D624FDB10413E56B7F62273D4D9C22C9128A4BB350DB9EDB6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434440, "uuid": "f738abe1-ea75-4a4d-b3c2-1e0391ae08c7", "value": "6144:OzC0kMH0nNtcWvBAqmkceq5kyHd5Z9D3o:6DW/lBAqmki5Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434440, "uuid": "ba715b6f-1743-4b4f-ba50-688d417db251", "value": 236334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434440, "uuid": "b4682d58-ce49-447b-9f60-543d48e64158", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434440, "uuid": "8e86b261-3ad2-48c4-8652-935ba9fd113f", "value": "Payment_Bank_Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa45be0-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1776434402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434402, "uuid": "38cab093-b426-44da-9004-cddf890acadc", "comment": "Malware payload (Vjw0rm)", "value": "6fcd41f5336ecab111e09269de5636ff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434402, "uuid": "bd4ad908-7a49-4f6f-b909-66754bfe855b", "comment": "Malware payload (Vjw0rm)", "value": "399de8881d4ebf99fe32f995f200734c91411848f736758456b610bc2322e318", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434402, "uuid": "0ed59a5a-addb-4fe1-9623-8ff98c1a6192", "comment": "Malware payload (Vjw0rm)", "value": "daa04ee972be4c3c379309a5adb523dc1eae4463", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434402, "uuid": "a08cdff3-7d22-4ae0-82ea-1d7e83769c0d", "comment": "Malware payload (Vjw0rm)", "value": "3fb523cf58039972872095cbe78a8d87b0864d403b248a52211477591c185e41e787f01159db2f45071a50927a677ed0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434402, "uuid": "e12d6ace-aac8-4158-a259-2c28ed5dfa04", "value": "T172364893535417BEE3E88DE620442467E0F1E22F3C6D266AF6F1469BF939E01A435E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434402, "uuid": "d2df3ecb-ed23-4d95-9925-131b508071db", "value": "6144:gFlkgJPqVuXhM2vFiWTIsVBQwyxuQ+2HMd4NaBjMybJ0s1jQ92tI1Z8+v+mAPVG4:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434402, "uuid": "a315770c-008a-4755-90be-1727ffcc1c6b", "value": 4978745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434402, "uuid": "4b5d5765-a9fd-4e3a-b31e-4b2f3d0f07b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434402, "uuid": "39550ecc-014d-459f-970d-a0c10a57f2b3", "value": "PROCESO FISCAL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661b5cc5-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456164, "uuid": "ef608921-3ac9-4889-b72d-ff7df20365e8", "comment": "Malware payload", "value": "f404e3c61291b76e8063c86d419f754e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456164, "uuid": "211a3a0c-66b8-42ff-8669-ec158f50bc89", "comment": "Malware payload", "value": "39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456164, "uuid": "8c74901b-1ab3-478d-8cee-e3f6df0e3f02", "comment": "Malware payload", "value": "6c36c7ae724d70a213f2fb1c61049b7ce71414f1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456164, "uuid": "cfdf166d-99f7-4033-9ef5-a048b664f9ff", "comment": "Malware payload", "value": "bf1311dff8e453442284b7837fe296ec9fdfbbc73575249ed641e0aed037b6aa5b454d3a293269c7c2e3f69dba2da2b3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456164, "uuid": "75b7a31d-81f2-4e8c-9faa-e664ca368a2b", "value": "T1B4D5F045FB999E4EC8F393320C396635547AD827C703C283DD792679288BAF41F852E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456164, "uuid": "d9baaa86-6909-49ad-af4c-e50a49c3ae3c", "value": "49152:O9YiiOk+sQlv7mPnauVe5WfBNOXQcjJbgYzJrksfW5gipFKVq:OtA+Pv7mZk5WfBNzcjhgexLfW+i+Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456164, "uuid": "4d1c98e0-5409-47ba-9ac7-c20881698817", "value": 3016262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456164, "uuid": "687d7f75-c059-4435-bc2e-eef873e86c30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456164, "uuid": "876f9b79-9841-4b9c-9466-4a22dcbc1121", "value": "sagawa(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d329e5f5-3a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776451193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451193, "uuid": "174e52cf-c984-497e-b323-c3fd57b265d5", "comment": "Malware payload (PhantomGate)", "value": "636fe99804bd3a1cb68a02a0dabc8308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451193, "uuid": "5b032f8a-9961-4ddf-ae54-d6a413543b2e", "comment": "Malware payload (PhantomGate)", "value": "3a8817e24a8fe23096ec7182e697493f4a3da28399ea8c789aee9693a2a1b3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451193, "uuid": "716aaba9-cdea-4bce-be22-7d8daaee8605", "comment": "Malware payload (PhantomGate)", "value": "5c27641e6c3cb16968aedc0d736f33faef51a422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451193, "uuid": "9866ddd7-0042-403b-b8a9-585a9da599e8", "comment": "Malware payload (PhantomGate)", "value": "9d198b1d3a6ac2270d99d37a14ed40d17bcc0596e958501eb83550524048cd18259282af8d1e188ee2c631b230e072eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451193, "uuid": "777388e5-6863-40df-a660-fc8eea7729ff", "value": "T19A44B5243BFE5419F1BBAF765BF475968A3FF6632B07954E0091034A0A23E40DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451193, "uuid": "fed0a5dc-96fb-4e0e-8192-a20eaf2eaaf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451193, "uuid": "93497293-0565-4162-af3f-8715be855b33", "value": "3072:s4nOF2klzzlI6Bg+rxaXv9hmDY+NZWyzMPyZw85dSfyDNgZB8+y+LPsk5dGcOqW0:tnORzzO6pgXv9sJb7Z75k6e/iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451193, "uuid": "f878bab7-4483-41bd-826a-fb5941aadfaf", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451193, "uuid": "79e79400-8268-40ec-8b1d-1f08cb25c58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451193, "uuid": "e02e3cbb-c958-43fe-95a7-32a80ddf017e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33c2bdd-3a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776409076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409076, "uuid": "53759c8d-300a-4941-8bf6-91d9a7c98c81", "comment": "Malware payload (Gafgyt)", "value": "3facecb4cb44ba0e8b6b9aa00ed31ed3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409076, "uuid": "b3ad0444-d070-4884-8a66-fad90dfdef64", "comment": "Malware payload (Gafgyt)", "value": "3aa5d9b6715d22c5acf22182475df66becfd4b5943efd887b4be784189aafd03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409076, "uuid": "8d8dc15e-f960-4b66-bc1d-fd924a764c26", "comment": "Malware payload (Gafgyt)", "value": "a89bb2d491bb6ffb3399b1aa7ad206f83486b71f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409076, "uuid": "2b2db84b-5607-4184-996a-ca19d8a743cd", "comment": "Malware payload (Gafgyt)", "value": "56c5535439b4633fdeed276790f292f15f6c2d2045c86f1fcd18cbdbe2a4cc962ea6cf94a9edfcf58233847833fd7160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409076, "uuid": "645cfe95-9b5c-41ad-8a41-e16fb29c7edf", "value": "T136B37D1B6292C6FAC08356B527DFA2618423F67A0B36721B73D4BDA43F15CC95D2D381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409076, "uuid": "32b810c6-7c1f-4851-a5ad-2bef20ff6bb6", "value": "3072:Pl2n/WelPFo8NezN3/S2VvXfpha0fZPCZVOXinYuM8R:FIy4QN3KmphaQZPCZVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409076, "uuid": "eaf8f725-3476-4aa5-a8d1-111165641c95", "value": 112832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409076, "uuid": "175d87a3-38dd-48c2-940f-173dfbbf31ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409076, "uuid": "9a058633-d2ae-4e95-ae97-cc2ad79e61e5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d369e1-3a41-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776418855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776418855, "uuid": "899f5561-4cf9-45f3-b65f-825c62c7f43a", "comment": "Malware payload (Stealc)", "value": "1e3541116cdb680c3e2e2310548841ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776418855, "uuid": "1f536511-9c49-45c6-890a-4f8aae4e00a3", "comment": "Malware payload (Stealc)", "value": "3b82929000530fcbe1c6fed61e83b88dcf1ee95e6ccc623c031e2de6191204c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776418855, "uuid": "fb101e4f-4637-41a5-9d63-8d7282dcdccd", "comment": "Malware payload (Stealc)", "value": "28c8a3e596bafc2ec09c9c3e13421fec8d5d23c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776418855, "uuid": "879bb5cf-752d-4a72-a663-648fb46daaad", "comment": "Malware payload (Stealc)", "value": "9390327b4aabb7a902a7cff62a9404654068c619a249662325e778262f139ec19e455b8331ffd4d1ee41bc71b04224e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776418855, "uuid": "f2b2d213-b46f-4050-af73-d1181948fd69", "value": "T110B67C0B6D9545EAD8AAA732CCB61291B770F8490B3233D72D90BA742F377E06D74B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776418855, "uuid": "f06b97b0-e962-4742-aaf1-58f92958315e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776418855, "uuid": "c5b44ba6-a7df-45e9-9a06-c4b89bda0de0", "value": "49152:QsvpDgxAXH6wK40oAmuuovnvFry2tksVR:Qq4iaw/0fvc2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776418855, "uuid": "78818782-28b0-4db8-a79c-b1487d48d384", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776418855, "uuid": "1c12196f-e37d-49fe-ae93-dc28574cf550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776418855, "uuid": "9cc46482-8782-41a5-a2c6-d00e552b1eab", "value": "1e3541116cdb680c3e2e2310548841ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7c4481-3a59-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776429335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429335, "uuid": "8ea8f8ee-698a-4887-ab07-9a0191b4a4b1", "comment": "Malware payload (Mirai)", "value": "7053467fc5a36276de51d75697c68c5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429335, "uuid": "cabc66bd-eb74-4e45-873f-a48689e0b623", "comment": "Malware payload (Mirai)", "value": "3bcc3ea4dfc287d8ef2801434b546699583a472dc234aa91ebde62abe64f3775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429335, "uuid": "c4f11757-79a4-491a-ba5e-c43169f96e0f", "comment": "Malware payload (Mirai)", "value": "2d8d6c6d8dc0cbd23afa8f2daae0a96d1e63e2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429335, "uuid": "597331a5-264f-4e52-9982-b3128608c39f", "comment": "Malware payload (Mirai)", "value": "5ff600b3535d719de07dd9b69bd49339011d0247437312e0bf709c0369131d8d065d2578e6320a6a16eff03ef1e88da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429335, "uuid": "fc7f7e23-776f-4cdb-b89d-bfae93f8e9b7", "value": "T164D34B07B4C190FDC4D9C1748BABB13BE977B1291238B25B2BD4AB272E49E305F1D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429335, "uuid": "1734ea1a-e930-4dac-8c11-b13e739e5ac6", "value": "3072:m0Y7L9uN7sAk5U1jnJKr4lKqX+qgHsCuvufiZCKmVJ2:m0Y7L9uN7sAki1j4qnf+LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776429335, "uuid": "49003bb4-d0ea-4e66-8522-0475a455e76c", "value": 139336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776429335, "uuid": "6ca6cb90-e4f3-475e-9a5c-382d1d73ada1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429335, "uuid": "b438c6ec-009d-4221-89b3-43ca375a6fcb", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c781b36-3a2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776410568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410568, "uuid": "e7d5eef1-7fb7-4bf8-a39a-2f207b7152ba", "comment": "Malware payload (Gafgyt)", "value": "c20678555dce5681f8397e7489f0a08e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410568, "uuid": "bf5fcea2-01f9-49fc-961e-ff888135a956", "comment": "Malware payload (Gafgyt)", "value": "3bfe374843d21f804ca0c3b18f609696896ceb01262fb3a6869a8322993de4f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410568, "uuid": "ea7a2067-e8b0-402f-9ed0-4c9779b2c96d", "comment": "Malware payload (Gafgyt)", "value": "39a355a507bab3a4983f2c3af24ab3986c204616", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410568, "uuid": "5c81da9c-b13b-4288-a5d4-5cf7838038d4", "comment": "Malware payload (Gafgyt)", "value": "5087bbdd07021beab242164d57e373fd029c6622889e92d3c20f3cfd32011d0a9aff8ff26140edeff9a7b15e2be74f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410568, "uuid": "8428bc30-af54-4fb9-875a-497b2b8c48da", "value": "T1C2C32993F801DF66F80AEA3605D34725B630FB620E931A7273573A669E362D47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410568, "uuid": "635a292c-851f-4ec5-991a-76ad21a1c9e5", "value": "3072:BICcPeHR4p2ld0EjDRHty1K5J32Pw7icBJZxmva0PDGnSQNER:BICcPwR4p2leqy10J3Ew2cfmva0PDGnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776410568, "uuid": "e58f11c8-b322-4739-8ba9-b3275b10544b", "value": 118946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776410568, "uuid": "16f91a2d-fb2a-4c4e-9603-4de199a73d6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410568, "uuid": "d45cd89d-f31e-41ca-bec7-826360836abd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea8b36f-3a74-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776440690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440690, "uuid": "70e5ec4a-2924-4239-baf6-b4f75d93f113", "comment": "Malware payload (PureHVNC)", "value": "5c4d6f8e24bc7ec90ea04ff90d126c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440690, "uuid": "d3cede5a-b1e9-4157-9d92-6a3140aa0817", "comment": "Malware payload (PureHVNC)", "value": "3d07c4fe368878d0c0d76e0f2c06030d947447d200f33b0b9e4ff0d8f431e7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440690, "uuid": "4cb8d7c7-9e28-4b80-af7b-d66c04955730", "comment": "Malware payload (PureHVNC)", "value": "998b65817410cb57f249cc053f6a82f6b644eb81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440690, "uuid": "38ca157c-382b-4d38-8c4f-e10b7efbc4c1", "comment": "Malware payload (PureHVNC)", "value": "dab52e75d080e2f4fcf639bcc75dd035915b0d416f7a7df7a45ba911fe4cec81093d9c5df5bba64f9fea7a15aae22dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440690, "uuid": "f942311a-1c49-4d98-bfc0-dcbcd26bb9bb", "value": "T113D4AEA636634E12C2885733C1CB4901A3F597C67AA7F30E7585139719073BEDE4BAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440690, "uuid": "0dc6e18f-5ee1-46b6-bafe-9874ff7024d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440690, "uuid": "64cca9ab-bd50-4e3f-931e-824e41a3666a", "value": "12288:l5XaqVASGkthd50un1a3TPtCgiHeJlVYHlHJvBUIn:M1OB0qajtXba3+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440690, "uuid": "fb90c514-9079-404b-9a5c-1985f1071bf0", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440690, "uuid": "e4da3a99-9ef3-4210-b2bc-4d17b98f3741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440690, "uuid": "73430a12-5b00-4b41-bb75-9f0d7be42d95", "value": "SecuriteInfo.com.Trojan.Mardom.MN.11.36657185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da6d862-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776452338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "5a306597-4348-4276-b9ce-a16f700c751f", "comment": "Malware payload (Vidar)", "value": "cdef123c6b8fa7dfc3b48ef037417345", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "e1e085ae-39d5-4112-9bf8-c33e7c6abf06", "comment": "Malware payload (Vidar)", "value": "3fa2c7e292d695771dcdaf94c8067566f99eef59ecb1e079ca4b48bfd90fc205", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "e3f03124-1504-4f19-bdb4-9e99294b4dde", "comment": "Malware payload (Vidar)", "value": "b14c7d499a37fbccd2a69a72ed344830eab1e628", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452338, "uuid": "d1388660-45f8-42c7-a82a-4e5f50e792a7", "comment": "Malware payload (Vidar)", "value": "bdea7f2fb9a121a16ccb03b9da0d93df88b47cf61f20f0f280df59c3c4fd6982e3828dbb4d3f020711879ec40f02d8f2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "d5f6ae70-799e-4ba2-aa65-7a02d59c0807", "value": "T1AEB58C0BACD518E6C46E97328DB626927B31BC4D0B3263D72E9076782FB27E49C75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "de237652-8fe5-490c-b144-6d44d7b09458", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "e9d90b76-82c4-44ae-9754-578de5580655", "value": "49152:GrxKtEBIdvrDqtau4Fo9AUDvAYLRkbAAS1WEnY:Gri8WfjUUQ+AAog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452338, "uuid": "363ec714-af90-469d-9eb6-9dcd6ac92411", "value": 2349272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452338, "uuid": "82307e83-19ee-40b7-b414-1afd3fc6a49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452338, "uuid": "d9e1e261-11ad-4035-8e56-81b61b38b223", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae3595a-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392392, "uuid": "1090567c-dd53-4be8-b092-7ccc8cf6e9c4", "comment": "Malware payload (Mirai)", "value": "63bc73c0adb3acf412c44169a4e91972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392392, "uuid": "5cc142ce-c2fb-456c-853c-c1f570c470f9", "comment": "Malware payload (Mirai)", "value": "3ffa61bb30699516e9aee0b1dc7052005441f4b9027adc5168e8dc7c42208614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392392, "uuid": "a086bd65-7eec-41ee-ac29-c3253e6de89e", "comment": "Malware payload (Mirai)", "value": "1f95424e172635254a325362dabcbb701465b932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392392, "uuid": "6d439642-c4d7-427d-875f-26d62c51c4f0", "comment": "Malware payload (Mirai)", "value": "e605344421d463f889c02df9a8cb25a6760de8e96c001d08beed90d21cd36054944794c54d388a453204b3517d243815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392392, "uuid": "d6fba710-5687-4a5d-80b8-9ece529c899d", "value": "T154E32A46E7408A13C4D6177ABAAF42453323AB64D3DB73059928BFB43F8279E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392392, "uuid": "75ffe03e-a14f-44bc-9dbe-84a06323d431", "value": "3072:X5uRoJ48aV7/HBcP0x57mW7gz4habLNJmM/9wGS:X5uF8aV7/HBcPs5V7A4QbLNMM/9vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392392, "uuid": "edac6e1d-c297-40f1-89e5-25872417f0a3", "value": 154303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392392, "uuid": "8c6f863d-9cf1-4727-87a2-fef316347e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392392, "uuid": "fdb4b9b4-2df8-4ffa-8894-7a2e77791487", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66dc830-3a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776452058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452058, "uuid": "6a1d3746-4271-4cd0-a838-42acc1883d8a", "comment": "Malware payload", "value": "1c57bc8a38fe9a2a8dc37c09604bf56d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452058, "uuid": "a4ed86db-0414-41db-b8ee-bb1874581e44", "comment": "Malware payload", "value": "4039f4b7894969cd03b96e0e004b2da18445e24eb6dbfdec09a1a0de685e4215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452058, "uuid": "66675b41-8c4b-4e2b-8726-517f856f4343", "comment": "Malware payload", "value": "9414288a2731d053b7e4dd88e448ab51ec62dd2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452058, "uuid": "402db164-94a5-456b-b350-fc5d86d71bc3", "comment": "Malware payload", "value": "0f8e2ed40cced2f6b8a1054c5b1c9725fbc3f75de4566bf1b1f1f45a43bb58bf7c4b4c58e91b28fe755354bc3fc369c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452058, "uuid": "f5014586-afa0-4920-8865-1e6bd10d0420", "value": "T11CB58C0BADD518F6D86E97328DB666927B30BC080B3223D72E4076782FB67E05DB5744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452058, "uuid": "8165653a-c76c-43dd-b858-7b639840e38c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452058, "uuid": "9068e7d8-5496-4c92-a70e-3a724c2a4c9d", "value": "49152:ZhvNsyyAzCcbtPql/+vye38MqNEi+3BqQ:ZhONSR+sye38Mq6iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452058, "uuid": "306c9d48-4219-4a0c-a467-a6cfe9f53cb6", "value": 2359000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452058, "uuid": "a43a954e-8e6e-405e-8969-2b153e103f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452058, "uuid": "8b52e28b-6729-4e22-afbf-96349d662fdc", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0601ba-3a32-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1776412285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412285, "uuid": "7fcabf03-d648-49fc-9c2d-65596886f6c7", "comment": "Malware payload (DarkTortilla)", "value": "34bf5d52d3e9ba4b41c35ba443b6410a", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412285, "uuid": "9802aad5-1bbd-4226-9262-55658ee91164", "comment": "Malware payload (DarkTortilla)", "value": "406c463a0a5f7dbb86653a0c5d6e49793e423f096c6c871e468b4f5cbf369059", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412285, "uuid": "9f6c5abb-fe2f-4d36-ab6b-c739334d4618", "comment": "Malware payload (DarkTortilla)", "value": "f06763cebc5fc3a273d799231722889f7f646965", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412285, "uuid": "976001fc-ede5-4c30-b263-3551cc761dd3", "comment": "Malware payload (DarkTortilla)", "value": "e694919b156fbdf863f2919e880259ec7b47ac65924d9e6225a076ce6d1f01239424aa5275c3a5b8e2aca86f076eb48a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412285, "uuid": "60a638b9-9779-4a8e-9583-1d50bd37f272", "value": "T189A5C0990B8EC6F8D36BECB482C79C4BDBD5C21E172DD6859B637DA52022C6CF0B5484", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412285, "uuid": "f702c8da-1318-400b-84fe-7696f3e75b89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412285, "uuid": "f5ea6bec-6e1c-4c06-8cee-91aa66283d11", "value": "12288:TJJPgQXeYqeq4m8aTtDCUwwtaRvjVLRiGzu+W:TOY1t1aTtDCR8aRvjV9iGvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412285, "uuid": "f437c684-a4b6-4e08-81cd-3bcbdbe17af2", "value": 2217472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412285, "uuid": "5501c358-00a3-4db8-85e5-f5e6ac57f290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412285, "uuid": "c5110a25-c0f6-4a1f-9212-847422b4d0d3", "value": "SOLICITUD DE COTIZACI\u00d3N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bedc43e-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456094, "uuid": "e25c92fb-fb8c-41fd-ac2e-b9fbd771d9b9", "comment": "Malware payload", "value": "9ec136b98628f58161c2e6028a6f62b8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456094, "uuid": "78c6eed9-aabd-410f-b6db-fca0b03b0431", "comment": "Malware payload", "value": "41a9c5a298128b8c000227443ed3c1bf4e6ea17c4c8b91496ca7674ca62b08d7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456094, "uuid": "caa443d0-bdca-4814-a9a6-d9b7a6cb55c2", "comment": "Malware payload", "value": "c9c76fcbddbb00c5daaa34cf8b7d843773ec7e3c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456094, "uuid": "3f76839b-096c-4431-a3e8-3de694851e47", "comment": "Malware payload", "value": "8b4413054ca885826a86c3e60ec3f042d68f04d280090135e39e0accd2b19786930bec2086aeab328736b95760b4679a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456094, "uuid": "5fe193b1-1d94-457b-ab5b-bc315d7eaa30", "value": "T1E6560189BB48A62BC837453349F65232554B4D978E83D7832928720C79B7AE41F5EFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456094, "uuid": "fc8ac4f8-1a63-4378-b24d-5f90f4734aa9", "value": "98304:KbTa4wTiT0d2ZrlijBKgMHM1Mb2lZHVB+SdCzyxkmi11K+9fhXHLi6t7suw3gAYg:KbpwOg4m1M0PLM1lTbijgAYgmTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456094, "uuid": "dac27989-6d91-4f32-b296-0d3c88651fd7", "value": 6303572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456094, "uuid": "0c40d116-354d-430b-8fa5-e36b6a67a3c7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456094, "uuid": "3f4376ba-0fbc-42d7-9419-432c5365430c", "value": "LifeTimePay.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2608635-3a51-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776425798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425798, "uuid": "b70a584d-295c-4d19-8792-12c683134f62", "comment": "Malware payload (SalatStealer)", "value": "6d32e99dbcc6ae9591e4d777c4358822", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425798, "uuid": "c02752c2-f8bb-4868-b3e4-aafe34530d3a", "comment": "Malware payload (SalatStealer)", "value": "43046543479a37aa6d74770fda7b3e176203b566d788c48164bcad17a8221ddb", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425798, "uuid": "142f6d55-0878-40eb-b098-6e70af965bfd", "comment": "Malware payload (SalatStealer)", "value": "877ba68352e93abd089109740b915385d683f792", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425798, "uuid": "dfa4211e-6a22-4417-926b-9998430fa562", "comment": "Malware payload (SalatStealer)", "value": "124057570400762145c900b5fccad157c283a4a520bde19649d80bf2ff2ded095c610ed9788f66422b9bfaa8c172b9c2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425798, "uuid": "cd4075c8-cdfc-4300-8d97-412e765e37b7", "value": "T164863345FF8216F9C5B209701C9FE33693762E8D0406DDABDBEEACB1BE66301191611E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425798, "uuid": "6b00ead6-fefb-444c-b26f-df1a846f60b5", "value": "95a68223cd267e9104dabcc375bdfe65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425798, "uuid": "0e6bb231-14d0-47c8-819e-360719870db1", "value": "196608:147/pAbkfLzY5N/bato1vGU8cjBtMf6Cmzy2H:I/pXXqb4ivG7Gys2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776425798, "uuid": "9aa647de-ca3d-4aeb-b5ff-6b8267447024", "value": 8442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776425798, "uuid": "3fbb4d52-a389-4a8e-a710-75bfdaaf1142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425798, "uuid": "25311725-3930-4cb7-955f-a18b507a1541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d9a1a0-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458501, "uuid": "1ef6dbf8-df0b-4ff2-94aa-cd2a650b43b1", "comment": "Malware payload (Mirai)", "value": "a7c326799f1d81c73144c0644be5cc93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458501, "uuid": "89c434c0-f9ab-48b3-8655-385f39ef8a95", "comment": "Malware payload (Mirai)", "value": "43bedf7bb6ea4abad8c6a2e4a816c97230cf0e0ee461a286109f0aa61dd00be9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458501, "uuid": "63335619-7e5c-4d3a-b43d-df26202739ca", "comment": "Malware payload (Mirai)", "value": "2a53fc5f088fc7416e8642eb225b6ae5ee7a2e29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458501, "uuid": "3221febc-9aa0-400c-bd8e-ab1d4b6c1b85", "comment": "Malware payload (Mirai)", "value": "3606892603e1773e73c15f5211fa39683a07d37c38c1ba6e7e2c7ead40a0e0f6b7971d59248874d26e12f2f9d5c55962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458501, "uuid": "b10e318d-958d-4bff-ac3e-3cde47129530", "value": "T16BC33A86BD418B12C4C325B6FE6F448D33136BF8D3EB31168E25AF6467868E70A37615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458501, "uuid": "1a8be697-dea5-46a1-9b13-3116245581e8", "value": "3072:V82K0fOPQKzlRuWm7KJacKL86i5ILQCmxWH:xWo7qaxLH/LQLxWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458501, "uuid": "3d544102-025c-4f77-a4ac-0b29c09c5baf", "value": 119532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458501, "uuid": "6d304387-ced8-425f-86f9-afb88811460b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458501, "uuid": "56c4a33e-17cb-4377-94de-83b32de3c9a2", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedbe5d8-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458514, "uuid": "dc6948d7-16a2-44b3-982c-f59e35db0c4b", "comment": "Malware payload (Mirai)", "value": "e5fec12ea4b8347832bc1efc15aa7825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458514, "uuid": "3517b39d-def7-4b8b-9460-4488dbb10703", "comment": "Malware payload (Mirai)", "value": "44530a1f51017fa9f5ded69655d0638c0ee4498c1168030a816411c91741d006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458514, "uuid": "eddd54c5-924a-4829-9406-6e187a22f4fb", "comment": "Malware payload (Mirai)", "value": "1028534e2a9e82b68e7c1bd5afeb0a1dda51e97c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458514, "uuid": "63e70d55-0776-47bf-b2a0-c4800fac30a7", "comment": "Malware payload (Mirai)", "value": "2403315573a9c233a86fe7498596fc8f844e072c8f8e5939f9254d92844ab7ed5c89056f6d5efaf1a5a495554ff837fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458514, "uuid": "37053e80-3ce2-4deb-8f1c-5bf4f98a1bb4", "value": "T13DA31981F9878AFBD41744B401AAB33FDE31ED2E4436DA95FF606EB2D6235C12216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458514, "uuid": "fdb3f525-3f58-4a7c-9f3f-22c1fab1739f", "value": "1536:nZOuPhRMmmJppljN6Ldz2P9aF5teWxDWG8h0U6drzhqN7Rsk/s0A2BgQ:1e3Dj8Ldz24rEVbl6d/hwlskxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458514, "uuid": "7b55c998-33fa-458c-bcf5-8475508477b6", "value": 99048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458514, "uuid": "7a87f70d-1f6b-4e83-9ce6-66d0cec116bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458514, "uuid": "60512722-7293-4d59-bb43-432bf46b9f60", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bde8025-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776434592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434592, "uuid": "2ccba193-4c51-4923-acf6-4f9e67a863d6", "comment": "Malware payload (PhantomGate)", "value": "0c007f332363d100251889a1ba3a8d82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434592, "uuid": "38b75f30-9cc3-4c03-92b2-cb775d10f00b", "comment": "Malware payload (PhantomGate)", "value": "44e085b4223c112802a0b8fa6cb6e9e4890e313c7c28b2a75ff9d336c6f1e77d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434592, "uuid": "0865574f-b708-4557-bb73-ee697ff28153", "comment": "Malware payload (PhantomGate)", "value": "110391e32e329c61e41feb831c5c3df37a381453", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434592, "uuid": "1277e6fb-c545-46d6-b670-2abcb8d272ac", "comment": "Malware payload (PhantomGate)", "value": "0d64dd0c8a4fac4ad58f52fe22065e0f9a6eee83cbaa4a50764e51c25a508af123ee4ce8b7585b5e0def9b31849fe66b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434592, "uuid": "177730c2-11b3-4acd-9a9e-4f57400e6230", "value": "T19663627CCDD60848E8CDAB5CCCAF5C048B3B26B910D823325959B9BCB63D5DAC5E5392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434592, "uuid": "08661ebf-ea81-4d0b-b5df-5beeb2921b69", "value": "768:gZA5TMWst3+hhZH5lDv2NgzQB7E8uFiidBdkC5GwCm19mi:gZAZ4tOdD723B7XyDB/jCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434592, "uuid": "8158200b-11d3-488d-b779-55faa594b930", "value": 69473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434592, "uuid": "9b180204-3583-4a46-bfa9-eb46746275be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434592, "uuid": "80c04e41-9d6b-4555-b14d-de09d499cb70", "value": "invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af7a199-3a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776413518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413518, "uuid": "c4d9eba2-eb53-46f7-9725-ec18199f6580", "comment": "Malware payload (Vidar)", "value": "101efcb72da77671d56d1e3153acfdcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413518, "uuid": "73b238ee-c137-4681-beb2-6d604601963c", "comment": "Malware payload (Vidar)", "value": "454850749d874755a8e1e43e5a128a9fa39ffe49f5ffdbe9f264b5997ccb039c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413518, "uuid": "f1b25b45-6b7b-454e-b56b-7a966dae47d5", "comment": "Malware payload (Vidar)", "value": "6e01e7362996ff2b6289d7e72cd4e00fa285e42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413518, "uuid": "9a0dfab0-c13a-4d4a-8c7c-33388577c450", "comment": "Malware payload (Vidar)", "value": "59ad373c13092c4c9279b8f6ebd0ebc19237f67a03fbe44d4633a55049d890ea0212857730dcddc5612c6378c97ea7d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413518, "uuid": "9d7508da-ec95-4d6c-b155-e84ff6bae7e9", "value": "T1B5A58C57AC9144F6C0AA63328CB632857BB5B8580F3233C72E90BA792FB27E45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413518, "uuid": "2be7c32f-4e5c-4a95-99ed-075378084f26", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413518, "uuid": "5569ddf1-035e-4197-923d-449e0e06577e", "value": "24576:59ZhgxBq+gszyaDcF3ey5Gho6z8Q609RXiYhbhPwcj8aXwrr1USezP5gXuKFhelP:59XKBzzya05Gho6z8yRyO9PLj4r8nM6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776413518, "uuid": "264b4ba3-6008-4620-bbfc-61ba11405b23", "value": 2207392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776413518, "uuid": "862f3f6f-97c8-4ea5-9fa2-bc3bd59f274b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413518, "uuid": "15331e61-9fa4-4707-8866-850a422b4b4d", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1749d0-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776440365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440365, "uuid": "808eb76f-20bd-4a96-9cfe-47eb92a5e8af", "comment": "Malware payload (Gafgyt)", "value": "fbde4648edc3c5e2f533244feb87236a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440365, "uuid": "443f386f-7dd2-4f77-8e2b-11d99e67705f", "comment": "Malware payload (Gafgyt)", "value": "4573480fccf2943c780c4bfaddb8050f4bb589c4c58e17640a6c9035653d0de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440365, "uuid": "5fbe0985-3c25-4f14-bd70-83cef74b1076", "comment": "Malware payload (Gafgyt)", "value": "7ac1949ead1be397cddca0cb300e12e0eccf143d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440365, "uuid": "df449b63-64c0-4909-9520-3ffc41efb996", "comment": "Malware payload (Gafgyt)", "value": "f7ab10ea989443022dc269d724a6509b6913ed7d096b98665e56c4fa6490fc5679a87e61700a46da396771fa797a486d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440365, "uuid": "d365ce5b-f7f3-49a3-8299-90cc5d10496e", "value": "T1C0430229175208E1CCA8C4F75BAE129C3C758FF3A962E48F560DCB59ED7107AE409BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440365, "uuid": "18f78e8a-b227-4143-829b-dd6e287220b6", "value": "1536:6K7LSKy35Azdw2mXdh6OBVIzVYbIKmk/iK4WFE/2mVlVrYW:6oAYi2mXdhhLmVyliKQNfVrYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440365, "uuid": "50848ba4-2362-41d6-a599-3d41d0f2ad84", "value": 58616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440365, "uuid": "6a927d1d-63f0-4212-a2fd-a2b903b27b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440365, "uuid": "8213fbe5-102f-4751-b329-d47f451d110d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf11d90-3ab0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776466697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466697, "uuid": "84d8973f-c12d-4427-a1f5-b652e5e2b0ae", "comment": "Malware payload (Mirai)", "value": "90794dccec61e717441265ea4ecac497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466697, "uuid": "7464e460-4aa7-4b2a-aec1-6d23070cede4", "comment": "Malware payload (Mirai)", "value": "45b8eb42c6dfda5111041524483ec121ef02adaf04f9be6bb3de68e205dfaab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466697, "uuid": "19d0fff8-7629-4276-96dd-c874124fa3a2", "comment": "Malware payload (Mirai)", "value": "7749950af8421a2c07f88571b620d7e5e1e7320c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466697, "uuid": "0e64bac5-34ff-4189-9044-41610b4aa372", "comment": "Malware payload (Mirai)", "value": "7b6bee71d74d1d71eed1c75b8f7ab4a2e660f28a3233b7be538352b3bf966ffb59583ab67025e850da8556c654f66821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466697, "uuid": "0f1a27e7-6e9a-4c85-a79f-e93564b34123", "value": "T1D0832933B392D8FFC54A62F406AAD0B1E660B97E1B31716A63D3FD260E719F81B15610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466697, "uuid": "b85ef297-1abd-4ac4-8b28-19db290ef545", "value": "1536:H/5rFGqP+fCV/vNLbplVyf5DR0oC6z5EQ5SaN3E3RW1I73rZA476H9:Jz+fCRF5u0aS3mI7bZCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776466697, "uuid": "20a4afc6-c183-4648-aa17-83a21d3e750d", "value": 87768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776466697, "uuid": "f267bf17-0da0-4cae-a6e0-f15a36153b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466697, "uuid": "d5da76bf-706e-4cfb-bd26-025d59b804e5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5ce5ad-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776446756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446756, "uuid": "044b00e1-90ca-4ce4-8d23-b461e7c22b36", "comment": "Malware payload (NanoCore)", "value": "f63448f498f8f7d34b194d54e9a95a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446756, "uuid": "a735062b-0caf-4768-bc42-165cf3edf59a", "comment": "Malware payload (NanoCore)", "value": "4686b6e4902d8a89e97eaa78b4513344537e8031da2fa2b31dad8df30496a3fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446756, "uuid": "a7faf35c-3225-48f6-8880-b2386732c78f", "comment": "Malware payload (NanoCore)", "value": "2ecd4622e6b93894792545b0851900a3b3188ced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446756, "uuid": "458ee1ff-db24-4b1b-a813-65924bfe7923", "comment": "Malware payload (NanoCore)", "value": "5499bcc6d0a4051fd145f6ed9eba5cc7a3b3017f1f2dc23f628738a4d0afc3842592c0eee321c77ef6dc3e7e261ae99c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446756, "uuid": "ee1ebb47-ca6e-4836-ac58-73f9b27a7b5c", "value": "T13264AE1533A8B51ED19E867867125176437889D29CC3E3DA28C872FB7B7EAE006371D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446756, "uuid": "e80abafe-d443-4885-91d3-a288e9a67046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446756, "uuid": "51d68626-745d-4870-8f6f-be9addfb72b9", "value": "6144:KLV6Bta6dtJmakIM537cGLYiO5C3e6s7338vSI:KLV6Btpmk2YiOS1k3TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446756, "uuid": "e40797cf-f49b-42cb-af49-5c723d097f5a", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446756, "uuid": "f12dbd1a-a328-4722-b2d6-97782a065802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446756, "uuid": "d23965ec-bf18-4266-8221-aa395ee3df5f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e183fc15-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458519, "uuid": "f11b5c01-226e-4e60-b97f-693d03f22bf4", "comment": "Malware payload (Mirai)", "value": "cef74e7045124d01066a0ea762ff5b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458519, "uuid": "2d9a08b9-d8a7-44f8-97a8-94c001006be7", "comment": "Malware payload (Mirai)", "value": "46d20cca8250134ee80d0eeb354d458ed189c107770fabec558a0c1de9ed4391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458519, "uuid": "2889b14c-9e79-40a2-8e1b-0f15a07788fc", "comment": "Malware payload (Mirai)", "value": "41292c7250f8df002f39e7dd49f9078fa2a66936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458519, "uuid": "292e58aa-cb22-4c82-8840-469505ca9687", "comment": "Malware payload (Mirai)", "value": "3019712498e82d702f33c6ae13411eadf7569d877ba84b3a873a53fc9cb551fc5645c1db4346bcaa11bdd08311cf0b72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458519, "uuid": "3e67bd76-69f1-45e9-8ae8-f1037f9ea2a3", "value": "T159D3188AB9418F12C4D225FAFE9F418D33135BBCD3FB31128E259F65238699B0A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458519, "uuid": "de31120f-7294-43fc-abbb-2059a360cac7", "value": "3072:pAAHpBk9EyK+IJuemb19UpatAZqzXEHuSTzm2sD4wQEU34/H:TMBBKpatmqzXEHuAzmawQEU34/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458519, "uuid": "cb7157c7-594d-48d5-8dfa-9e928d203a0a", "value": 136216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458519, "uuid": "ca8dfc82-ce4d-4b71-a187-2e2eb803c891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458519, "uuid": "c43d010b-9c88-4b32-bc78-f693c5dbb3e7", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cd52d9-3a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776400754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400754, "uuid": "19c42abc-7175-4add-9852-480026ee3c8b", "comment": "Malware payload (Gafgyt)", "value": "1c7f2666728c3abaa172194ded6db75c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400754, "uuid": "19ec09be-eac6-420e-b944-baf1f2cbaea9", "comment": "Malware payload (Gafgyt)", "value": "46d937ba544d4a698c56a0ec636c0666c46725a8f76c71afe36ebf006758615b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400754, "uuid": "1a6a39f4-b488-41a0-aebc-923de3b710cd", "comment": "Malware payload (Gafgyt)", "value": "5629e82a264e773bba534dc3f8d7efa07ced4c78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400754, "uuid": "15fb7fbd-b20b-4b7b-ac13-52bbf2d38c47", "comment": "Malware payload (Gafgyt)", "value": "e39e937d5b7924f17317ff47a01e45395e8609b48daff33ddbf948116d3d99f32edbc0d866b560e211b987bb15c45997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400754, "uuid": "367ab449-2e5a-4af9-b5e2-f6f188254145", "value": "T11BB30A1377B1D9BAC04396B41AEFA1F19462FC7D0B32322B33857DA52B399E42D59312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400754, "uuid": "9131014c-73c5-4131-aac8-016d136ae95a", "value": "3072:Ad0wAZFb0Od1A8tFNtU6JKkwFUmDk1c8xF6KjW:Twaa8vXFXmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400754, "uuid": "c6c486e9-fe1e-46f8-ba6e-bd8c62badda2", "value": 115529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400754, "uuid": "903fda98-1c69-4fc3-91b8-0d1ea55f5d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400754, "uuid": "10343ef1-8234-4646-84f0-dc3594e2c307", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672e7ec4-3a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776400761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400761, "uuid": "302dd2d5-54a9-467d-8c5a-f50a1bac8124", "comment": "Malware payload (Gafgyt)", "value": "9054128fe760e8492d3af90be5bd8893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400761, "uuid": "716b0175-ac9a-4dc5-9d24-9f2f1ccdcd3a", "comment": "Malware payload (Gafgyt)", "value": "4727b391523ac2067245f1118234692de69227d0ff9ade8deb35bf0b58b32c17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400761, "uuid": "1788371d-fd06-4ceb-a323-ca7eb8d40a2d", "comment": "Malware payload (Gafgyt)", "value": "02e2179d4a8f91028bdf806381c8069e0576c6dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400761, "uuid": "4a706d91-1627-43a1-9a4d-cb5cf616acc5", "comment": "Malware payload (Gafgyt)", "value": "35b0728f55b0b792b60dc75f59e2d71677bdb26abcdbcfbde79982ddd36f9b39796c2932dfda710477d8322449d22b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400761, "uuid": "0835a416-07c3-4e0a-9cdf-8c083a97ff75", "value": "T1B5C3193B6B270A23C0C9107116E31332B9B5DE5D34BA93D3AAD07D9C6F3A98434567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400761, "uuid": "533bc802-fdbe-4989-8291-634db492e6e3", "value": "3072:TFSbHDfLXTP7nj/r3zvbHDfLXTP7nj/r3zdvNPpmck8fm2pwYux3I5uW:5slXk8fm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400761, "uuid": "41a8e183-abfb-4f3e-a9d9-9613a011deec", "value": 127294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400761, "uuid": "7ee33231-8ec9-42a7-a0aa-dcdb4566749d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400761, "uuid": "1c4224d8-ae35-4362-a50f-bc79d9537daa", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879238e2-3a54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776427015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427015, "uuid": "2144b257-256c-4902-8106-3d07c2fbeffc", "comment": "Malware payload", "value": "37d2bb4b894d3a8e06575f54adcecb26", "object_relation": "md5", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427015, "uuid": "469989d0-19f7-4b65-9fed-e63f70b3a3ce", "comment": "Malware payload", "value": "4771a69c40d984dadae8a485e53e0fa7ba2b032b7ea1e9d05f927748bcaafcc8", "object_relation": "sha256", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427015, "uuid": "ba72f826-87a1-4af4-8246-45d3f2eb32d4", "comment": "Malware payload", "value": "f4d9700e4c2054976291a03b7c352832668c87ca", "object_relation": "sha1", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427015, "uuid": "86068b19-2f43-4d1b-9c90-ea74d58bdfba", "comment": "Malware payload", "value": "bcd457f9dce2ce0d4da8226d81d8fc9d52c2f0f75aaa80ccfab7032dd5bb7fc60aa64968270ff9143271b8e28418b3e6", "object_relation": "sha3-384", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427015, "uuid": "5b656dfc-13a2-4463-9acd-de9d7f2bdb7b", "value": "T159F733EA3D255AADF361AAF0B6E54332DE7001F2EDE290DF2A5025C04F42664CD3D96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427015, "uuid": "0652e124-476b-4cab-8b49-07a7d86470d7", "value": "1572864:j8jgsgGJ3KqMKoVA047AfvBrzMEOXKcka7TGq/UUIc0juW3B:j0lVMOMfvBrzMNx8UnQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776427015, "uuid": "9c9ab28c-b3be-4dad-8998-7d296a7d54d0", "value": 73976640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776427015, "uuid": "b5481d17-0261-4f71-9ba3-860aa5c9047d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427015, "uuid": "fe822f77-4721-40a7-8fac-f20822202419", "value": "DivineX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2723211e-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776426423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426423, "uuid": "16025d9b-b688-41de-98bd-cfd7d10b924c", "comment": "Malware payload", "value": "253d1d7fa8817c083f531bad8db3370e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426423, "uuid": "b9a01040-e223-4fbe-9bf6-c608dca95a63", "comment": "Malware payload", "value": "47fcf022946a3c1e9049877f85e28a677b13dc5e467bd919d4938c0e564c4903", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426423, "uuid": "f9f2ae96-7674-4133-ba16-05140a31fe6d", "comment": "Malware payload", "value": "3ced4477aab2b78ec23472c9630cdf025c3488bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426423, "uuid": "8fb6208e-7495-4b3d-98d8-2da08e807369", "comment": "Malware payload", "value": "e36315a4258f26d0c0b776d340c4f816ea21e0bf6404650525539b2ea79b503cfd63b8436e01038682fae78acd0a1e6a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426423, "uuid": "17b03bbb-afd9-46d6-8bfd-d048d7e9704b", "value": "T1EE136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426423, "uuid": "1034f378-b383-4c45-8e01-a4ea1f644b2b", "value": "768:bjjs9NyXsZztCA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bkHusZUco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426423, "uuid": "b2adb197-d15f-478e-85d0-c5754f55f6e1", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426423, "uuid": "a2d3b5e1-9a1b-4a05-ba14-a3d5b15a8d19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426423, "uuid": "ac343d15-d512-469c-8eb0-ee9e90e6621f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918027ed-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776440346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440346, "uuid": "daaf4c37-3695-4f96-9fbd-e2ba37be8715", "comment": "Malware payload (Gafgyt)", "value": "c222b712806ebb6a601272df90353d27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440346, "uuid": "5dde78c9-6c5c-47d0-a483-3b0b7bd21dd9", "comment": "Malware payload (Gafgyt)", "value": "4828d141d7c6b23d0e150aa5e88b812edfaa80ed31fea8f7b6e960144e96f58f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440346, "uuid": "40c5347d-8771-45ed-a387-4f09af00558f", "comment": "Malware payload (Gafgyt)", "value": "2a7c7d8ac26a6a714d0c06e617ca1747ba486285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440346, "uuid": "d629bcc6-fd80-4c31-8522-bb2a78f35fa7", "comment": "Malware payload (Gafgyt)", "value": "235e923f9b2ddc05f58ed958ee4eefe10b7fdcf60d500d76b70b9ff9381342f5b894d2cada00ae6d7d20f26bd30dd3fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440346, "uuid": "a29bb779-2969-423a-97a6-50b14b1bbbe9", "value": "T11443F255F2BFDDA8C7B61C7201EC0056F7957D2227862BB308C512FEA512A46AF352B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440346, "uuid": "9508bcff-ac54-4672-9a40-81be4236e75b", "value": "768:bGlZwyTPlxj+6PoBQKwOiNRsls9fh1m9I5DAz/ihlisNsEdU9+eNsq+zA8KxdXOJ:bkpB9+Ign7qRTDvt/NsEkrOFuuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440346, "uuid": "28aa8274-d699-44fc-909e-9dd19949dedc", "value": 57648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440346, "uuid": "d438e361-fbe7-4f28-a85e-0433f60d1dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440346, "uuid": "6340a19d-1e01-49aa-8106-24c2b568048a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c326ed2-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455826, "uuid": "90cd458a-470c-4f83-9cab-42b82e93fa3e", "comment": "Malware payload", "value": "cd6f56c5fd3ef23c45fb5fd9b5217916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455826, "uuid": "f1cf5bb1-4d37-4a3b-99f6-5164c570391a", "comment": "Malware payload", "value": "49d0c1f61a118ddb2363c29013b1076f62bd8dfaa34779afe25a404dde328679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455826, "uuid": "5b3791be-deae-4026-b4e5-f95a026ea5fc", "comment": "Malware payload", "value": "44160fb69f18e9f41924e7528daba94823b4b476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455826, "uuid": "26a95a58-9a14-40ef-a3df-653014eddb1c", "comment": "Malware payload", "value": "77808a3f793b5e1455f109cd20175ac8e5c92846026200404ed0cc61023bb955677b6347fce61adbabc11fbcd4faac4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455826, "uuid": "bcb08fca-aa38-4059-bfba-6514c8f56207", "value": "T172339DD2C8BABE4CD51462B0603ACBB88383E500D9835EBA661BC6744847DCCB25F3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455826, "uuid": "d747f301-0e12-4f08-ada4-05b80c3c1c90", "value": "768:AUFsvA5NrJUsXkSnMSA63tZCNgVw23J4D9hGGijPovWGwRVCzS7:8UUsXkAMSj3tZCNEiD9c1g+TVCzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455826, "uuid": "c2e72074-0872-4181-96dd-96d56c0a16d7", "value": 51640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455826, "uuid": "0f7e2204-8e55-4621-8302-80700e80aec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455826, "uuid": "7302febf-bfbb-45ad-a62e-de87991a986f", "value": "square", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547ea162-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432512, "uuid": "55be8eee-29c6-4368-8fea-0e983c633f34", "comment": "Malware payload", "value": "f2b90a91887b6fe7893cf9d05cfd7d5f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432512, "uuid": "8236e2a1-19e0-4200-95bb-82f1d139d5cc", "comment": "Malware payload", "value": "4a601595920175c34112d066aebe929958232b360b75e802a0c07266285627fc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432512, "uuid": "6c3d766d-5768-4c0d-a040-6082e358bba3", "comment": "Malware payload", "value": "c9ab3f8ec90e4b35612ca6486baa8b7c7fe66f96", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432512, "uuid": "14eb8fd8-5b59-4e01-9a47-ef0fb3d98350", "comment": "Malware payload", "value": "14f2eaed3ec2de74a9a19d9c8027fd5c096862b55cfff74adf5a370dc5e293172cb23d800d1b99b018e83aeb56680951", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432512, "uuid": "b4d33360-f206-4135-b675-0571848cffbe", "value": "T1FD513266B5098D2B4FFAD343C983A205FD78016B61CE280932ADCD9DFF7E4068359863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432512, "uuid": "5ac26a91-19ff-4061-af15-af86935f7613", "value": "48:DTSlK8kxm1dmPXZNY0vxDD6EZ0BDAdoGjpeoS96fwIArfWmsmBO8S64n3Y:DTSBkxm7mPJpX0B0dFpfUpPB/L4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432512, "uuid": "d0feb4c0-7765-435f-b89f-955be285870c", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432512, "uuid": "9c541bee-dd48-4623-ad2a-b78e874ddbba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432512, "uuid": "b565e631-7c71-4559-85ac-3bf33ff231f0", "value": "fm_20260413_063425_fixenroll.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaddb72c-3a23-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776406136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406136, "uuid": "972bf18d-0024-484b-8318-a8346ba210d7", "comment": "Malware payload (LummaStealer)", "value": "6c361aa23e21c753e5ac65cd5ab516ea", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406136, "uuid": "f935b4c2-6b83-4dde-99ec-66b91cb3e9fb", "comment": "Malware payload (LummaStealer)", "value": "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406136, "uuid": "31916468-ca76-4765-9f43-dc307363ab17", "comment": "Malware payload (LummaStealer)", "value": "c9782347cdf6ab0754dd90b4b82e5d0388e64b60", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406136, "uuid": "1403e0b2-a976-437a-a14b-418d640d7679", "comment": "Malware payload (LummaStealer)", "value": "9731aafcca5795c74fe364ee11ec7a36b29ebed81b32a3c681619a2bfb387e7d564d0678f85bfa128d37dfd586cfcb9b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406136, "uuid": "ba26cb36-5822-4789-9c92-267b1c623d01", "value": "T115955C00FDA654F2E50E063295AB72FF2735AC054F76FA97EA653A7DB9732D00822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406136, "uuid": "d7ed5cb7-0c4b-4fef-a0e9-0da6eb486e47", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406136, "uuid": "999a6235-c3e3-4367-b4f1-26904fa0c0be", "value": "24576:W4AtLwSo+x1zrWQ/L63/t7u36hE1FfgUDdz+u9EcO4injXmB7Dh4mv12MxuyrHaB:WxWrI6adlv1huIaZHWGv1bQWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776406136, "uuid": "0490cf42-76aa-48b4-a240-2d26fb429db8", "value": 1958400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776406136, "uuid": "96b5c146-b30a-4dc0-8b12-534658bfafa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406136, "uuid": "7efb7441-4e66-4f24-ab2d-ce8c9f95cf93", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a943a032-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776435661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435661, "uuid": "7497d5a9-08da-4ef6-bfa9-96d0a97631ef", "comment": "Malware payload (ConnectWise)", "value": "9a7f677603f9d68ff93b6b349bb84d1c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435661, "uuid": "35a0fb82-cb9f-439a-9844-35827e3aea43", "comment": "Malware payload (ConnectWise)", "value": "4b7ef386f538cae38e7455bf083ad1059abd3568328f39c87a0e7320a15bbfe8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435661, "uuid": "ea8aa180-35ad-4982-a35b-f472e6c73971", "comment": "Malware payload (ConnectWise)", "value": "908daf6a32211b1a2640a07b1126889221fee582", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435661, "uuid": "e19adae6-dc3f-4300-a3fa-069c962d929c", "comment": "Malware payload (ConnectWise)", "value": "4de20a61a8198b7c661420a318697b334d9a03d893e4f0111a3f771e07761d0ae8ee4b5c97fa2db3c0f20c212de91189", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435661, "uuid": "8123b454-b0b0-44e3-8541-29e116da4a1b", "value": "T1EB21BD8F9207A1249DB1526657C72C3CEA416E328EA070745FD98588DC11378B3A9097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435661, "uuid": "d3061abb-8158-48c4-9baa-98884f9d0d52", "value": "24:1zLCzPK2hNHhjINelGZ6BI56w1AZUMaFSDc:1z2XNHhjIclA6BIbAZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435661, "uuid": "639f2a31-00e5-415b-a1ba-da60b4870933", "value": 1277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435661, "uuid": "36d78340-d87a-4591-8e9e-b6a23ed7dbe0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435661, "uuid": "a545e8da-2409-4005-8294-ff02880b32ff", "value": "installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73d54b4-3a51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776425913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425913, "uuid": "4f9aad52-79ff-4287-b6c7-ed7927e3fe05", "comment": "Malware payload", "value": "cc8e1a07a494db166097a99580b132b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425913, "uuid": "161d8aca-4d27-4330-865f-f955729b882f", "comment": "Malware payload", "value": "4ba01f317dd469c6ce5fb5333828ea5faf6761c263431ebcd0a5c17c06b00868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425913, "uuid": "108ab2d1-3925-4a15-8fa3-3b7965606349", "comment": "Malware payload", "value": "f110671a8200c3f747898323dade5a54051cfa95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425913, "uuid": "a802f726-8ed5-4ebf-85bf-1f8ff50d88fe", "comment": "Malware payload", "value": "35cc23e12b5d9f8a6c2f6a125c8675042619be05d06987753caa6ce5d8470ff5b705ef306c1b274ba07d106fef5abb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425913, "uuid": "877d03e0-7097-49c4-bcb9-b85e18c6e735", "value": "T19AE4E083F7956BADD57FE63AC916132FFA3234824704835B13A59A172F272341B2E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425913, "uuid": "6901a2c1-d101-4fec-b1fc-bf29b1c74e0b", "value": "2ff469e8a85333f8e6ac6f93c3cf6824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425913, "uuid": "31318a56-9eb1-4f43-bdc2-fe113155da57", "value": "12288:cUlbfpuaD8LYYMDAkM1wDpzMj5M8FLZZs4O9xfVjnbUO6nx:cubpuSSMk1U4zlZwfVjnbUOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776425913, "uuid": "c1d6a511-e597-43b2-9871-ad4e571aec36", "value": 691944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776425913, "uuid": "2ba1445c-edfe-4f8e-a536-42b12631be58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425913, "uuid": "ee386160-13e9-484e-9194-ec5e7646d06c", "value": "image202604176896.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20883108-3a18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776401072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401072, "uuid": "bd412565-0e3c-4dd8-a6a2-c3a1d6864d5f", "comment": "Malware payload", "value": "cc0c4b5e397d84c47cb9e87f636ea7b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401072, "uuid": "3ef70578-b4bd-4177-b35d-b16f881e331a", "comment": "Malware payload", "value": "4c997f31a7967050362f49dbeab864ce8d2c5e17e94d72008a81d1bc316813c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401072, "uuid": "1e2831ef-500f-45cf-8eed-970ef954e569", "comment": "Malware payload", "value": "3374048cf9d7eb3dc21deb954f6fab0c2028fb45", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401072, "uuid": "04a66f49-bdb3-4bda-9869-d3bddb2288b8", "comment": "Malware payload", "value": "e6d0371ab1c4063b6aa78f367129ce2cfec921559fa424c37386c7f6e3d050d46a8293992625206d51a262fe1ab8aef5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401072, "uuid": "b77d9c7c-23f1-423d-a4b5-e87fbb6e4095", "value": "T18F3191CF22E20EB0ECA0B93772A94844B9D5E1C750CA6F097DDD38E6468CE187401BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401072, "uuid": "f6e909dd-2c7b-4b63-ab62-740e71a4a5bb", "value": "12:Gn0FS8ki0FSQ0FS2c43Iu0FSsAeQgv0FSQ0FS5W0FSzCFv0FS0v0FSzKv0FSofRy:1t6wTc4EfAJgM8GU8Y95fyZanReDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401072, "uuid": "072fb1f7-cde8-48a1-86c0-c8c568b316ee", "value": 1616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401072, "uuid": "ac54c0d9-0424-4c96-85a5-884495aa348e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401072, "uuid": "f0f338d9-042d-42a6-a7b1-0ccd19d807e3", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda8e093-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435776, "uuid": "0942324b-e199-4aca-a6f9-04e400653130", "comment": "Malware payload", "value": "6d9f9c0b40a30cbefde711411991c2ea", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435776, "uuid": "d2ae1ee3-8a34-46a6-836e-2d54e94b3e95", "comment": "Malware payload", "value": "4d7285b56320f40a816049cff4aa2f585f61ccad985f8a4a2dc41ac00f4c44f4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435776, "uuid": "84325d0d-572e-41a0-9146-6d45a9a56768", "comment": "Malware payload", "value": "2191035f266120591bf33a4d845b874f43486d72", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435776, "uuid": "ab5d1f87-e99a-4866-8e03-53e41f565abd", "comment": "Malware payload", "value": "2d568ed73fa2d51a93410ca7c5d7ac36faf39ae7fe55545d638f53f2e8d9d91581adc3d75936078f16d140395770a63b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435776, "uuid": "16a33d58-6dda-4ee1-8c7e-c818a7a77c06", "value": "T19A22BAF58669392F562449D13F8D901CA802F0E2956C2E11FC6DB319B3AB6B104BB38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435776, "uuid": "d8ccb0e2-25b6-4e88-a21e-910d28158a36", "value": "192:jTstQiXw8/p2X6PFgUtaVtOh9k5QkPYC8K:vst08/p2X6PFs8i5Dp8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435776, "uuid": "9ad45a50-8cc8-4b6b-b176-c3b97225c011", "value": 10514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435776, "uuid": "5afdb21d-f5d8-40a6-8c35-66224869e50a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435776, "uuid": "ac922e6c-2eb1-4f3a-b6dd-497ec9d9f3c1", "value": "a92455c8-7e4e-4846-8cb4-4128ddb0a9a.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea4cacf-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776423644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423644, "uuid": "a0ba5e3f-81a8-4994-ac5d-5ae19f587471", "comment": "Malware payload (Mirai)", "value": "098d467530a70c2ed675ac2424908c3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423644, "uuid": "f737afa1-5e0c-44d4-8cf9-043536356b78", "comment": "Malware payload (Mirai)", "value": "4edeae03f3af043be3114545846c2731a2b1e5e71f7780ad8046ca6877647727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423644, "uuid": "9868ad64-b93b-4bcc-80c5-7c5c9153c37d", "comment": "Malware payload (Mirai)", "value": "0959197e3ee933810893a81cd92d3f1802bcde8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423644, "uuid": "96ab6446-0321-4817-b65c-fb0b43dee2f9", "comment": "Malware payload (Mirai)", "value": "ecee89a22624247e71416a8027ba8671fff633ef5e7e7403bc4d5307ce32689629fed2fb15e55bfd2eea548c3a16ec7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423644, "uuid": "3091941d-ccfa-4184-b55c-adbd44a0a30e", "value": "T1387302D1C761F2A4D9E0243ECFEA11BC6C834EB95FA1743721AE46F8469B12B3256312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423644, "uuid": "205705b1-3dc8-4ec1-a0cd-bb9d98b4c0ed", "value": "1536:ZvQ6HF0rhUGcl0rpgp/qMhPhGUA/YL7k/G30/bI1I34FLj:Z4iqrhUZuCBq4VA/KYO3AbDQLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423644, "uuid": "aa8e361e-d4ee-449f-98e3-2d7973b4a13a", "value": 77828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423644, "uuid": "bbc251ed-2916-4fb5-8829-52e62b17df59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423644, "uuid": "c0ededb9-4622-4467-8dbe-c6736d193d72", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f74121-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435303, "uuid": "aa77d1cf-0e39-4fc1-9d45-ed25bf1377db", "comment": "Malware payload", "value": "2c6283c54616607cfd8f3ea6e496c1b7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435303, "uuid": "63f30173-68c1-4a8a-8608-d993d9c52fcd", "comment": "Malware payload", "value": "4fbbc6cbd8c1dfd723199bf660e5caf894a698c843deb372c00635ffc39204b7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435303, "uuid": "2b0a59ea-e717-4b60-af04-86bfe0b6bd25", "comment": "Malware payload", "value": "2e2e1f0da3d5639e80c270e86b5885756a07d000", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435303, "uuid": "fade78c2-b3d5-4c38-9069-69451dee2297", "comment": "Malware payload", "value": "483d72d108560617fe05685c6b81f38b008d07d48c0291c2634b801880d221875ded01c169d47bec8f27536204e206f4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435303, "uuid": "6e65c13e-ee91-44b9-9074-979498ffa98b", "value": "T1E8C5954CFB7E59F551A2D811787BCF0684BBB2F7754A69630A703F8E21C7D21A681838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435303, "uuid": "9e8b837a-fa80-4458-af0f-fa45c22260e8", "value": "192:Ugqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqgqv:UVMAJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435303, "uuid": "2a478868-5f33-4b9c-b20e-7338306a6642", "value": 2658122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435303, "uuid": "a1340c6e-bda2-4404-a1a5-96fd77f8b5fd", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435303, "uuid": "96a8da11-3688-46a5-9b49-d601a1c4a662", "value": "Purchase Order-#BESBPO250365..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06835e64-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432382, "uuid": "a6ef68d6-b7be-445c-a1b5-11039e375cc2", "comment": "Malware payload", "value": "72a4e2d677e2abf78dc06d5b1b1791f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432382, "uuid": "477b7398-e3fc-48ef-939e-180666765431", "comment": "Malware payload", "value": "4fc185571ccc1867ebeca3c8a23171b7e27c5b428a141ab3820e70ac4c70a6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432382, "uuid": "63f61625-c5dd-4ab0-bdb3-9e81d244f69e", "comment": "Malware payload", "value": "4566b69799581c100c2c109f0dfd8ed5fe466ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432382, "uuid": "e9fbfcfe-3c4a-4106-a2bc-e5dd2af8660d", "comment": "Malware payload", "value": "1b7c4747e1ca623ce3f889ac6e04cd391671a7b8d7936a785cb86418056f0c103af17ab3ec426c5f86b81d7e08be8dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432382, "uuid": "85baae31-5c99-44c7-b57d-7091c07632c0", "value": "T1E3C4BEC5DBE903A5F1B35E3488B20500EA377C815B75D68F1388457B5F67B829E3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432382, "uuid": "f59477d8-b6ce-4033-8c92-8bda320185b9", "value": "a90dd0da2b8eddb963b8ea61476b1e94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432382, "uuid": "9892ae0e-e22e-4878-8f23-cac117686827", "value": "6144:EiSmpQMU03Jc309KuokdunG37gDq58QZnPNysGbRpeCCLYlsU2bIqMvpCE4mODiW:Zbz1cekG37TKSPNyZaLYhNzAiREOzb4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432382, "uuid": "8d9dee42-7949-471c-8c25-fd59f7e16067", "value": 560848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432382, "uuid": "6161617f-c8d7-4231-9be5-653ae7a80b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432382, "uuid": "9075b52e-8e0e-4b5f-a93b-02caba03c742", "value": "shjef2aVFDe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830d80fe-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456213, "uuid": "03c9f064-b598-4760-ad81-dbf342adf111", "comment": "Malware payload", "value": "de7ae6efb73347f3fca11fc66bae47ab", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456213, "uuid": "f3ef6af0-b4e4-40c0-b147-35a0eae74a77", "comment": "Malware payload", "value": "50183f261f0685c68b3a11c710b3505afa7a93a360437aeea0412adf73055eba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456213, "uuid": "71df1adf-0cc4-4b3e-a10b-081499c511aa", "comment": "Malware payload", "value": "7e24f1fa3226318656b605c7669eddb802c3ed37", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456213, "uuid": "36b7ef87-129b-444b-b45d-e18c7a15da3d", "comment": "Malware payload", "value": "861b66bc420c7c42a62cc3828cdea34ca243aca6469d55256e318bda6b782b2baa8a6ee37b60fa21e4bf6abcb059ba8d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456213, "uuid": "a75250e1-2045-47a9-8d07-ffdee2f41e71", "value": "T1D7A533FCFB95C8A9DC7D32FE7A36C0C383440F44A7691A0490DBA61E29DE167952EE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456213, "uuid": "0fd53b04-39ab-4d0e-ac07-ebed065cd5d5", "value": "49152:2D5MPzuqU0tv1V2xPfwNR2SxOFQQncWNZ5eopXDKp:45cLbtiyznDQnvNvewzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456213, "uuid": "a2c8e0ed-83ac-4cbf-8295-9924da688330", "value": 2074136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456213, "uuid": "9621fc04-a205-4cbb-83fe-1cc052776418", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456213, "uuid": "f0b69ced-d622-489f-9ce3-79cc024f7601", "value": "\u0424\u043e\u0442\u043e (4\u0448\u0442).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6885ad1d-3aad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776465188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465188, "uuid": "f83d1b57-3d6c-480e-8cdc-e37877c58545", "comment": "Malware payload", "value": "fff155bcc6c34f8042f7d1d36ecbb507", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465188, "uuid": "cfe4a93d-86f7-4406-981b-a97925ccec3d", "comment": "Malware payload", "value": "5176ecacadc4ca22f1f54e01a1cc5fc19631f0ec036ed78e5df32696536c4682", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465188, "uuid": "066459d2-e051-4415-969b-a9d7e744c18d", "comment": "Malware payload", "value": "f5f5c5d7468600f69cab6099629915026608173c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465188, "uuid": "0d0bff53-f5dd-41c7-8b69-69e6fdc81d65", "comment": "Malware payload", "value": "959a083ce86081dc30dd1c2a2f32c6a1b2ac997d59b2767c45ee73c8087394ab4f23dc4a262ef9b2e14172b5f0fc4186", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465188, "uuid": "8b91df91-446c-4044-b125-22a8a3ec8ebf", "value": "T19BD57F91274A8022ED5F02F0DD1DC77A69756FA02F62C4F762D4BFBB29B07827121B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465188, "uuid": "c341150c-7a00-4b9b-9c0c-07918e3080aa", "value": "49152:BjYqYaZrf5jSTUial1JrMf+7UVZDEFeg4vLNgmUESIEjPMN2lv+oBsYIMV3eVouh:ljSTBiq+54veHjPMNaAYIMV393A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776465188, "uuid": "55b73287-7878-4599-9790-5acaff9f639a", "value": 2956800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776465188, "uuid": "8c173af7-9e68-4e4d-aa7c-aaede334ab8f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465188, "uuid": "32d8a362-e032-49d7-bb24-9f216fa12607", "value": "sharedassets0.assets.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5d09d8-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392396, "uuid": "69650bd8-7ddf-42fd-ae56-a368ca008ec5", "comment": "Malware payload (Mirai)", "value": "f833343c574aa6c98c42f8e29ad1eb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392396, "uuid": "ec99798c-02d8-48ca-acd4-023c513b4c43", "comment": "Malware payload (Mirai)", "value": "517f652fcc5ebedc51ea608c66ad363556a0b520fd0adc028821c1b223a71996", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392396, "uuid": "4e652aab-2055-4130-8ce8-d6ee2d133bcb", "comment": "Malware payload (Mirai)", "value": "0176feb3c0c5130922d9a1061938a0e303b6630e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392396, "uuid": "639cebfa-2df0-4bb6-a618-9d2ab3be3060", "comment": "Malware payload (Mirai)", "value": "ac5ec3a5c832d86def1b400ef8c5fa4aae4e58c4bb334e6978266ed97ce1bea1448f83469c033d4203af7a22a84c7e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392396, "uuid": "827e4c36-6f5f-4b98-a36d-fa812bcfa597", "value": "T1F393B81E6E219FADF769873047B78A21A75833C627E1D685E25CD6002F6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392396, "uuid": "8ff651c9-e17c-46c3-9ab7-263970d45fea", "value": "1536:KloXJI3TfgvW5aIq3sULAHwXgmh68eblnF8kmu:KkJIDov0axlLHXgmkT8Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392396, "uuid": "5a492982-46e1-47b0-81d7-2ea9c27e365e", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392396, "uuid": "12155644-5511-4df8-bce5-3acd54ef8d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392396, "uuid": "114c529c-a7a9-4702-ac35-e63e40a2137d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6542180e-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404194, "uuid": "39a902e1-61bb-4286-af42-904f07d8e575", "comment": "Malware payload (PureHVNC)", "value": "67215c07b14f242e6b6264d8d09521cd", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404194, "uuid": "9f550cd5-8d2b-44a7-a0b2-e46d145af41b", "comment": "Malware payload (PureHVNC)", "value": "523891fee9ce253dfcd42c2e627830235ec7161689524463d12af76d44300875", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404194, "uuid": "6845740b-46b3-49d7-9bde-064e7ae553b6", "comment": "Malware payload (PureHVNC)", "value": "8d1a79347d2a69bffd8cb3e6e1eefc8aa11e5f23", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404194, "uuid": "1861668f-0929-476d-9283-ab84e31ea910", "comment": "Malware payload (PureHVNC)", "value": "9777e8a321f1bc132ed400c7a70f5e25076fb3d8b78de5a97d9fe730a88c38c08d25e2a0471e5b7061b4738d64c49079", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404194, "uuid": "d706d3b6-2621-4806-b2f8-23106723847e", "value": "T139845C3EC6A90116B1B6D714FDA50413E5377B53263D8C8822C9124C4BB354EB9AEBBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404194, "uuid": "67cc76ee-da77-4c02-a9cf-45375dba1845", "value": "6144:tb1Sm+BdJVh16LFRQyBeDCdiOWGWVEntnau89q7owQ48YKjDV9t787MA9/ZkKYJd:tsfdEQy4DpOWtcoR9q7owv8YKHFeMy/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404194, "uuid": "7f0bcbb7-5dd1-4018-991c-5a55f6174fbd", "value": 389340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404194, "uuid": "b3ae1e69-fabd-45d4-99b6-81dd05e649ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404194, "uuid": "7439d1a2-2331-4eed-aad6-6ac2f4284baa", "value": "523891fee9ce253dfcd42c2e627830235ec7161689524463d12af76d44300875.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b6958d-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434372, "uuid": "05b62a88-22f5-4657-8bac-39fd4a1471a0", "comment": "Malware payload (Formbook)", "value": "0844c9b7e82e349096dd4c1655099d18", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434372, "uuid": "d4269ee3-e157-478f-9cc7-2177eced1a58", "comment": "Malware payload (Formbook)", "value": "5289ce7c72bb012c557971f407b438261c598b13e29c694995d5501f78bee096", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434372, "uuid": "60858056-f445-4cde-ba0e-e1edf03dcd1e", "comment": "Malware payload (Formbook)", "value": "d5378a347c3f32f7bdbb61329ea85bd1f37fec13", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434372, "uuid": "1ceffff2-650e-41ca-8fff-f0324a19e95b", "comment": "Malware payload (Formbook)", "value": "ce1a112fc067adc1a975fb9d8fb6cd4d1509a865f92140a35dde88e2c28150fdd0a0d8002e1cfb4e5ccfa98e24e378ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434372, "uuid": "f2a323c1-23f9-4ee3-affb-6ddb88d20557", "value": "T1CDA502154AC86FB8DFE8571980FE150DA3E04E8B541AB98AFB33BD1BBFE7504510B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434372, "uuid": "7e211ab5-ff19-4330-8d9e-12c806eae478", "value": "24576:TEvSjxI5r5CSUNZ+Btn2DcdIoGJK4x2DLS2ms5j59ArWn0zuQMPfKPDLmz2hMbKP:YvS+CL6B0Fx2bHeMKPD05z/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434372, "uuid": "9be8f35a-665b-449a-8d12-ccf5e164a790", "value": 2087919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434372, "uuid": "9e2ad896-2bf8-49aa-8dca-43033f2ea4d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434372, "uuid": "3cd64abd-981b-4047-ad1e-96e77c3e25b8", "value": "899096534234568.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be844cc4-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776435267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435267, "uuid": "1517810a-d8fe-4532-8c02-719c54fa3198", "comment": "Malware payload (AsyncRAT)", "value": "2d28ca56fe2f53445fff456758a56f54", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435267, "uuid": "219d1c1e-8391-48d3-a7e7-63d879cefd0c", "comment": "Malware payload (AsyncRAT)", "value": "52db82045a84885d6baf046b451a1c8473e3eb0e4b3e2bda84e2c2af2ac27645", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435267, "uuid": "346c9878-1cf6-4ab3-b07f-bd82f5f151d9", "comment": "Malware payload (AsyncRAT)", "value": "71917e1f6832378688410c03e8b8064a59b8ba11", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435267, "uuid": "82c8ed69-545b-4941-9428-1a69e510321b", "comment": "Malware payload (AsyncRAT)", "value": "af8363073fb6519d7684b5a497d4f05ce075af75271f57c85ff3e58a45b67bc57c9e03d3bf9f60d1ef190283c25536da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435267, "uuid": "772b8501-40a4-4796-a192-8128d6d94857", "value": "T183D5DB482B8E61966F821FD6EDEAF561D13D683124FD45218CD373BC40AABFC0E571A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435267, "uuid": "d1e81b47-3429-4a14-a160-bb99a9ddf5dd", "value": "192:8wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwg:ro/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435267, "uuid": "aaca7ead-9590-4277-93f5-3116d0a65c47", "value": 2768101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435267, "uuid": "6847bdf2-e5d4-47d8-9a96-92d0312ac35e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435267, "uuid": "98b4ab9a-dd8a-4814-86b0-d0308fea76f1", "value": "SHIP PARTICULARS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1632a2e-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776446842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446842, "uuid": "98dac7bf-9728-4524-8d34-36c6818c230b", "comment": "Malware payload (DCRat)", "value": "0d4753a9ecbd19b7c5215a730f8a116f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446842, "uuid": "ab16f5f8-bfe4-48e6-b0f3-40c59ae2350c", "comment": "Malware payload (DCRat)", "value": "53473fb59509bf2f5ee0022bfc20f20e66165c40ac8416a9321618de11de559d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446842, "uuid": "194ee2c5-eb00-4fc7-8434-84711b2c860a", "comment": "Malware payload (DCRat)", "value": "7e515ce4e3a7118a7d7fb3ebc4a1c160f18ea1c4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446842, "uuid": "385b5a7b-ded4-42c1-bb95-6fca7c9a1b88", "comment": "Malware payload (DCRat)", "value": "953cef935409cb868427537d814aa32752a35727ef1fa5b9c93cb8662aad411dfad66c8c45d38a2523336b8d97101706", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446842, "uuid": "f2792be4-41bc-4a4a-b19e-4c6ff69f9231", "value": "T13F4549027E44CA99F0185673C1EF420847B5ED512AA6E71BBDBA737D15213933C2EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446842, "uuid": "701f4fc2-44e3-493e-9851-7b8dd34185e9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446842, "uuid": "376eaaee-7cac-48a4-9abb-ff674dfa376e", "value": "24576:U2G/nvxW3Ww0tKsg1yp2f+gKyzpKy6FRB2sh:UbA30216R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446842, "uuid": "1409b1f8-a488-4106-a318-988a0dc2643a", "value": 1164942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446842, "uuid": "994f5fe1-4b81-459b-ad78-5a4c3884a675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446842, "uuid": "f47cfa2e-703f-49d4-8d72-16b5ea00ece3", "value": "qwe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d71bdb2-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434568, "uuid": "d8a87e67-5ef0-431f-a77e-ee0e135cb062", "comment": "Malware payload (AgentTesla)", "value": "b1a85630100fd7585904fd68938b87dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434568, "uuid": "427c88f3-d8e1-4f68-9a99-4abee38d77b5", "comment": "Malware payload (AgentTesla)", "value": "535ebd25b817bf90c470958e53a2d31780000219c0280a48612c116790da8f94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434568, "uuid": "4de8c18a-c3f5-4c2d-ba3e-41a5346e4464", "comment": "Malware payload (AgentTesla)", "value": "f6932f3f247a28a6109052e1bf8165f627eb5082", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434568, "uuid": "df5069d3-e979-4d73-a281-36967bf8303c", "comment": "Malware payload (AgentTesla)", "value": "fc1e610aad978e0042c24692bfe83a488aa168f351f74643d214efc7d906d419744761d6665681d013cc5ec910b277bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434568, "uuid": "97a29674-3704-460e-8280-9d0ab5d84380", "value": "T14D65014559C82FF5CBAC1B2D40FE120A93B04D8E5059B98AFB27BD4AFFF7A44411B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434568, "uuid": "3f2eae17-c997-4348-921d-02f441924360", "value": "24576:ieJpU0TpA0VCwlqiqC8yvzq62Iec7nwLyKavx:iePuwIXhIjwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434568, "uuid": "670586e7-ed2b-46f0-9b88-2a2f17b93e86", "value": 1459201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434568, "uuid": "b2c3fc6c-ba33-401c-988f-6e22d3e3b645", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434568, "uuid": "07ce98f0-d323-4adb-9d73-7a660a9aaaa7", "value": "CHECKLIST EXPEDIENTE SANTANDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95263e2-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458505, "uuid": "22a9e27f-cb63-40ab-bed2-8248ce801b1a", "comment": "Malware payload (Mirai)", "value": "007d0f55a2c3ea32659b96f2ac16bca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458505, "uuid": "4c8b806e-3b8f-4e7c-9da9-d3824a59e679", "comment": "Malware payload (Mirai)", "value": "53bd7f7ea723b6a2854461c97e5703b2b970d843fc63d7c4bbdce67924b7354a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458505, "uuid": "ed1db4f1-0aa8-45b8-a218-3354b2d1b875", "comment": "Malware payload (Mirai)", "value": "42f52b53e2375ca88940ce48eaf77338dabc4206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458505, "uuid": "a47fe5fe-519d-4e13-8804-9ed5f22db01f", "comment": "Malware payload (Mirai)", "value": "fc10780d2d7f7d924cead0b74bb5b807c05af5f48b5f73166057190baee1963081a2fed568b854766187060e41417e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458505, "uuid": "5d83938f-be6e-4c04-933a-9da6d686eabf", "value": "T16BA34A4277094F83D19769F02ABB2BE04799FE6224F0E5847999FE8643308F36542FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458505, "uuid": "30988966-2ba0-4f11-9678-d6e5838c09bb", "value": "1536:Bn8i8o3hCWFkFzBbZ6ADr9dhuKm3b/gJLqZOUrd9Y47KJWsIkxG:B8i8o3MWFs96AJLBUrD7Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458505, "uuid": "27a18383-06c5-44d2-a676-215462ef1b20", "value": 107028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458505, "uuid": "c67f794e-d0e5-4c81-99a0-2e060dc172b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458505, "uuid": "71bcdb46-c4ff-4bb3-bcdb-ef805f3920e8", "value": "zyre.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7c892e-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776458489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458489, "uuid": "e0468433-a426-420e-99b5-244acafa27cf", "comment": "Malware payload", "value": "d754a7994ced72cb7fcfb6c21d911a4c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458489, "uuid": "b1998bb0-4e1e-453b-91cc-fc0ebaf39818", "comment": "Malware payload", "value": "53c14b83206d1c83ae672d10314ede3aaf74386d065364aed714bf0d729171e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458489, "uuid": "597c19cf-1f52-4540-ac81-4ac82436d65a", "comment": "Malware payload", "value": "91ac8bb18237b5afc9db4471cb0e58b68663871c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458489, "uuid": "161ef40f-bead-4e13-af0a-18b389ba6a28", "comment": "Malware payload", "value": "55c273c053af4da0751c89dc7d827bc481f92bfe068f0bc9ab4b17b7950bf5ae5eb61cbe7dd93d1ae8c90318b3cc564b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458489, "uuid": "8541f9a9-12c6-4616-af38-f54e2720b633", "value": "T1627192852391CB3AAEFAD953717493443190A28654EF6FACEEFC3890D4DCE48B4447A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458489, "uuid": "a13de818-3a91-46f5-b760-9ddebb4c9232", "value": "48:JwyY8CVl+V6TGgscv6p3iXFiFvCF8Fq2FVsUgFV3j3lVklchGl8X0QMw46YD:urqawvQmqUVXaV3DlVk+0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458489, "uuid": "a55d83e2-5654-47fd-8e24-c8c149cd26f8", "value": 3734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458489, "uuid": "c5952642-aa15-4a5d-830d-9a8c26184822", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458489, "uuid": "a38b1941-508a-45bf-a70d-def31d32af60", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03327001-3a04-11f1-a769-42010a9c0008", "comment": "Malware payload (QatarRAT)", "timestamp": 1776392433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392433, "uuid": "5ee851f0-4e42-468c-b82b-d7fbfe32c714", "comment": "Malware payload (QatarRAT)", "value": "3a7a5867461d707017473cd7f621c13d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392433, "uuid": "dbde8b98-22a5-4c05-9153-0ad6ac13a3e7", "comment": "Malware payload (QatarRAT)", "value": "53f5e88e696bf672ea91740516f73e5c2cfaf4823fcd7abf76d329753b988137", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392433, "uuid": "048b5cf0-2855-497c-936e-a43120e24fe6", "comment": "Malware payload (QatarRAT)", "value": "ba3c525dfd59a7da1049b42891487aec6969aa6b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392433, "uuid": "945e9609-5f5d-4e50-98f7-a73545832fce", "comment": "Malware payload (QatarRAT)", "value": "7bcb005ec8c284b1d9e1528b868a90487e7cb1ef30d7cc6b05ceb12880f457e5ba6f54ca51c95c238839af732081539c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QatarRAT", "colour": "#F9BD35", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392433, "uuid": "592d67ee-4971-4341-8a65-3b9dabb4bf66", "value": "T1E0172323B28AA33DF46D5A3745B2D2B15D3B6E60A50F4C029BE47C8DDF290701E7E652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392433, "uuid": "fb864df8-1f5b-4020-8643-95582f895968", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392433, "uuid": "103898f6-a461-47af-91f7-38c4621d886a", "value": "196608:2jdTnC27e8BkkAb7N4Y8ozGGQMFg6nUnJXlqoqSRE2:2jdTCWfBOdb8ozGGQHeUn/62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392433, "uuid": "6d6e534a-6cef-4936-9e96-9c72744f1f3b", "value": 19148496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392433, "uuid": "2c08fcfc-a2fa-4c18-86af-d8b581f4ba9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392433, "uuid": "ec2e700c-561c-4015-af13-6006f5279de1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd18bd7-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458509, "uuid": "c45db0e4-44cd-4cc6-8212-0ab5d34d3f40", "comment": "Malware payload (Mirai)", "value": "205d689fb4f9c3572a1a293b44adef8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458509, "uuid": "b836e3f9-576a-4545-952d-96cad6a292fa", "comment": "Malware payload (Mirai)", "value": "540844ff88d0d343becfa5512b556daf289e8d62b7727fcfbec5be02adf69326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458509, "uuid": "c521cb3d-b0a7-45c5-a96d-0e50a655705f", "comment": "Malware payload (Mirai)", "value": "d05fb9113fd39a5b4991b1d1c58193e213027180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458509, "uuid": "a7d61223-cbf4-4c74-8238-bee8b2b8b4e3", "comment": "Malware payload (Mirai)", "value": "4785e84c0c2e92697a1c44cc075b34a44e2dd98573c024579fb3b0d3ab78ef2645df9ed10a6a5fbd45ff714a170aa1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458509, "uuid": "13e7ab60-af33-4983-8d3a-774e3063db49", "value": "T19AA34C0779818DEEC45ED2F40BFB71309932FD2E0A3272DE6B90BE913A19D903959764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458509, "uuid": "6bcd1bea-ac23-48d9-8e46-87f50945387f", "value": "1536:2JKXpU4gzmhUR4n2+lzugSuizBpEQeBk3GS+NmzRuiI3reee:2JOpDH3n2+kgvi3ZqwGFmzEiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458509, "uuid": "bdf252f4-198e-442b-a1e4-db72c46b29df", "value": 103288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458509, "uuid": "f32a3348-38e8-44fd-b706-b6f5e823c5fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458509, "uuid": "0a42c698-f1ee-4e7d-9342-ce33a7e7b57c", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce897b51-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776434435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434435, "uuid": "fbf41dce-802d-4a65-81a6-60a49c6b7ce4", "comment": "Malware payload (PureHVNC)", "value": "71ab57c6faee638c8947d5c809c5bcad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434435, "uuid": "6b8d5acc-bc70-43ab-a574-e61a655e6aeb", "comment": "Malware payload (PureHVNC)", "value": "54a03c4e327e011109213cea90b3b600df2eeee457dae410ec2aff29b76b87b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434435, "uuid": "bda35db6-0067-4633-8625-f2d271a7c530", "comment": "Malware payload (PureHVNC)", "value": "a6b96dfb6adf79a41de2c2ac69b6482dd308bf8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434435, "uuid": "cd94f1f9-57c7-4a34-acf4-6e486ce69f33", "comment": "Malware payload (PureHVNC)", "value": "03c0264285a36af866f90e5daba63c5bc401b49ce42290ae1b8c928f9099d3327ee28b2121cada1a49e7bd2df64ef498", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434435, "uuid": "8d6f7f19-2564-4c3c-87c4-7d6a013947dd", "value": "T188342B3EDAE80016E1B3D624FE660413E5677F66263D8C8C22C5128E4BB350D75AEB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434435, "uuid": "8866e965-2ce9-410e-ae0f-cdec9acf5b93", "value": "6144:tbcqjbSs+armDRaQhVB3k5RXT+zD054LPucGZJSqTE+mHvRMFwR:B1OhVB3kx+zDoSNGgQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434435, "uuid": "75fb2bea-31ed-4f36-90e1-e81aa84e6a95", "value": 249178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434435, "uuid": "6a76f0bb-634a-4906-82f0-dd815e1ac1ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434435, "uuid": "2012ccf3-c188-45e1-abc7-64c1382185f6", "value": "invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3afdd8-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435104, "uuid": "b7ccde4f-d6da-443d-8306-dc05ea15a211", "comment": "Malware payload", "value": "cde58fad0ea5f72e887b9e2d42bcc83a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435104, "uuid": "6749d8e6-1e9b-4a64-ad71-eb8f54b083c4", "comment": "Malware payload", "value": "55ea49552025a98d4f358e1cd174acad147c786a890c4dff8369137ca5f5b29f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435104, "uuid": "c9746be4-d21d-4544-83cd-52e95acf097a", "comment": "Malware payload", "value": "4afe391cb6058145cab3c3e099920c66b5c2f341", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435104, "uuid": "4cb43ed5-61d8-4cda-b147-0d166c337735", "comment": "Malware payload", "value": "53f3f823d79b64378ac69338d3898190f2fe4a1bdf5793f6baf23d9a1b72e2389e719fd9181444356247ddea99cf2f14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435104, "uuid": "cbdfba9e-ab17-4ed9-92cd-b4152e2862bc", "value": "T18AE4126618BB9400820761EA5B3B63F97577C983B90474B8F84FF17CEF8AD2C51A0679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435104, "uuid": "c7228593-c5d6-4f26-a44a-d6f049a9646d", "value": "3072:2L5jYf2CECreWh4Iif2PWhncn6r6NYa2Ztu0KFZ/NY228mhD+ewneElVaQ/:2VjYvBreWaIifQz5eCeZNQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435104, "uuid": "80129bf1-a7ea-41e9-8cf5-8f5e9bc74866", "value": 692955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435104, "uuid": "93174c79-48b3-4dbe-a689-ca4a1b861026", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435104, "uuid": "cea640bb-d4c7-4e6d-9376-238d3c259392", "value": "00886562533_IV.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801b8064-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455778, "uuid": "90a8069f-77b9-495c-b9dc-56017799b407", "comment": "Malware payload (Mirai)", "value": "4603992aaf80a3923fed0bfe604ef82d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455778, "uuid": "b40e95b7-82a1-4fb8-aa1a-4ca261ce14ae", "comment": "Malware payload (Mirai)", "value": "5644e4bcf30233be39e0fdaa4916b9f4023fa9790e47d9b47d6aa335c63e91b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455778, "uuid": "e9fc702b-ac5d-4212-aef3-e13dfc6053b7", "comment": "Malware payload (Mirai)", "value": "1d7f33ac7f6b0de38b244e78ab2074e69a501d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455778, "uuid": "7422f59c-bd38-4764-ae7f-d9f1cbfacf0d", "comment": "Malware payload (Mirai)", "value": "6f5270a7a2afaa01d15aa4eaba4529b02d7c6393b2d09272a748d4e994d80fa6de606bdafc63cb5dd400986243c8d661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455778, "uuid": "bb1c5df1-619b-42ac-92f7-87c1a1f34d19", "value": "T1D6B2B50768A2CA9DD68A3134B752AA18730167E4D3E77F034818E7B8BB4755C0F79DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455778, "uuid": "c4e7f328-a39f-4b9f-ae05-eb581e75ff5f", "value": "768:61Q51xFYgow4A5BJRZhpx5BJRZhpx5BJRZhpx5BJRZhpxmO2eGuW+mOBcq4p/AYj:61YFYgow4A5BJRZhpx5BJRZhpx5BJRZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455778, "uuid": "512e7f4c-a37b-41a5-a974-ae3a3fbccf66", "value": 24580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455778, "uuid": "7e2f70ce-3323-4ee5-9598-7cacd2ffa544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455778, "uuid": "2d75e49c-953b-4f08-b2c7-20c699d5e040", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd2387-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (RodexRMM)", "timestamp": 1776435637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435637, "uuid": "1d5fcaec-9d89-485a-abfd-54a2c1599627", "comment": "Malware payload (RodexRMM)", "value": "01d5833b5ccfbf335324a2e38f936622", "object_relation": "md5", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435637, "uuid": "d71a4381-70a9-4470-b45c-39e5152a399d", "comment": "Malware payload (RodexRMM)", "value": "5784e2c3f3f6146877e650428ed004ea113496753ca73f7cc8354d6265fc881e", "object_relation": "sha256", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435637, "uuid": "5491a3e6-9d33-4b40-90cc-9cb32eedb82b", "comment": "Malware payload (RodexRMM)", "value": "00a9876f04fc25849024de520c45f02b2d904939", "object_relation": "sha1", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435637, "uuid": "2383f92c-9a7b-4e87-9390-5101968af99e", "comment": "Malware payload (RodexRMM)", "value": "e0cb72d572e36c3ae6f9a1499c18500bbadc5b03b6e87cd6283e87d2798aa835481a5193560ea8f1baa37f25c6f0774b", "object_relation": "sha3-384", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435637, "uuid": "ab39d96e-b4fd-49cb-8bc2-116596a86405", "value": "T14FB1B70F6D0BE5B1593ACEA95637BC2CDA919063C85164483A8CC4C78F70E7CCDA15EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435637, "uuid": "aeb3c18c-0926-46e4-9ffd-a94d10b795d1", "value": "96:JmYHiqVpIxAlT8eBEscOcml/2OltnF7xhyzZtJI/C/MhSRfAHitkNxdKswQcANKy:JmYHiqVpIDeBENOHl/2O97xhyJI/C/qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435637, "uuid": "dc4864aa-27d3-48b0-bfc0-77393326d7e7", "value": 5405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435637, "uuid": "f3eaf2d8-0766-43ef-9029-9abbb80600aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435637, "uuid": "2231b2fb-0b7a-4cce-a2c6-d1e05b076373", "value": "LDPPAYROLL-Install-Default.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeb51e5-3a58-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776428872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776428872, "uuid": "cea9d029-0fa8-4c16-9699-fccf46879119", "comment": "Malware payload", "value": "1cdf42f22d45940ae28fecf9bd06d875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776428872, "uuid": "85fa0f67-dd12-4cdc-a73f-535b17f8b2e2", "comment": "Malware payload", "value": "59abb133c88b6fbdffcd508f5d74564df82b01c4704ea5457b1ff4440cdf2771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776428872, "uuid": "1dd38f04-9be6-4458-b32a-ec4f01813adf", "comment": "Malware payload", "value": "7bfd16c47e7ef4af9a03c8c9642a3759e5e5b3d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776428872, "uuid": "c3f2eb32-22c1-4999-b0a5-017b86baa7ff", "comment": "Malware payload", "value": "187dca18f17d7b07cb729a9ddab6ab33ea1b46b6135d7570e35ee648a542d1da3ebe698c58dbd264b6ce898f3a3d5335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776428872, "uuid": "d6796882-a44a-4eeb-bc0b-b204c7d6906e", "value": "T10354091AC951E8FDF04202F01EBAAA3E6E7B9446E37FC797DBD869205595850133F20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776428872, "uuid": "404cbc47-ecb4-4cd7-9a97-7b07ba71961d", "value": "e94ef2affd460354a20230f72d207aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776428872, "uuid": "c4230822-9683-4219-8dc5-2f68b6a8d270", "value": "6144:v7FypiAxMHUjyK3UgiyzCTRGcV4Rj1XLHLrRwhRDke:v7FypzMHY3UNIURGcWRj13rRwhRoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776428872, "uuid": "bc478a7f-98d0-4405-80d9-a0002d9383b7", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776428872, "uuid": "d6457df8-96c9-4123-8564-f4fb068bd95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776428872, "uuid": "78f0b9b4-b827-4991-b100-0b1cd5917b77", "value": "1cdf42f22d45940ae28fecf9bd06d875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c00c06a-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776434162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434162, "uuid": "c9abb9bd-73d4-4cad-8530-2c9729446c76", "comment": "Malware payload (VIPKeylogger)", "value": "8956205faf16723837da8d54fbbc8c0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434162, "uuid": "52b77942-924b-44a0-882e-a29905748357", "comment": "Malware payload (VIPKeylogger)", "value": "59acb975c536aca1cf9b2ee2c3b7cd39c617435e51a91f22d59daa8d1de29add", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434162, "uuid": "fb341a74-0219-4c71-bcf8-1744b4f6049f", "comment": "Malware payload (VIPKeylogger)", "value": "8fbe3704cf23a6467ff26021b6de7d9db906eb0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434162, "uuid": "06510786-7473-4962-b093-c50802869617", "comment": "Malware payload (VIPKeylogger)", "value": "bc6424d96d8a681fe2a25f1b74428428bc2332fce20d74fd10ce194989a1d426fd785d1c88d237d1664300c04f4ea603", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434162, "uuid": "cc4a1d7c-9bb3-4fc6-ace3-c459d15163b8", "value": "T1EE645B70FE6905694C1E6B9EFC414AB3C9AD810A563B54E0FBCD078D22081FCE7BD669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434162, "uuid": "52ffb0f9-6098-427b-927e-e0881b9c4e11", "value": "6144:mE+EsE3E+ErY3vyCEzE+ErgGEbE+E5EAE+Er8fEmUE0EEjE+EriBE+EVE+gEqE9o:gsOa4O0AOVOi2ROl3OOLTmOmSO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434162, "uuid": "49a3074b-7244-4ad6-9ea6-62485ae64de1", "value": 315500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434162, "uuid": "43df09ea-cc8a-4e5d-9506-2fca00308025", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434162, "uuid": "093a6614-dd8b-450e-9c87-072cad273840", "value": "2282307562.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73524272-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776446738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446738, "uuid": "aa3433a5-4b64-48f0-9965-4a979c5a031e", "comment": "Malware payload (NanoCore)", "value": "ad6a689e27bda0f4e7171c7ac8ff9fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446738, "uuid": "c00fdd2f-0a37-42a4-a8a3-76c152ea59a1", "comment": "Malware payload (NanoCore)", "value": "5aae3ba01e2ec70f2b6e2207f94a725299ec63eae5557431da4c47f21298d428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446738, "uuid": "7316ecad-abac-4912-b2d6-96a3efaa6c6a", "comment": "Malware payload (NanoCore)", "value": "f6c33744213f2a6a8138494f4528b5a4f52e1929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446738, "uuid": "cbd063fe-067c-4458-9912-41b334d377f1", "comment": "Malware payload (NanoCore)", "value": "ddf12e3596f35a35adfda575c06dc029911b83c4197a084e7156cb8d8b21bb6a149ba5fdae0a04c5d905a1a485dcda8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446738, "uuid": "76abd98b-f108-4706-a4f6-33529cdd317f", "value": "T13C14CF167BA8492FE29E867D611202138379C2E3D8C3F3EF28D464B78B667E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446738, "uuid": "9f850846-f776-495c-a1b4-debb20de68eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446738, "uuid": "1e56aaa0-e9e6-4ce1-a18e-a49845259312", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0JC/Ma/FfqL4m1FYeRBtm23x:MLV6Bta6dtJmakIM5m/BFCh1FjM23x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446738, "uuid": "9615b45f-786a-4f91-b8ba-a94db4a66594", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446738, "uuid": "b867a6f3-9c61-4e11-b64e-d43634a0d4a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446738, "uuid": "a2983af9-a016-45d5-a6ad-3f39475a1e06", "value": "liaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cb32b6-3a79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776443066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443066, "uuid": "66aa860f-7177-47a7-b95e-272865b5fefe", "comment": "Malware payload", "value": "e78b25d365222ecc5b5135d443da4664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443066, "uuid": "1d99427e-cb23-42b7-aa29-dc6aeb2629ef", "comment": "Malware payload", "value": "5b9c3317998200d7abb0b53da44925894365489f693bfb2cc8b09fd3b224e509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443066, "uuid": "0f3b0969-7949-4f76-80fd-ead1b1db9be9", "comment": "Malware payload", "value": "44346b7475ce4f79cd21199087cb87bb2535a591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443066, "uuid": "da1b618f-d190-4e9d-8749-fb7b3c03eec5", "comment": "Malware payload", "value": "c20a114dac8c602c097ac7fd9f69575955fab215b15bd5df93948971df08f0f8d8b5a567e8096a7c2b19a9566416f4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443066, "uuid": "1bc90b26-a3c0-473d-980f-1ecf3cde7ae2", "value": "T199546F9C766072DFC857D472DEA82D68FB6074BB831B4613902716ADAE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443066, "uuid": "f6457bbb-7e4a-46a3-b521-f578b08d2e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443066, "uuid": "4178afdf-081c-47ba-ae68-3028d22849dd", "value": "6144:/VYli3qSuNgOK9x0Lgl7BRZQ+L8FJ4Rf2VCo1pY3d97waWkQKDuzkP:/ymqHNY9WLg1BRRLqJ4Rf2VCo1pY3d9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776443066, "uuid": "31164a6b-51b9-45eb-93c9-6df84638692e", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776443066, "uuid": "4450a887-4c69-4421-b2b3-e718e1598ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443066, "uuid": "deebc583-3515-4ec4-b728-c678202bf814", "value": "BrightRaider_Arrows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fa7c98-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776452354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452354, "uuid": "a5ccb281-ab3b-4b5f-b69e-d6eb48f3a06f", "comment": "Malware payload (Gafgyt)", "value": "1c5f8523aefc5f1c52d19e5f983ac136", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452354, "uuid": "5ad2cb84-76fe-45ad-a7c7-4da3f57cbf57", "comment": "Malware payload (Gafgyt)", "value": "5bfc0335cda0a2eab63d23af4f4fa2e2484f8f9b8d88a2c937f7a900c45b3597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452354, "uuid": "cb49b233-3c27-46b5-9af9-2e977e057cef", "comment": "Malware payload (Gafgyt)", "value": "3f6bf18f7d4c376323d5e843812d5f2009873783", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452354, "uuid": "8575993f-6c23-4bc1-a468-e79dbb2ad9ab", "comment": "Malware payload (Gafgyt)", "value": "2a26c8dbafcde5248bd0d974bd2519b9294cf29a4cc9f79c427a32b371b57c6dc76271268eea41550baf4e832979fd0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452354, "uuid": "cc64ec2c-9653-4ff4-9b50-b401c36b8eef", "value": "T1ECE30851A8918653C5D15B7ABBAF539833324B28C3DB33066D29AB382FA770D4F3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452354, "uuid": "8e79b44e-f5c3-46e2-900e-ed81aca9815e", "value": "3072:uBtvnSHisuB5WlhMv1gmnOsIEbyPQkOXKwCgDZG:uvfSHfuBMl+v1v7byPpBwCgDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452354, "uuid": "121d812a-2737-4dc3-9588-ad8ad4e5d1d9", "value": 156584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452354, "uuid": "90b8c48b-7214-4d17-a8cc-38907be0fd4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452354, "uuid": "8b62dff0-65d1-4810-a1a1-7d03b135cdf6", "value": "xnxnxnxnxnxnxnxnarmv7lxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa16431-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392418, "uuid": "2c4c8de1-1062-4eac-ac61-14cb53840aaa", "comment": "Malware payload (Mirai)", "value": "69fbdef465e6246de2936a032037fb5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392418, "uuid": "43064a76-4ed4-4634-8557-2715f9b2ef85", "comment": "Malware payload (Mirai)", "value": "5ccbd18639d5884d552943b9bc34805ac5f05305acaafb3ebf29841f251df3e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392418, "uuid": "34cb9761-88bc-4c65-8dec-806daf40504e", "comment": "Malware payload (Mirai)", "value": "f207de3e85ebdfdf826db1caad2c63bddc591ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392418, "uuid": "78a8114f-966a-4a69-a6d6-1e672d6d4dc8", "comment": "Malware payload (Mirai)", "value": "5d8b7d741eab6bc91f27cdae82f7d6821e0b84bec72f08571710e3fdc3e92e4e4eb35998fc1cf0b4a6fb3b7dd9580582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392418, "uuid": "fec6dd3f-8a82-42b5-990a-a33450a2b4f5", "value": "T17C735B22BA751D27C4D4A87A61F30721F2F2478A35AC8A1A7D710D8EBF35A5032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392418, "uuid": "9c8b453f-cb94-4a3e-8e6d-d47a7d37250e", "value": "1536:O8fS5Zm4fVl99BvTwptjQ7jtheSNM50+WTQyE2tAEz:P6TnT3j/ZN80+oBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392418, "uuid": "e131fd35-d16a-4297-9347-390e86abb653", "value": 76480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392418, "uuid": "ef83bbcd-a3eb-4cf5-83e5-ca97bc6fd768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392418, "uuid": "4296f8c8-fade-4319-8147-9c6ff855d3cb", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dae7588-3a0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776396477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396477, "uuid": "14c25984-6a99-466e-94f3-54b9c185e15d", "comment": "Malware payload", "value": "6d8279504564cc530b4af7eba6459ae9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396477, "uuid": "32915070-5a1a-45ba-9c80-6a9deacc1eb5", "comment": "Malware payload", "value": "5d1c2bd59327cabb361cef6de90f0bf2986ce2c7309dde021b7e5ed3aec30b6d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396477, "uuid": "987359ae-61e1-4284-900c-b686b62e284a", "comment": "Malware payload", "value": "6eb81817b006a8ec121d609b99a8b87a40c96c12", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396477, "uuid": "33946fc1-e3a7-48fe-9346-9dfc19f46dfe", "comment": "Malware payload", "value": "bc300f4dc5b4fb8455e15c14eb8a0028d5eba646e926449a773bf695fdb16822bd7331084287a974c719c510ddb2c75b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396477, "uuid": "ce09f6e2-e24f-4286-aeeb-d48d1404c6e6", "value": "T17367124EFB0DFC1BC8F7F0BCDA5A42527A526C98A20187B71A01D528BE536C58F0A7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396477, "uuid": "5709ce6d-0e11-4729-855a-49e4674ff3fa", "value": "393216:8PLgXxYLpV3vkfNbTdkdkR1RhdJhsv8epVBb753ecrsh5ax6mtURz1h6hP:CL4YVobJrRThDwppVZ9ecrk9mfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776396477, "uuid": "2a79fb40-9a14-4d7e-aa50-763c2d4e7b24", "value": 29743563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776396477, "uuid": "eb151ffa-da63-4674-9d17-7b5dbe1a6b56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396477, "uuid": "816e4002-73d3-4cb3-81ea-0cd7172bfb08", "value": "com.furniture.technic.fileclean_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fce0b6-3a26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776407416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407416, "uuid": "d21fb33f-d6cc-4398-962e-276ec37bccb9", "comment": "Malware payload", "value": "2d99415e39bc1d1079f2c7103edb9c10", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407416, "uuid": "0e9c889d-6cb6-415d-9048-252d7aad4426", "comment": "Malware payload", "value": "5d60ae8fcc98cf60e6f96b109a23279cde674b89aa984f645bb17d0987f803ac", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407416, "uuid": "0120a326-1064-4b86-b460-440f80f29252", "comment": "Malware payload", "value": "8f910fef05cb7cccd2f2424c6fde73026b9b8a95", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407416, "uuid": "3e540ad2-cf5c-4bcb-953d-c767cd025e55", "comment": "Malware payload", "value": "10a8e73fd2636c326200574e65204936f7315d3af85d03505dbb12a70361f677ffaac77e658071af8293a22a381f09d0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407416, "uuid": "a23b16c8-c14e-42eb-a87f-79fd62715de5", "value": "T16A361765CD7090127D4C95640EBBDDB5EA23A9BA3FDDBBA00FF24CB21715689990303B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407416, "uuid": "f578aac8-fc6d-4cf0-b721-058b912c2b61", "value": "1536:+ffffffffffffffffffffffffffffffffffffffffffffffffffffffff2fffffP:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776407416, "uuid": "46bb0dcd-1ca9-4e9d-b047-7bb1212ae5cd", "value": 4963688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776407416, "uuid": "702b6fb5-7640-4c75-91db-9f735f1135f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407416, "uuid": "5c7b41e8-d1ae-4b7c-a81f-bc5284f21c4b", "value": "rOrderRFQ-7645GmbH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27ad762-3a4d-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1776424161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424161, "uuid": "94b3c5f9-de85-4df2-aefa-f2287e077d5b", "comment": "Malware payload (HijackLoader)", "value": "9f8615e20ed23a82756aa1392fba6a99", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424161, "uuid": "cbc80598-ef3c-46f4-81aa-b2dd6ac11bc7", "comment": "Malware payload (HijackLoader)", "value": "5e10964cd53299192349ed0c0cf6f3510363380731581543aa70c80baff92c25", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424161, "uuid": "049a0429-679a-4070-acdf-412144521518", "comment": "Malware payload (HijackLoader)", "value": "9a5c94e29bba722b1497990d3241f2d01f9b0bb3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424161, "uuid": "45713f59-771f-4fad-bf64-58ee5227e7e3", "comment": "Malware payload (HijackLoader)", "value": "52c88ebca361b093d5c22351a76779ac5b2e84d6f9c595868b30ad6c693787be998476145338a75f66aac8523d39248f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424161, "uuid": "30d21119-a381-42ee-b9b4-c19a091adc22", "value": "T1E526330233C70438E8B5DD34F97188178E57B9B815E6206B6DF9F60C5AB62C90EB6B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424161, "uuid": "c3c52e7b-fe06-4061-a464-d619d12cb945", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424161, "uuid": "8686dc10-c668-424b-9998-fdc1ff8ba553", "value": "98304:oNj4hnu4tJ2PYUSHSXYoqxIxsQLTGTFaa6EmFY4d:aj4M4J2PYUsSX/qxJiGga6zLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424161, "uuid": "dfed7424-699b-479e-8696-a0146fc529d5", "value": 4456235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424161, "uuid": "af9e2adc-6c5b-448a-8465-e3525e37ac6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424161, "uuid": "3dc9c4fe-d3d2-4e53-a228-0a46917c4b07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6775518-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776434475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434475, "uuid": "6491d913-1a2c-4c18-a8ca-28bf4b47e484", "comment": "Malware payload (PhantomStealer)", "value": "0fe24d82bda8da8afc0fa95086e742b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434475, "uuid": "773fac40-4c4c-4796-9ac0-d39d6c580e93", "comment": "Malware payload (PhantomStealer)", "value": "5fdf11489906a7d2bb13097050676b82136447e10d7f2d2d29a3bbffc6ff8d88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434475, "uuid": "15f0444e-af1c-4080-a268-7d2b25880ea5", "comment": "Malware payload (PhantomStealer)", "value": "67f9058044d1751dfa851f236e84a472600102e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434475, "uuid": "716a11c6-b6af-467a-9a1f-dfda6d3cd02d", "comment": "Malware payload (PhantomStealer)", "value": "946d48bb33792359699fa0d3d8082405a7f811565d98f8843b4ff795781cf0fc8a2475eb0b3028e183e38059498eabc3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434475, "uuid": "79a22b74-42c1-48db-96d2-327273d947fe", "value": "T13126021589C43FB9CFEC561D90FE160EA3E04A8A505A798AEB73BD46BFF7A0401071D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434475, "uuid": "2c52be75-25d2-4271-bf39-abf238a06ce9", "value": "49152:teXuykG5LN1It2BT6i64QKwmD+hcvHqXRWvHTBitU1hHjeS4NP/:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434475, "uuid": "4fd94911-9f84-42e0-9fa8-fa34867ec0ea", "value": 4787052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434475, "uuid": "cb8e1c4e-f373-49f3-bdf6-e4eae797d235", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434475, "uuid": "2e8ff2d1-7376-4415-9115-0c8d2f59298b", "value": "BA66792YMJAT600100651.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9105b8-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440369, "uuid": "88124860-2119-4394-af87-b0cfcf4d6a86", "comment": "Malware payload (Mirai)", "value": "d22de2ee4e454674ec20fd98cd03691e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440369, "uuid": "003fcc02-c898-49f3-9ccf-9e7aed177b9d", "comment": "Malware payload (Mirai)", "value": "5fe31001fd5c9c367fa4d13b1218e7408610396feb5a93fa6e05e595583f37b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440369, "uuid": "1d294422-7ceb-4199-89cb-438c1e54f895", "comment": "Malware payload (Mirai)", "value": "97dc8b2c894b617b4ba61415b72d3c25ebc66595", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440369, "uuid": "d72b506f-a574-458a-a3b9-e803099f2dc1", "comment": "Malware payload (Mirai)", "value": "271513a40b377b8a3c3a588e1831182737fe83885902b7da0e8fbd2b94ccdb1332a089a4f36cc2349e9b78438259c69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440369, "uuid": "59f1f84c-5f2e-46df-ace6-dd3243d735b7", "value": "T1415302F3E1CA252268A04CB8ACB78119D5215FFCC0BD1AA5392D69507F664CF83AF53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440369, "uuid": "ef8b8598-97b7-4718-8a4d-f5b7182ee326", "value": "1536:ANWX2Gc7l37FnwJM3Gt3pS41oIMzHsvTWwIAj3GBf0asHj9:ADGc7bwJM3GtZSPvgIaHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440369, "uuid": "1b7b77e9-e795-4164-8a4c-7683f98560c7", "value": 64408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440369, "uuid": "3b06d86d-df8c-4143-86e9-a533312bb6d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440369, "uuid": "ac53e18d-16ba-45f3-adc3-d1aa8729b640", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40492f6-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776435276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435276, "uuid": "3296aedd-e8f8-48ba-980b-49f8f565d284", "comment": "Malware payload (AgentTesla)", "value": "6695d360b6a9d2b5d42e22a20e70ecdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435276, "uuid": "2df648a1-4a3b-484a-bc2c-9179bc2e03fc", "comment": "Malware payload (AgentTesla)", "value": "5fec327401ff89b2d81c243aeb9401a96cb55017780049ba7a4c32dc154576ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435276, "uuid": "7e3f6c15-4039-4bd6-b756-b35a609bb76b", "comment": "Malware payload (AgentTesla)", "value": "2378bc100b45716c0913796fba4126c924fec0d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435276, "uuid": "5e326fde-280e-49ee-9be6-f881a91927e3", "comment": "Malware payload (AgentTesla)", "value": "533cf7e44fd9048414f643967ca4654eeebb054d3a11d7968b01c1f404a8c9832f7d329f0f789d0e778369b23ac6700a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435276, "uuid": "4d60a059-ddb2-40b4-ad32-179ec24cbadf", "value": "T169E55536273099EB348B5E2B0B36FB6717162C73D1B69D26D0AC32607968F275D80DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435276, "uuid": "00cfeb2d-078f-4918-becb-cde361e19594", "value": "192:9LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL3:JT48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435276, "uuid": "142b7eb1-8f1c-44ef-a41d-09b88efc224f", "value": 3216889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435276, "uuid": "d1b68cf9-f0b9-4d27-bbf3-c65ee0c7fdc1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435276, "uuid": "93002916-743e-4908-918a-30756ef76837", "value": "NEW ORDER 46474.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9628a3-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776434378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434378, "uuid": "73ddeaa9-86cf-4728-ac92-d00378609441", "comment": "Malware payload", "value": "4b6d48bdb273a46965205013dad261c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434378, "uuid": "44bf3e33-0ff0-41ba-8163-d970c2dd88d5", "comment": "Malware payload", "value": "60562f8697def45854d90565f13c502b5ede0c9b140a55a86c5a3a80348fb85f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434378, "uuid": "c95b4be1-21fc-4984-8224-1124dafbcf3e", "comment": "Malware payload", "value": "0f8b50c29ace32d58de320549f71fb79b68e7737", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434378, "uuid": "2735964a-f25d-43f3-82c2-b928287efcf1", "comment": "Malware payload", "value": "87c4c5b1f968209eececb5cde370fb68cad8f6354bb83e2e911c420577a48c45c0affdf84df43056e02477ba33515fbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434378, "uuid": "0cea9f0e-8e20-4761-8bc1-5f9ed05cf61b", "value": "T18EE4FE6628BB9400420761EA573B63F975B7C983BA0435B8F44FF17CEF8AD2C55A0639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434378, "uuid": "5d53fd62-ae52-40d4-b0c1-3b2ed6ae2c5d", "value": "3072:Wt4+LZe+COma0565BIJeSxvYnyaBdYaOSJsEZnUTZyVQOAFI9MLmnUMyHIiJCsm6:Wtlte+COh05E8qnTf7nZUdIvMn25Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434378, "uuid": "c048f5a7-aaaf-4f41-bd09-af82e517a9f7", "value": 689876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434378, "uuid": "6e50b899-1ca6-428a-944f-cd36d8614835", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434378, "uuid": "0af0b65d-9ef6-49ab-a4b6-e789740d605d", "value": "PROGRAMA DE CARGA DE ZAMA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65815881-3a88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776449291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449291, "uuid": "a12f5603-8631-4eb2-ad60-33cf480f5cd9", "comment": "Malware payload (Mirai)", "value": "aa879125d4dbc24282f295277239bee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449291, "uuid": "b578d93a-9ef3-44d8-9642-ea4660da1ca8", "comment": "Malware payload (Mirai)", "value": "60571e1f388461f7f630e289f78a1f77fb74fd4fbd01064c2b8af8b3aa96c4fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449291, "uuid": "08afb1b0-f42a-4fc0-af87-f008dded52eb", "comment": "Malware payload (Mirai)", "value": "b747981f9de77aebc6980800c4705c04895ae142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449291, "uuid": "ac2a6886-50d8-4025-b265-f68d62bac8dd", "comment": "Malware payload (Mirai)", "value": "1e7a5489fce870e8c34dc22615237536de65106bb4abfcd1c7a1c930b106de7be3affdd95d1e38691be279ce0520b9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449291, "uuid": "07adfb4a-7514-4fac-85a4-066843c18230", "value": "T130F2F121206228F8CF9452B156E887C897EC57B5D2F7694503901AD4FF4BE097FECAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449291, "uuid": "f8ec57b5-21b9-43de-abf5-ada7708eeced", "value": "768:4B2/VY+TU/BOsX0nn5NGWhnHvwSP/7kys3UozTM:jYiU/Bw1RHvwSP/AvzTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776449291, "uuid": "f19ed7ab-3b2b-439a-87f7-067f3a59f33c", "value": 35092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776449291, "uuid": "b4765823-2d70-4544-84a4-67573c1b9bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449291, "uuid": "fe14af01-2831-408b-a6eb-4fbc9e20acf9", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee845edc-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458541, "uuid": "4e621fe2-829b-476c-a6b1-7fa36ab45a92", "comment": "Malware payload (Mirai)", "value": "05a55a6d2f19315e44b72abf851f545c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458541, "uuid": "ca753d86-e263-47fe-aedc-6f118f123ae4", "comment": "Malware payload (Mirai)", "value": "6106ce519f7e95a2cadf0ae0770ceda6a18c91873f97d1762ec655a2cd1c5881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458541, "uuid": "d3186d76-3bfa-4ed6-a50d-bca37a7979df", "comment": "Malware payload (Mirai)", "value": "300e76426bbb099fbe10ff711dfae374fa9ca459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458541, "uuid": "dde809f8-d3a4-4afc-b787-000bded589f1", "comment": "Malware payload (Mirai)", "value": "fb4277ee2a4291f2480f4dfd7b434769860efdedf9859a2620cadc2a7c37cde00f4219547a418a6cde65deeb17aed079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458541, "uuid": "7054658a-57b8-4fa0-ac6f-025b0040743a", "value": "T130B31AA3F901DE7BF00BE67680D30C057130FB7549835EA272267DA7EE790D62866E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458541, "uuid": "e638cd96-b253-4676-b491-b0ef81e5d81f", "value": "3072:wRe/qwnsgeYjMPtHhRsdAUjrtyafRnO7EBZ8gqOWZ:ownsGPdyaJnOQBpqOWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458541, "uuid": "1427725f-10ac-4dd4-a81d-4ae942722c9a", "value": 115444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458541, "uuid": "2708d6e1-1d1d-43b4-bbc8-7c6aad78170f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458541, "uuid": "65951e3a-e038-4806-b21a-74675736970c", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e95f48-3aae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776465769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465769, "uuid": "1d4f8404-9a74-4cc3-9442-3e5904d540c7", "comment": "Malware payload (Mirai)", "value": "8361f39a3808bd505f2b929e5a1f6ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465769, "uuid": "49792eff-d3a8-4615-b1c5-1fab42081b6a", "comment": "Malware payload (Mirai)", "value": "610abfe9d01c0f2c9ffd471fb52e15c9f00cfa42fbf496fb5d9e38f2ce8dfcda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465769, "uuid": "fb96b304-0178-4750-8fca-b8b6b8bf8057", "comment": "Malware payload (Mirai)", "value": "5b7fe9974716ee4d7084f7395e961dda47d383d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465769, "uuid": "0beed817-7cf2-4620-93c8-5242130f857a", "comment": "Malware payload (Mirai)", "value": "f055f5446bfe784c0fe183d50be8c98080a0f61e4dbf2fa5b6450e7c06c8cbcab51ca1bd7ca40d06c6a697dd829e5afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465769, "uuid": "c72209ab-1285-4a31-b9fa-eedcc23683d5", "value": "T188E35CC0A703E4F9ED5701756137F73B8B36A03A012EDD93C7789E32AC52691995A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465769, "uuid": "a7437422-8e89-4734-b11b-5ec1fc022f72", "value": "3072:rsgwjjl5JijWFTFkxNnkCprKR7VQVhYibeWUxJCOfre6O3L+Q3Cwlm:rTwzJijWdSNnkCprKxVQVVznOfi6Oakk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776465769, "uuid": "7eaeba7a-8516-4940-b42f-9255da39cf39", "value": 144328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776465769, "uuid": "9025c9a5-8914-4858-b57a-223e3d6140c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465769, "uuid": "4d07441f-610d-4a75-85dc-dd3f9e3d7fe0", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc4b217-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434464, "uuid": "8f26bc7d-00ea-47cd-8452-67f8ed884770", "comment": "Malware payload (AgentTesla)", "value": "0ae0d14a76e33a200ca66224c3b01d0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434464, "uuid": "7963fd36-575f-45a5-9b69-bb7cda9e6f16", "comment": "Malware payload (AgentTesla)", "value": "6184bb1d65ed1915e042a2d4b0cda0bc8b14c216ae79cedce90f3d039c3d919f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434464, "uuid": "c8a872e3-f65e-4f0c-a58c-48d5c0184619", "comment": "Malware payload (AgentTesla)", "value": "b8cc5982823ba7e58a357b3db3868b9e9c361c04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434464, "uuid": "70f0dfa2-8a8c-4517-9bc1-4e0cc54f43c0", "comment": "Malware payload (AgentTesla)", "value": "a06b28a5219959949ccc10c0e5bac87cd829abd8b281108c2281e7c82e22ada415fd330d02c3afd6136ce2bde7f9391d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434464, "uuid": "ad1fe489-3841-4435-ac51-97393d07f186", "value": "T1986502414AC83F6DCFE8562DD0BE150DA3F18D8A5019A989EF73BE4BFFA7A005117198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434464, "uuid": "aa9367f4-81ce-443b-a75c-d5664d7cee6d", "value": "24576:sQnc9bAP5WK4m4m1HKGe5nSD0NHPONolwuA+:ZcJOW/q1Ho5nSApPONoWuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434464, "uuid": "e2210509-f5e2-4c17-b07f-4cbec09f8d73", "value": 1508061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434464, "uuid": "5b06b73c-77d6-4073-b30f-baf80a3f36e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434464, "uuid": "0ff921d6-7100-466e-b004-c3052432a49c", "value": "MoneyCorp transaction_4-17-26.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c46e048-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435425, "uuid": "7f7da90d-239b-4799-868c-b108be3caca6", "comment": "Malware payload (XWorm)", "value": "57bd3d2e62b0eff4b094bf3d05772683", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435425, "uuid": "f8d8d3e7-6f83-4208-b3a6-75c80ec62636", "comment": "Malware payload (XWorm)", "value": "6250f329e5f6311b857a7d6813269fb0f56d5916870dd0095cb7b87452f5592f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435425, "uuid": "1b01918f-4392-47a3-b8a5-44b18da3bbd4", "comment": "Malware payload (XWorm)", "value": "6aaa8e18128c6f411555eb5e29d547ab08471fa3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435425, "uuid": "4c18a06a-65d6-4271-bdfc-899f6a879311", "comment": "Malware payload (XWorm)", "value": "8392f04aed35bab41131cc102cd04e60875ada921a77b154993f2e7e96b00f2f457536e73fb33aa155ec27b93609da26", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435425, "uuid": "2ac406bd-1a84-4d36-a4be-754061c679da", "value": "T16AC5E4CECA97695AC8EDFCC92C4C9569A5570AC9B2353B62E921E572F072E3CD3F4004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435425, "uuid": "af44c54f-6305-40d7-857e-8ca86f4c2945", "value": "384:Bp94ejnRTwXugGPPiFXEvHq2vG2HRfuRccC5F2YL0s1JfhMLwoSpAkCkZyS/pABT:pnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435425, "uuid": "729aba7a-9930-4c5d-b195-df7f9871d89a", "value": 2603719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435425, "uuid": "f823bc59-f2cf-4a57-ae0f-236ac9ce0b13", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435425, "uuid": "7b3b10e1-4560-4860-943c-514429451fb5", "value": "PNugmaHnFZ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54220d38-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404165, "uuid": "898dcf46-539f-4b6e-80c7-4c21977f1f2e", "comment": "Malware payload (PureHVNC)", "value": "2e8a4d5de681c555b4c097ef86c6a686", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404165, "uuid": "ad5a4384-d7d9-472c-bfb0-9f01c82f4f84", "comment": "Malware payload (PureHVNC)", "value": "64441598464674933b82ab8f6a61ec012d7eba24e1efed3c8bda46602e5c88fb", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404165, "uuid": "93f3520a-5364-4e57-ae00-47e985507dea", "comment": "Malware payload (PureHVNC)", "value": "c4cccb58ac5b2e5c11f63a78543e3b615f6af146", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404165, "uuid": "0d7bfc2e-799d-47d1-a085-92cbc458cb59", "comment": "Malware payload (PureHVNC)", "value": "2c199a5b9dffcda49167e9935833176d9bae77d2f7178f74480fa27a47a292e208a0cc89304619209926dc58db25d9f5", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404165, "uuid": "7295b85a-4191-4c1c-bf25-3b94954e8c33", "value": "T131945C7CC86C063FD726D538545A0E48FDE1A407AA2C6E048CC3B78757AD9C778926AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404165, "uuid": "51780d13-1197-403c-94ee-aaddd20bb5c2", "value": "6144:wEk8+A95kfY9yLUkNcTWUmlY6iKgG0soMguv/onhkI4a:nqLUkNcTWNNiKJ0soZkIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404165, "uuid": "1616c0df-dca6-464f-b9b8-5710bb6a0def", "value": 412020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404165, "uuid": "cccdd660-6577-448e-90d1-b17654a2ea30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404165, "uuid": "ff938bb9-22a0-41f5-bff6-dd88427d11d2", "value": "64441598464674933b82ab8f6a61ec012d7eba24e1efed3c8bda46602e5c88fb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0a22df-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404099, "uuid": "109c2693-ce99-45ea-be49-894154d39ff2", "comment": "Malware payload (PureHVNC)", "value": "a2965f487feb81e6e0aaaa78d2ac9ab8", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404099, "uuid": "55789898-8cfe-484f-b337-bcea2cc1d3af", "comment": "Malware payload (PureHVNC)", "value": "64ac510610d6d88dc7783afae4683afca3cddfd9ec0216518d3190d9b926bb50", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404099, "uuid": "a28db5b1-cd44-4b3f-8bd0-3548ea807b81", "comment": "Malware payload (PureHVNC)", "value": "8c82272ea0acba0cd1fda8a764ca5966954ba324", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404099, "uuid": "c667ea95-1619-491d-a6c3-21eaf31d4ce8", "comment": "Malware payload (PureHVNC)", "value": "45401bfcac85853ea521a4201f4ad2bdaa2bf3e2cf02bc671f223c57049de45793f9c8cabf051c801be708c27240cb9c", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404099, "uuid": "9d36e8b9-8a54-4b20-a4b4-1db1436313d8", "value": "T15F542038A9EA001AB1B3EF54AFE47497E96FB773370E985C1081034A4723949EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404099, "uuid": "ee77528c-1fd4-4cb3-8e15-3323e2b161a9", "value": "6144:Xo/cJcPykPsSXLxudkPncBchxLuH1fOtwtAAO+3J3f08gIKOCwB:Y/9akPsSXLxudnBch5u9ZXHJvf/KsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404099, "uuid": "1d72f23d-d819-4817-acd4-dafe87fc4f20", "value": 302674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404099, "uuid": "0faddb6c-d6b4-420a-84b7-e8899fa2dfe9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404099, "uuid": "5e44790e-f2ff-43b6-9431-191c0eb57274", "value": "64ac510610d6d88dc7783afae4683afca3cddfd9ec0216518d3190d9b926bb50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224caaa8-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776435435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435435, "uuid": "61b92bcd-b3db-4fe0-a627-3f836c315ace", "comment": "Malware payload (ConnectWise)", "value": "83be10e4bb42d825a66346b1a350f393", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435435, "uuid": "72ba0a6e-d400-40c5-afc1-0ed28292e598", "comment": "Malware payload (ConnectWise)", "value": "64bb1f14cef2049da5d16ed51e0f309b500b4ffd0be22675ebb6e86d584d1278", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435435, "uuid": "89980237-7093-46d0-8efe-49ed1ac20d5d", "comment": "Malware payload (ConnectWise)", "value": "23ae7b902d84851fb64c5aa5d3b7ad07ef4693f4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435435, "uuid": "00edb9f1-962d-40b1-862d-91a385703f17", "comment": "Malware payload (ConnectWise)", "value": "e675850f05ea0b18d0f72d1b746b6af8c959631cd74476a88eda7f0902de3ff2b5db0630b4b3426fc714bd8083ea298c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435435, "uuid": "ed8a8891-1ff5-44f9-a19b-fe15c847c5fb", "value": "T102D1875F7D03A3248971533BC819900FE5E80B3F8656185879CC49499F72B2DE7E2ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435435, "uuid": "ef4a29c9-8604-46c9-abc4-cd385216b6ac", "value": "96:BIhZD9Ec/apQNOwX0O8/X5DuS4UFAco6vWhGvq/4c/JiDuFh:BIh//LOwXX8/7bFAco6uhiq/4c/ISf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435435, "uuid": "4e6898bd-2ac5-4828-a217-dd89b7108aab", "value": 6256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435435, "uuid": "a2332ccb-fc71-4b7e-9bd8-daf24b7e7797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435435, "uuid": "5edb50db-89d4-4ec9-871f-831a583ae24c", "value": "SSA_eStatement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f70747b-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (SentinelStealer)", "timestamp": 1776435430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435430, "uuid": "e9fd017b-9402-4805-8a36-1ce796ea4bb2", "comment": "Malware payload (SentinelStealer)", "value": "e223241d1ab78d7e326d1bd8ea588eeb", "object_relation": "md5", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435430, "uuid": "481f79ba-4d80-40f9-989d-cc0736910e1b", "comment": "Malware payload (SentinelStealer)", "value": "653b974721366f22fb25ade37e4ad63d1087c7d5b209915f6828ce8b16d9e2db", "object_relation": "sha256", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435430, "uuid": "cad50ef3-0a75-484f-801b-10b0bd54c48a", "comment": "Malware payload (SentinelStealer)", "value": "b6c9df1977bddee6d2881207bb46f9f3749c1367", "object_relation": "sha1", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435430, "uuid": "027be4b4-2eb9-4fe3-9a21-0fbdf8fb73a0", "comment": "Malware payload (SentinelStealer)", "value": "e2a3dd2a784fd234e3577639654d0a612961ef0c5d2e52b76180b90deed0ad1354211aa81d80a36b5a99d4a51b7b4143", "object_relation": "sha3-384", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435430, "uuid": "5f30e6f5-d4fa-443b-9e56-6428e55ecc08", "value": "T1E335233C7583BC5E3BBC9AEFA01636991D74AEE3E24CD4E1888CA48716DC6961C5DC34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435430, "uuid": "b67f43fc-ab55-4064-9d9b-9061561db67c", "value": "24576:YSpkpFiPG5fhBMDtQz2/OwWvv2UIxwWTWWGKz9U+Q:wGSfxe98rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435430, "uuid": "2eb668ff-f311-4dab-8d26-37f98952f06d", "value": 1102823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435430, "uuid": "9b36c6e7-02b5-456b-a62a-fdb79ba1db2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435430, "uuid": "69355bcb-a51c-4dd3-b4fe-ee6e2d96b92d", "value": "Document_74mfwc.doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3daea9-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776446830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446830, "uuid": "e410b7ab-c333-413b-a3a2-e9e986d673a1", "comment": "Malware payload (DCRat)", "value": "33508e39c87bd89ce7320408b5628aba", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446830, "uuid": "655fae3e-e75c-48b7-92e0-238615a8c116", "comment": "Malware payload (DCRat)", "value": "66112715198d24f63a299bd8074989cfefcd45a3c1c985a75e438f66d4ec0165", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446830, "uuid": "00432c24-7e18-4b80-a514-cdf07f8a4575", "comment": "Malware payload (DCRat)", "value": "cd1f746ee649ba9401a083e11836c2bdd5f37a37", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446830, "uuid": "68f3f91e-2009-435d-8b96-ded83f55c7e0", "comment": "Malware payload (DCRat)", "value": "9560c3cb6369b4fbde70855ff76579ec9c7f17db1247764531fe5b0beaa2b378ec355086000fa71122d3f48363798e1a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446830, "uuid": "63f97e83-dfa7-4e5d-b01b-552b932579c6", "value": "T12B655B023A4ADD52C0791A37C9EF443547BCBD413BA6CB2A7A9F335D64123AB4D0D6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446830, "uuid": "2574a35e-97ed-43be-b4f7-a25348705200", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446830, "uuid": "7be6e341-25f3-4f12-9bf1-7ac0e4eda3ba", "value": "24576:82G/nvxW3Wc2l9xq5Tmp2RgPSHBwZebflzSndcsX+4f:8bA312zMm/PKbflzwdcsu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446830, "uuid": "3da9f5ae-353e-4f79-b778-d85b04b68fa5", "value": 1524885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446830, "uuid": "86f85437-a31a-401d-92cd-c89985578867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446830, "uuid": "669ec8fc-fd1a-425a-ba0b-71ad26c938ca", "value": "x66112715198d24f63a299bd8074989cfefcd45a3c1c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6290d66-3a2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776409081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409081, "uuid": "b7215f98-316b-49be-9870-a87504139156", "comment": "Malware payload", "value": "906caefe5508974ce9b587c42dfef373", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409081, "uuid": "f8d91e26-581d-4dbe-9155-f867ec6c84b0", "comment": "Malware payload", "value": "667f6c68a9596ca602452796a64669994c5d86059d2fa4c72d106f90bfaad45a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409081, "uuid": "1e96ad47-e997-4254-85fb-95484ae963dc", "comment": "Malware payload", "value": "066cd36b31dacafeb6bb9f077bfe41d50734a8e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409081, "uuid": "5c3fdc6a-bffb-4f60-9d84-a7e7230771ed", "comment": "Malware payload", "value": "20d9e71589aea37aceb462c553be2987fef366d15e47a5d3d82e1398601bea1c2702b7bd286592b608cdfabedd261a2b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409081, "uuid": "69a94eb0-9811-460e-ac94-9aa914ca4d6c", "value": "T144136C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409081, "uuid": "953c96b9-e58c-43aa-a6ca-beedd33f76f9", "value": "768:bzs9NyXsZztCH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b4HusZhco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409081, "uuid": "4182db06-64fc-49ef-9c72-ce2ac2dbb77a", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409081, "uuid": "502cc8fd-170b-47ae-b450-1c8b042cdd3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409081, "uuid": "24e23db1-dc85-48aa-8a3d-a96ac339fccc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6f8dbc-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456339, "uuid": "8d420da2-8147-4f0a-b508-fe62e82a1d34", "comment": "Malware payload", "value": "237111fd9518beb4868d7e989ee53e70", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456339, "uuid": "22b4bf5c-61ef-484d-8861-4749460348e3", "comment": "Malware payload", "value": "66c19fb88abdda9ae7474ec00b0f48df380cc2e618f53392106aad8d7e445c94", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456339, "uuid": "0ab5a668-ac03-4613-a45d-368b9fe6b940", "comment": "Malware payload", "value": "c42dfd6378dbd057de1e16047d14a3aa829bc9ed", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456339, "uuid": "0749c40f-519a-42e1-9c37-bf83fdffd45e", "comment": "Malware payload", "value": "20999e718eb035c54b2a20f02b919e64ea11d53390b411505b6a51ee8383a6e2d21d38cfbeb3327ee9f8fb6f59c35d42", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456339, "uuid": "01ff54de-a2bc-4821-91ab-7ae9c282fff1", "value": "T12CD3BB8B4EAEC8EC8B1FB42C055F5C47DA4F5117151EC9A07AEEBE943F21D6470AA8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456339, "uuid": "e84bcd55-14da-4865-895e-0a5fbeb62caf", "value": "768:CUjJIjej2vFB40+FsoFlg6BkPM+C8n1Hk0DeD/RRjAcvkemi3JvDriDrPx6HBlAO:FIZ9B0QdFGkf18M5W+CNG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456339, "uuid": "a1b3e3e5-32e6-4db0-9bb2-acf0d58a2493", "value": 132145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456339, "uuid": "0f106b5a-7d63-4403-82f9-40214d18c914", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456339, "uuid": "365d2c1a-74fe-4e0d-bf0c-9650434d126d", "value": "Nova_Project_Holiday_258.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19322fb-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776434360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434360, "uuid": "bdb2315d-b862-46af-92eb-3792e209a06c", "comment": "Malware payload", "value": "6bed8c5830c72d851b276ebdf1923868", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434360, "uuid": "0f06e33f-492a-4228-831a-b74073237b72", "comment": "Malware payload", "value": "66eb748c5bb2f66a90fe1da826c96186a03d0ac3567e6ca9df7e790c275455c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434360, "uuid": "9f878254-bdc3-4692-9ac0-288984dacef8", "comment": "Malware payload", "value": "7747db770022ee4dc2f3b96655349a8bddf32f63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434360, "uuid": "69d01cf2-8099-4be0-869e-366b0216c658", "comment": "Malware payload", "value": "c02def9e48dd84f3c44b4ea587ef4ae0a8e61e8149b219905b0160c310cebd0bf14248b6297445af7e5d47f3cfec9a99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434360, "uuid": "0cdb69b5-823b-49c4-a918-51ca4f0794a5", "value": "T1F713829DB2EFB3544B0A31B32D57B152E16ECCC9B50C8140F5E6ACADF82CA48D479A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434360, "uuid": "c02ae731-9dab-4ebc-b776-0c7cedf44759", "value": "768:fy83iEUCuqlDaZq7J6ARvskkgqZad0AItuQRB1ZckS:fycxUC7DHzREkkLIdJMzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434360, "uuid": "34b420b2-a2cd-4b08-8c14-4fddbc7b43f8", "value": 45219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434360, "uuid": "426da42d-3a4d-4d22-9673-17681ed5fb42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434360, "uuid": "ba269cc0-5124-47df-984f-d793b71d3082", "value": "MODELO 303.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10642bc0-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776435405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435405, "uuid": "8b397e6a-213d-461c-a9a2-097176f8812f", "comment": "Malware payload (AsyncRAT)", "value": "2d12c77e5dd4ede8bcadb82e04124df5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435405, "uuid": "5f33a7b4-fe9a-4370-a7fe-b5201a6bc51b", "comment": "Malware payload (AsyncRAT)", "value": "679ce9eb3e1bdba8ed58fa53690ae879ce50679be97fbc41e85cbb6a88bbeb0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435405, "uuid": "0eab8ac8-6148-42ec-ab22-ed28ab4b0f31", "comment": "Malware payload (AsyncRAT)", "value": "951c56cdc505e779d3bc341019310a31987a7a1e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435405, "uuid": "fb2eb269-5349-487a-addc-71260c4826b1", "comment": "Malware payload (AsyncRAT)", "value": "458cabe08c48176d57c8310d7d9daa338825598456d7eb438ce5294b4be863da9dffe7fe8f5aa8d96b4d193a5545c6e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435405, "uuid": "f2ed37ce-4e94-4a89-8217-67c6d80e9d8c", "value": "T1B2C52A8D2D5B2148462002B0BC992DC5C65BEFD54EA5B3A37B1CEC9A65438C2FF84F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435405, "uuid": "2f78a201-5a7d-4679-9ee9-a9fbce20628d", "value": "192:28Wi5YS9jZSibKNzCu5AfP5O/61S+qFP/EMyu3E4EFPQIOXfnkAFF24b8R7IllrF:28BfK/z+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435405, "uuid": "8a1991b0-9487-4f85-9277-ebc814177937", "value": 2518399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435405, "uuid": "5f4136c9-a685-43ef-a8c7-d5e7a6da5e05", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435405, "uuid": "fe6accbc-efd2-471b-9149-f0672aa4e51c", "value": "Order samples and Drawings.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0471bd79-3a04-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392435, "uuid": "154351bd-5309-4054-a92e-d171a7d98922", "comment": "Malware payload (Mirai)", "value": "17b61fe153c0455980c7250ef72738cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392435, "uuid": "a4921e55-a8f3-4c46-b7ec-597d5e834764", "comment": "Malware payload (Mirai)", "value": "6808ed62a01c196021c0ea09dd3b602b4994502a379887e00fe985ccb994d209", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392435, "uuid": "b17c36c8-c2c5-47a0-b7ac-d649020b8837", "comment": "Malware payload (Mirai)", "value": "4d01486a2a42c897dc3543aedebb66b7ca4d6828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392435, "uuid": "0cd0fb47-47fe-4865-bb6c-b36ffac282f8", "comment": "Malware payload (Mirai)", "value": "66fe3f48445bb259f5078974a4dce9265e714e8d43148f51bf4d50a44917d2c84968b7ab46a919f6a3ea781a0b14892d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392435, "uuid": "5d476896-099e-424c-93d0-9f0449a0065b", "value": "T17B93D606BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392435, "uuid": "ce292f97-74d8-4fa9-9727-f2ac8dd13c22", "value": "1536:DX1N7eUx/tBC/4YAlrCfw0E3QM5k4yZr5rH0Vc6VRs61xCbV:DlN7eUx/f9Z3QYyop51Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392435, "uuid": "b62f24be-24b2-4acb-9ec3-649d6eaf1378", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392435, "uuid": "a6ba2fa0-3da1-47f4-a93d-caf01957e84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392435, "uuid": "a43c34f1-3629-4e4d-9eb5-ec205ef2540b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c330b4-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456080, "uuid": "0a2bbb05-f0d3-4121-833b-b170b5b0bd5a", "comment": "Malware payload", "value": "798131d7f54f4a98532df8aa23b580c0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456080, "uuid": "3c13b30a-072f-4d3d-a586-c8bdf63f2a4d", "comment": "Malware payload", "value": "6875957f69028a7cde72961968df5ccdef896709d0114851313bb9a6a66d7349", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456080, "uuid": "7949c5d6-6106-4e38-9231-c620434d717b", "comment": "Malware payload", "value": "902c23c497fa520a36e4cbfd963494b27692e53d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456080, "uuid": "ef0ccc4a-0d20-41c8-acf4-02095bf54d14", "comment": "Malware payload", "value": "0bd76253de5ff062cd1583e1a0182a95a214304ce0618a1c49942c223d0e994f736ff18a2280df4e428bb202d3b6dac9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456080, "uuid": "a0d9b43b-bd7d-46cb-a544-0de55f8b13ca", "value": "T14222BF3D7A6647B5F323B7B550BB4E7B2F3B51501D42B369DD683C104D23A8222D2C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456080, "uuid": "e5017006-ecaa-42a2-a915-cdf98c3532ec", "value": "192:VLt7+5N/Lg3CG6GCi9j+AbptG3kWLrgTNEVR7:VLtALM/CijgkWLDVR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456080, "uuid": "a6c6480d-7c4a-4633-af36-ea3adf33064f", "value": 10433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456080, "uuid": "08da6608-66b3-4506-8170-e14d79ef0f7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456080, "uuid": "04d075aa-a652-4ec5-aaa5-c792f4ce9597", "value": "hile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7859330c-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452329, "uuid": "1819ed1d-8199-4260-bee4-8b46a7e17546", "comment": "Malware payload (Mirai)", "value": "d9c56a1ebe9d8bda1f7880c5fbc19b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452329, "uuid": "0cbe98ac-684b-4bc7-be93-47d8c8c3bf66", "comment": "Malware payload (Mirai)", "value": "697bd8428fd397b56f81a9825380e66c720bce8da774a43222ef39062a824f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452329, "uuid": "08eba478-ec29-4618-ac4d-0a0bd29697d3", "comment": "Malware payload (Mirai)", "value": "fee64cd363f09f7d698b484cc29218fda046def0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452329, "uuid": "a9b36ff4-d6aa-451b-84c2-0cfb7984e1f1", "comment": "Malware payload (Mirai)", "value": "5b72fee7514a6ab886df32a61a1047000a30773008500a30a8417fbe03fcb9a8518aa0ccece6c400708d315643c71db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452329, "uuid": "ac12bb7f-0c38-4883-9b54-324c54e284c0", "value": "T131E33A07B7118FA1C329967009B3CB67E7A626A616E1D985E76DDD107B2035C2C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452329, "uuid": "50c6db24-e741-4dca-9a16-5db1cd31180b", "value": "3072:zxFjKxuZ/mQ7TlMBCQMvTgnIqB7OsUGlj1wxpMEhCYy5hhzjaTfa/k:FFj/mQ76cTeIqUyjepMfD9St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452329, "uuid": "6120f162-31d0-4870-bd00-b881c9da77fb", "value": 149936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452329, "uuid": "de279649-6a6c-4914-a65b-fd3ba68e7de6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452329, "uuid": "9ece455b-c09c-454b-95af-23fbcf511594", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab05873-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776435234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435234, "uuid": "7f4e1807-d825-4ea4-bb7c-b08126c60e9d", "comment": "Malware payload (RemcosRAT)", "value": "e9ba73003a85031f62a2720ba20e7170", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435234, "uuid": "fec8eba4-65b7-4ce9-b28f-d8165cb8fd30", "comment": "Malware payload (RemcosRAT)", "value": "698e43542e1d562ec451d4a9b7f05e45256492d33bde848e3804df428e14cd2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435234, "uuid": "146c8fd2-007b-4274-a010-0dfb58f99e27", "comment": "Malware payload (RemcosRAT)", "value": "34a0520d8d32ff812309ccb6175ec454de05447c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435234, "uuid": "8467ef78-7b27-4d42-b752-2af13f412b08", "comment": "Malware payload (RemcosRAT)", "value": "fa9ba8132c5c180562890c776784d07a8f473608dee4cab743daa50db1a3b951d25b8924f3c7031425907ae616014de0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435234, "uuid": "85f9fa7f-df4f-478d-a7bd-cd957841ac5e", "value": "T1EF768348E1787525A8EFC71CC07BD971484E646B394CEE5E303F822C2A51F63466A6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435234, "uuid": "af27d812-10b0-4e53-abd1-e17503a57829", "value": "196608:bLTPjNK6LsRjMDyFIT9Hd6v+MbSXZDpVNo3VRWPlU:bLT9sRjMDHJdXMb6ZDp/olz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435234, "uuid": "6eafa3d9-1a0f-4e26-9519-834f393ce843", "value": 7320836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435234, "uuid": "01672b18-393f-4052-a6d9-8811aef385c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435234, "uuid": "66cb13d2-9c58-4f83-b8c6-48f093d5e640", "value": "SKM_C36826041510200.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215e33bd-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404080, "uuid": "7183fda5-8b86-46da-9d07-029e4e97b191", "comment": "Malware payload (PureHVNC)", "value": "4975700ad3298cec299c66c34319ca15", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404080, "uuid": "70b67b0a-e454-40f3-bb11-4b4e33539811", "comment": "Malware payload (PureHVNC)", "value": "69edeac98f1cf614188ce821b21118a1464f88de3dcd55d700bb66d710cde57c", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404080, "uuid": "3e1c0856-bb3e-464b-808f-b56e266351e2", "comment": "Malware payload (PureHVNC)", "value": "b491984a7929106ed6caa2ae781baf7c72cf48df", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404080, "uuid": "3d9cc20d-7e73-480f-a549-78242615b422", "comment": "Malware payload (PureHVNC)", "value": "1c37bafd8859a04b03faf4d0500970265054c1131a8b3d21a0e4065000c203406588129d5ce3fbbe2b8a8dc9a517b627", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404080, "uuid": "beb14cdb-a7e9-4b48-b7fb-587d1947c82f", "value": "T16F843A3439EB5019B2B3AF599FE8B4D6DD6FBB732B07941D1051038A4B23A81DDC2639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404080, "uuid": "08186164-ee48-4d7e-971c-3ca591fe8bf3", "value": "12288:enmtcogz3s+N0JC8uDH5y2l2HXYJON2p+2KoB:5tc9I+sHXV9oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404080, "uuid": "fcfd771a-8254-4e6b-aba4-4e62df17d3fd", "value": 393868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404080, "uuid": "390fabc6-6771-414c-a6e1-0d2159e88fb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404080, "uuid": "36d8668d-b76e-4fa8-af7d-71d5a46f68fb", "value": "69edeac98f1cf614188ce821b21118a1464f88de3dcd55d700bb66d710cde57c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491830ed-3a69-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776435929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435929, "uuid": "0bbdc3b7-ba84-450a-8a95-611c0e7a2b20", "comment": "Malware payload (RemcosRAT)", "value": "3203276aaf175f6f76bba274e41b98e6", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435929, "uuid": "d7c023a3-edca-4f6e-ba2e-a1c416a1a111", "comment": "Malware payload (RemcosRAT)", "value": "6a07a43a6bbc5bdd4ac435aa08feb6254ac020c6c708adbdd3c526fca24d5171", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435929, "uuid": "29f956b9-8255-4840-bd1b-f8c7bb11f044", "comment": "Malware payload (RemcosRAT)", "value": "ecef93fba2f143ee9be3dc4de313435a3cf03230", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435929, "uuid": "a4dd1ccb-f420-4387-bf5f-bef3939e96cf", "comment": "Malware payload (RemcosRAT)", "value": "eec700a5ac6375a9254989da8e2c9d38668c12051926970ac130f639e5bb5cc525fd09effcee42d3cfe84abb554e26d5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435929, "uuid": "3d6042de-e171-436a-a887-b8e69bb0e66c", "value": "T1AE25F166F6D9C88DD023C17A852B98C1135EACB4A768BEC3715FB237AC77B0A41A3141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435929, "uuid": "89c82375-69a2-4ce9-b897-d6b52246b739", "value": "24576:DVweCnGd4LJ7GYRT80/KadmZeOgKJ/K8WUN:xxCGd4LFRTh/iZePKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435929, "uuid": "0c4f6059-7817-40f2-bd6d-de85b5e5d2b3", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435929, "uuid": "b4782d90-f76e-4bb5-a317-5888f8d3612e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435929, "uuid": "5588408a-a360-4527-b0c3-788a073ba715", "value": "FedEx_Billing_Payment_Receipt_16_04_2026_000000000pdf.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8734ba8-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434398, "uuid": "0a3ededf-6f0c-43b3-a28b-b7b18b406de7", "comment": "Malware payload (Formbook)", "value": "ee8db5b400cd8b45ca656460dca7de59", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434398, "uuid": "462c90d8-fbb3-4dc1-921b-5724b75b99ba", "comment": "Malware payload (Formbook)", "value": "6ba2db461aeeb228074c678dbf0d249ce66e05aacfa76bd8a0eedfbd4dec33e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434398, "uuid": "567e8abe-7efa-4446-a77a-2b7230d86980", "comment": "Malware payload (Formbook)", "value": "7cc5a5bba552af366021df1b1c6a1b4ee9d8530a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434398, "uuid": "2fb0af49-4734-4d64-885d-940e0d0d50c0", "comment": "Malware payload (Formbook)", "value": "e2f9b18a8e0e8129aa35b61c5d00d3fbab7a16062f4818ed28ddf335214e46c2d88ab34c9b00b7e1b74af530c2da0fda", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434398, "uuid": "959877d2-2a53-4b38-ae5e-9de5dcdb9d1a", "value": "T1B1F2B49B75C6B051464730F72B27E51EB16E8C84790C8420FAD4B89DBC2DF2CD6BA9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434398, "uuid": "ddadb3e1-3802-40e2-8a06-529b3faa7aea", "value": "768:EVx36snO7Oo2e4CvdWjJXhscC2buL3wJWoo/vsaFya3ICUzmNj5+:jYA0nKaRK3wY/vsaF5ICmuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434398, "uuid": "5fbf688a-4699-4968-8dd7-8ff7274ec3d1", "value": 34994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434398, "uuid": "388fe337-2390-490b-8f1e-bd0c0f165956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434398, "uuid": "8b8428f5-1704-4fa5-b869-f85ebef8448c", "value": "MODELO 303.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fe1671-3ab2-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776467297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467297, "uuid": "e4368b2d-0a56-4db5-a936-a0303438cb73", "comment": "Malware payload (Amadey)", "value": "170ae8bb220382c5160f6a026d113b40", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467297, "uuid": "30bb2964-ad24-4f80-b667-45bc57d32000", "comment": "Malware payload (Amadey)", "value": "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467297, "uuid": "0ef4115c-ed0d-40c0-8689-e676d3daac83", "comment": "Malware payload (Amadey)", "value": "fc1baaa398d369822cb6df06d3b5e512b54d93e5", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467297, "uuid": "f15da27b-92ab-47b0-994e-c70968a263a4", "comment": "Malware payload (Amadey)", "value": "5e4a78b0aa2308a91d02304b4e49d2a3c77ba90d4a5b53cf00d4af65e28609656e9cdb7f58dec023932fc7b3e219afeb", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467297, "uuid": "39888d53-66fa-4f61-b83e-c21e226563e0", "value": "T185955B05EEC754F2E9471632A9E723EF233599090F3A9A8BDA017A7DF9732D50932341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467297, "uuid": "45bcd47a-ad57-46d0-9bae-49d64c27c0ce", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467297, "uuid": "d3e96edc-aff7-4a41-91cc-ae334aa7145b", "value": "24576:4Z3mnUFs5/HlOqye/D22CFwGKPDGmLsdKyyNtY6eZScfEpOGbZBZuYpu2wtbRkMN:4tSdOmSXaDY6riQVTuYvubRkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776467297, "uuid": "f3ce9251-a57b-46dc-9fec-a4892cc13cb7", "value": 1993432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776467297, "uuid": "c2d8d60e-04a0-46c2-a173-12d771c74aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467297, "uuid": "8be9ae47-0fea-4dc6-8fa1-467b7d521155", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a7dbbf-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434388, "uuid": "0ff7babf-8fa1-4d80-ab60-09642649dc85", "comment": "Malware payload (AgentTesla)", "value": "5fc131ab9cfa6e76ea2c002066d1c26a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434388, "uuid": "2c191a6d-24fb-4c65-9d0f-470d971f1ed0", "comment": "Malware payload (AgentTesla)", "value": "6bdcccd6ccb6b651327db1a51dc93445a489eb21cc9e83bcfd749fd82bff026b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434388, "uuid": "7e73eca5-2acc-4013-8764-b7f3a699fb31", "comment": "Malware payload (AgentTesla)", "value": "9a636d8f3a251619c06f862f296dd90324c31dd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434388, "uuid": "e06abc8c-bb88-44d3-8530-7bbde2501180", "comment": "Malware payload (AgentTesla)", "value": "9b1022e548d3866e5209fe1ea4db7902127e7764c112edc5a80e81f186987217d1f373cb7a24aead878c8328f25be1b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434388, "uuid": "3fc23bdf-7ad1-49a9-bdf9-6569e7b756de", "value": "T18865021149C43FB8CFEC262850BF151E93F14D8A500AB98AFB33BD5EAFB7A04511B599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434388, "uuid": "f9c064e0-674c-4399-a7ad-3ea82ba3f47c", "value": "24576:9D0po/m+PxI+vsraUEnvwSUdJzuvwndlvMEsSj8tzXLXJ:9thJInAg5nTvMGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434388, "uuid": "a823b37f-a5ea-438d-b481-fb411c4aeb73", "value": 1483567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434388, "uuid": "80705437-a9b8-45cc-8f46-aa12ff8f4851", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434388, "uuid": "4c17a920-0717-4804-99c1-0665979ec803", "value": "Nuevo pedido urgente.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6344a8c1-3a88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776449288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449288, "uuid": "0e91d0fe-11c9-45cd-b0b6-c077e9c6cbcd", "comment": "Malware payload (Mirai)", "value": "4ce67be1f5a7367a673b9f65f0ac22fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449288, "uuid": "df0ab69c-f0a9-4922-93d5-671822f08351", "comment": "Malware payload (Mirai)", "value": "6cecf4baa5145f85c3c30713dca1ec0afad5c034de67695ba357e34e2a94f900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449288, "uuid": "f94fbeac-6f82-4717-acbe-a8f5227b7585", "comment": "Malware payload (Mirai)", "value": "0fa22e369566315938c95f117ae512586998b44f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449288, "uuid": "805d879d-7636-4644-b48b-0385ba038868", "comment": "Malware payload (Mirai)", "value": "b5e8bbff9b7b383cc8d103c251f13a16afbfbe9bf8fcfa27676bc391e719216021ea7c91f8f54d6f15756388312fa896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449288, "uuid": "57b0385b-59db-4501-905d-d5e33b258e13", "value": "T10E7302CFF3A4B59DEBCF987B018583754F01E991F2A9178C87188CAD960F98B180D4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449288, "uuid": "013a9ec8-9295-4f57-b3cf-28eb3cdb8a69", "value": "1536:UGqL761kWwRp2lDUfaxd8axD3H/zvOx7GbsdbHFFLrREKH6SAQdfQ3j7F:dqv61HwPgDGGDzVgvtZSufUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776449288, "uuid": "a7d3a378-3f1f-4f84-bcd6-79918ad4e881", "value": 77996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776449288, "uuid": "5558fa73-86f2-4772-870a-e6c1b7374505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449288, "uuid": "d84dfb3f-9f8d-47dc-ac77-6563eec51137", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a223bfb0-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440374, "uuid": "166facdd-91e8-4d96-9255-658b2319ef34", "comment": "Malware payload (Mirai)", "value": "31f390fc1f0b87cdede503fc7cc66fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440374, "uuid": "1478b4b2-fdd1-4549-b465-c453d50a7ad7", "comment": "Malware payload (Mirai)", "value": "6d0ccf790ff27fb69bb64e8f0d0a3b9ea6b250efd79ee7cd6fb93fe9d12dc09a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440374, "uuid": "7ac24b57-51c9-401d-8901-8ebaf26d3bb5", "comment": "Malware payload (Mirai)", "value": "ab8dbb336053c1e5252adf2a0bef79cc54e95024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440374, "uuid": "82f10f30-0da2-48bd-87cb-86258c0d1571", "comment": "Malware payload (Mirai)", "value": "b160926594e5a3d899b5dce59b5077e921f5c51725edba168776ed39add9ef2cf8fb110260f22eb3258c7a54837d7952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440374, "uuid": "56bc14c1-500e-4f33-80b0-33e041b8e591", "value": "T1DC248272989CC587C122627D60EEDF7ADD7E72CA2648CE017CD118399AD5FDB3A06D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440374, "uuid": "fb6fd6bc-9529-4e7d-8c60-d79b9f40f491", "value": "6144:bwL4a7BE9vXgNEjExiE4/+tLr9PVk7UFb0q9XjBZn3CxOM+lT67KO:bwL4a76+LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440374, "uuid": "d7b01670-a2e5-45aa-b853-0e86b2db80f4", "value": 215148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440374, "uuid": "66cc8dd1-4d7b-439c-bd1a-0b7120e9012e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440374, "uuid": "21d5ea8f-208c-4756-b8da-491fae009e4d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf2e479-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435666, "uuid": "3703954d-319d-47a0-b70c-96934f6151ce", "comment": "Malware payload", "value": "97c78b0cad3ba59ed1a763f69705f232", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435666, "uuid": "8eb8448c-0fe0-4f12-a1ef-a3f836075a18", "comment": "Malware payload", "value": "6d8fe21cbad92242a3c5c4509ee369453a9a56df5fef5773ade516a597be075d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435666, "uuid": "e2e46eb0-a4ed-412d-bf86-c9c159672b6c", "comment": "Malware payload", "value": "5051c9af4d1e00769f697ba01546225620e8f6c6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435666, "uuid": "526f8fa6-1b57-4de5-863c-928083d4c7e7", "comment": "Malware payload", "value": "4cebd278cec3b14aaba8d9232ff6627b060f171a2be09668da753a31e7c670e6927e2c3c35d6285c4e441c921f0c98fe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435666, "uuid": "3087eac2-1cb7-4b45-a9fd-17ce012c8a6f", "value": "T1B8C562306223485D9969F901066F5825CD149268F6D93C3304FAFCFECB6A39286F76E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435666, "uuid": "f9c26a4e-e0a5-414c-a01c-dab9f9fc3027", "value": "768:xVop8f+Q/Oz6G1wSFGj9mXyDtnA4P6Jdz0z0z0zRA5duCJz0z0z0zJEL72eUB7A3:x3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435666, "uuid": "99370718-71a5-4889-b1ba-23daaa59d68f", "value": 2563198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435666, "uuid": "f1335f6b-46c8-49e3-8ce2-4ed8d014697d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435666, "uuid": "0b4241d2-5165-454a-a629-fd5e20698ee7", "value": "ORDEN DE COMPRA_POGHB338T_Xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9f9b11-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (RodexRMM)", "timestamp": 1776435294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435294, "uuid": "09cc17e4-b6ad-450e-8ead-82e22e08589a", "comment": "Malware payload (RodexRMM)", "value": "92e1c456da06823c8d6ec5b11b4ed97c", "object_relation": "md5", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435294, "uuid": "4fb4c650-809d-43f0-be78-507fe84172ac", "comment": "Malware payload (RodexRMM)", "value": "6e0251af8c1e371066eba0350c7199305cee2fcb538d6b1b363d376ae146e068", "object_relation": "sha256", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435294, "uuid": "af2bd013-a104-4286-ba2d-9156ee354b3a", "comment": "Malware payload (RodexRMM)", "value": "af84337aaafa479681782e3ad934d2342e6f82d8", "object_relation": "sha1", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435294, "uuid": "4d933394-92ba-49f4-acb2-bff2be871a79", "comment": "Malware payload (RodexRMM)", "value": "6ce82b05f500a80c2b1520d04e93ed95d20a1d621935918e4ae782ebfba1e3d7b230661a6cc29f039c76f267de6153e5", "object_relation": "sha3-384", "Tag": [ { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "RodexRMM", "colour": "#0493D6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435294, "uuid": "71b76bae-f03a-4e56-9131-05362801311a", "value": "T127B1C70F6D17E5B1593ACEA95637BC2CDE919063C85164483A8CC8C69F70E3CCDA15EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435294, "uuid": "a85e0f43-2111-488c-9766-c7ea1205fdf2", "value": "96:JmYHiq4s6IxAlT8eBEscOcml/2OltnF7xhyzZtJI/C/MhSRfAHitkNxdKswQcAN/:JmYHiq4s6IDeBENOHl/2O97xhyJI/C/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435294, "uuid": "cc852aab-0eb9-466f-97b6-760b97ce583c", "value": 5405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435294, "uuid": "f3043bcc-1104-45f8-9e1b-17c69947994f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435294, "uuid": "691edfc2-4085-4766-8b87-8c9e4d12d9cc", "value": "MuzaGestin-Install-Default.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf65c8-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1776435670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435670, "uuid": "a222c42c-c7a3-4601-8a0f-e06f0c9e1ab7", "comment": "Malware payload (GoToResolve)", "value": "bb2ac6ca1de83f9d4e3582f810f50ebb", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435670, "uuid": "4329b34a-ee85-4af4-900f-35ef361a4459", "comment": "Malware payload (GoToResolve)", "value": "6e847a97ad2178481fa988c8c9a141d1b1af91e51cbda862303464713e4bee9a", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435670, "uuid": "22d91b33-a5cf-4236-ab78-647d4b8876cc", "comment": "Malware payload (GoToResolve)", "value": "d116adaff145c79cc289f7ae8835ac6f47b30ecf", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435670, "uuid": "09a0646c-b904-436f-8957-97f30a1f6ba2", "comment": "Malware payload (GoToResolve)", "value": "07ffd756c7ed31e4c41c3e62da725dac8ef2f1e19a26bfe4ae008ec4780b6758a8579bc2d50736396588a11d5ad1035c", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435670, "uuid": "c3960144-24bd-46db-ab92-8463d098a180", "value": "T132819433E9075BB26A758B19E913DC09DEB11533116308F87B0C84792F3986EA7B42ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435670, "uuid": "a5340588-b009-42f9-94f5-1595ea0e97fd", "value": "96:OS+EfSFCAxA/4lYI/sMpUsx9Bno8TFHe5ZSCq2YsIA5tvosCNy:OS+iSgAxA/4lYI/sMpjx9Ro8TdeWr7AV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435670, "uuid": "406c70cd-d33a-4d7d-9c96-336aca2b6132", "value": 4062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435670, "uuid": "ce673425-b569-498e-8709-2d3782a82ade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435670, "uuid": "3151ad63-c5ec-4b6b-aa90-b526875f69fc", "value": "SSA-StatementA1210028886351.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48485804-3a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776411017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411017, "uuid": "c2a930b7-2b60-4265-8357-9727d0096753", "comment": "Malware payload (Gafgyt)", "value": "a516bb53e97d143beb709c379192bc59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411017, "uuid": "d1e2a808-5403-4f61-8d75-41e4e5f7dbdb", "comment": "Malware payload (Gafgyt)", "value": "6f7aaf9ac08bce8fff788051d55116a7917c0cf3a69dd32ffff86d3cfa09bf4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411017, "uuid": "a2d387d4-578e-403a-ae68-d95ac62537d6", "comment": "Malware payload (Gafgyt)", "value": "ea45425c685600f7826806d1a81a0411c51c5903", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411017, "uuid": "8903b34c-08a4-4de9-b136-f734fad1813c", "comment": "Malware payload (Gafgyt)", "value": "fe882344f9322eb467d1246de14036e6a538ada66c5463728ef62448d93dc42f7bbd9f0d59910887c2410dfdba087fa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411017, "uuid": "f0579e0a-4be2-4c05-8407-6928b33972b4", "value": "T14BE3646E7E21AFBEE268C63107F75F708395219326A19382E26CDB185F7128D1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411017, "uuid": "abc9f518-1413-4cd9-92b0-a036bda06a51", "value": "3072:bOwVZhQyr7g8+t+z5hKWL8YlxRxulq+1uPNd5R:6uxrUMz5hKWLblxRxulq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411017, "uuid": "378188e8-6a73-4a13-a78a-3ba2fc085e07", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411017, "uuid": "94d9e61b-c2a3-429d-ba0c-a2bd20dcd432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411017, "uuid": "cb97dc68-7d57-4ffa-afb3-243497260f0d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670a1164-3a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776451441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451441, "uuid": "804bcc09-5eb8-403a-98f9-6cbe55423cc7", "comment": "Malware payload (PhantomGate)", "value": "2ac18dcb91824b1838ef83da2e2e8c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451441, "uuid": "763bac45-21c8-4a72-926c-64467069ac36", "comment": "Malware payload (PhantomGate)", "value": "706bd2e1aac21fadfbcfe1e6639a6488c574f00b007e087718282c597bebf1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451441, "uuid": "c90c46c2-40b6-4eb8-9d0e-4fb073b74498", "comment": "Malware payload (PhantomGate)", "value": "c401c3621c53fd64594e989a77ba055859b3d87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451441, "uuid": "bfd149ed-dd9c-4759-ad14-4ee2fed88019", "comment": "Malware payload (PhantomGate)", "value": "4f933672984f99653584929ef4c5d0c317f5a8654da89528c302c1aa107be464c4841af0f8fe3beb2f2c84b79e472df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451441, "uuid": "93b01818-32b3-45d0-ab22-f20b28547924", "value": "T1B754B7143BFA5419F1BBAF765BF475968E7FF6633A03854E0491034B0A32A80DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451441, "uuid": "1ac2933c-9efb-45ea-9bb9-00c5ff6f3d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451441, "uuid": "4ab619a6-0193-4cad-99d4-08390f50f266", "value": "6144:M1BxSxQ8o8ChWqYgXq90Jb7Z75k6e/iXk:bub9JdXtld66e/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451441, "uuid": "e06e66db-3d54-4241-a9db-9e969573b6d6", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451441, "uuid": "41b14858-9ada-468e-b346-94a703f40949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451441, "uuid": "eeb7cedb-cb36-4bdd-888a-5ce6faebb242", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b80842-3a2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776409592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409592, "uuid": "65958815-815c-4a93-b104-88f0cd86c76c", "comment": "Malware payload", "value": "cd2d3cb52bea2c2f9bc9e01f3013a1e4", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409592, "uuid": "c1988285-a3e3-492e-ad2e-e8c51092468f", "comment": "Malware payload", "value": "70d23fee2e6509121afb56346aa961d93bbfdf23919cd6aad3c7a2523b481184", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409592, "uuid": "4889c63e-5b85-4bb5-88f3-2d1fd1d01c73", "comment": "Malware payload", "value": "316d93d2505637067dc58b878b83022d6473b9d4", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409592, "uuid": "faa80744-95e8-4fb5-b82f-e795fe4da245", "comment": "Malware payload", "value": "b88c2496169c643b336d09f79e8c88e99107ecab5c915194c50d2fbffbd046a92d162637663b9b9f374e6c7d7150b562", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409592, "uuid": "3e5539eb-098a-4a2a-a5e6-877e7d24e011", "value": "T1D5970146F60CD82BD9EAB07CDD8B47D3B9126C461610C29B3921B60CFEB37D49A527E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409592, "uuid": "b9a34ac8-a5b6-4bbb-aa12-58f2b1e5096a", "value": "786432:GRtBFyii1GDi7MTUx64C0/F/dJjL/7UJAcFv47qt:qjOIiQYZC8ZdBLiWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409592, "uuid": "ec00394f-99bd-4175-bfbc-7b3c019e4054", "value": 42708654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409592, "uuid": "5cfa092b-e44a-4c37-a95b-76cc17beec53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409592, "uuid": "44ecd030-f363-4c9b-bff6-4e69ef3cb447", "value": "SMS+Fast+Messages_1.24.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5113073d-3a32-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776412320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412320, "uuid": "0c8b0619-6860-4afb-8f8f-f6cb027391cd", "comment": "Malware payload (XWorm)", "value": "e02cb6e561544032a40aaba15543c004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412320, "uuid": "aa7ae569-abb6-4837-b36f-4f3dc9892d49", "comment": "Malware payload (XWorm)", "value": "71298dc679ea1a7f863c3c645f008e5ffcf892510bafc1c1fd201fcbf5f41952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412320, "uuid": "6c838ee2-9228-4b93-a2cc-e1fb67115297", "comment": "Malware payload (XWorm)", "value": "b094d7b105d4e6ec9071d0ea371c45649094e652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412320, "uuid": "1c3869fd-e9f2-4727-bae0-526f5d24e8a9", "comment": "Malware payload (XWorm)", "value": "0563750c5e00c6d3e2ef0e984dc3d537cfce44754baf7867d32562719c5fef99f3cd82a9bc6aa9397fe101b49c472d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412320, "uuid": "dcc616ac-496b-4fe0-918b-2234c417bbc3", "value": "T18435026A76E84F90C9582EB9C1F3682407E2E58376B3F78A3B5116C61E527E0DF463C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412320, "uuid": "d9c1520e-9f7a-43bd-beef-74f06019ce63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412320, "uuid": "383d8eaf-9256-464a-b302-19394c0fbbcc", "value": "24576:OGLRDQZdMA2NAmzucFDkFHtBtCbKrMyfprOIbuGN7lK21:OG+MA2JzucF45xC2Msp6IbJ7821", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412320, "uuid": "75c786bc-d842-4911-9353-4afab855e6c1", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412320, "uuid": "19576197-ec08-4309-b879-9a9844576061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412320, "uuid": "5f2025a7-dae2-4a63-8879-a26b31de695f", "value": "SMT_20260417_Price Request DX FLO-VN.pdf(94KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f12463b-3a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776424799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424799, "uuid": "6a534681-8d39-4316-8f26-c3f86c720395", "comment": "Malware payload (Mirai)", "value": "0f3628551e0e6b628b04ce303179128f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424799, "uuid": "f53ba271-c6ee-48c7-a0e0-7bd17c6eba26", "comment": "Malware payload (Mirai)", "value": "712f61c3e3147826dfb6e7aeedadf20da9c764bcdf52b36ddca66e68c0aa4db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424799, "uuid": "fa551e0e-00c5-4e02-a668-6271aa6c2340", "comment": "Malware payload (Mirai)", "value": "291711c98493d61d45c42785911a8ad08ef529a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424799, "uuid": "a572619a-e23e-4a6a-b4fe-b3d99586eb8f", "comment": "Malware payload (Mirai)", "value": "1dd6ed9902a00233d7e4393849d9579e22c9bd59c4dff8d1ae1517f56350c7f651f24d1c7806e5e93af08e4d5f07fd73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424799, "uuid": "ff384d5b-d0a9-4a2d-9815-9fa034b1d5e6", "value": "T191B31991BC82966BC6E123BEF67D918C336667B4C2DF751BC8254B21778911F0E73A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424799, "uuid": "6034a175-21eb-40d8-a039-150739270529", "value": "1536:DYpCVxMaED8//LPVLovisFGdH1AsbAyAZ0QYEn06qcKLMF08v9sEiWeDjwgu2SEB:DUHaED831ohIuCA+9dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424799, "uuid": "4331b42f-73d6-483e-9c77-0491e96384cc", "value": 108100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424799, "uuid": "7a3a9624-4295-41a1-9358-b17c6d52d2e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424799, "uuid": "7e278e37-e38f-4476-a196-a48959eba7c3", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ae0e04-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776434368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434368, "uuid": "be6bdeb8-6ed1-468e-aa4a-b5b2c2491048", "comment": "Malware payload (VIPKeylogger)", "value": "89ad0937a11dd7f043b0bfb7d46cc3f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434368, "uuid": "aff879fd-d1e8-4b3a-be3d-3b9f99a1baed", "comment": "Malware payload (VIPKeylogger)", "value": "7170342e404d36eaf353e372204c6380fa5dc08337e900dd74d76e86db54eb5b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434368, "uuid": "2b5fe146-8582-4483-aae4-a86716a9b2fc", "comment": "Malware payload (VIPKeylogger)", "value": "e497dbd861a0f3baf3eea5b2fe87edf0827fc36b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434368, "uuid": "7068e432-9fce-4d60-93fe-7920bc5daeff", "comment": "Malware payload (VIPKeylogger)", "value": "56b73f7d568735eb3267302cf68dbbda4233b776e54b9f9830aebb79a1e43702361c11d8fd1439483834fb5263c94cd8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434368, "uuid": "6f9a0a2f-42da-457b-8bb6-e0a2102da830", "value": "T100645B70FE6505694C4B6B9EFC414AB3CAAD810A563B54E0FBCD078D22081FCE7BD669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434368, "uuid": "4ffa522f-4589-4f96-9392-69b0cb161e13", "value": "6144:8E+ERE96mE+ErY+IaEIE+ErH4EPE+E5E9yE+Er8YEBUEGEE2E+ErwBE+E8E+TE7/:OJOjOpAOQOMDROlt4OLTFOPsO0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434368, "uuid": "a55690c8-6f8a-406f-b2a5-08c01b2e02f8", "value": 315533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434368, "uuid": "58b7c6ef-46ab-4c22-b1e9-1ae4135a06e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434368, "uuid": "c31081f6-e17d-4174-b73c-6f0f474a15d1", "value": "Powiadomienie e-mail z 2026-04-17.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d741af2-3a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776450915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450915, "uuid": "c5c3ea82-d8eb-4c9e-882d-2227b40a4f2c", "comment": "Malware payload (RemcosRAT)", "value": "eae7e8ca8f2009cebaae57d5ccb75cf9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450915, "uuid": "88dfc30a-cbe7-41f1-8bad-ca27537aaf38", "comment": "Malware payload (RemcosRAT)", "value": "718b193c2a43f30228d63416eb68c21019069368905bc6638a3f68504a0e1228", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450915, "uuid": "c9d822cb-bd97-440c-afff-dc2f2098a5f0", "comment": "Malware payload (RemcosRAT)", "value": "024024a2f75e45278cfbceab18d2573928a2a08b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450915, "uuid": "c38a5d01-c0bc-425d-81d0-53a23d2750fa", "comment": "Malware payload (RemcosRAT)", "value": "53c5272a8eddee56e3c383d80898e58a08d0359e6ba26aa7659bd855aea66f39be44f32fc1b322ff6cc4c586632e2eaf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450915, "uuid": "471c6e80-1dcc-4ab3-a275-cccae9d18df6", "value": "T19934772B4B374D61D2BC136128840CCB686DD12A517C31AE278C87E9EDB8D774E8967F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450915, "uuid": "7496910f-bc83-44e8-b926-ff36becac527", "value": "96:lTpa6ATDjOkAI8U7yo80B0GEekTIubATDjOmqryVo9vbEA8a+MIHoOu/ExEEPsM6:Vpa7WUmMIRduy6VAS4FWB05oXje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776450915, "uuid": "91ba7661-9fe8-4c9c-8c8a-95344f3785e7", "value": 247971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776450915, "uuid": "f031167a-9cec-47c5-985a-bcbcf9ed4a6d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450915, "uuid": "76a64aac-5ccd-4276-8137-cea4f1f2ec57", "value": "givemebestthingswithbetterwithgreat.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7020be5-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435738, "uuid": "5fccb92b-7f0f-4b73-9b03-4bac1648750c", "comment": "Malware payload", "value": "cf21eca0ae7ab76a07dda5661ae68516", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435738, "uuid": "796e80f5-23b0-4816-ae26-299801680d68", "comment": "Malware payload", "value": "719b3369831ad7d500faa91ae023b8b24d3df151e72b0ad06a47ff1deb1a48e1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435738, "uuid": "a980a832-54f0-44ad-ad9f-0b7c32f27af3", "comment": "Malware payload", "value": "6913218772178fbeaa5724126d05ed8b54c257a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435738, "uuid": "bd872656-db37-4516-b21d-59e9ddc727cf", "comment": "Malware payload", "value": "4f3fc4371c47d7318fe9927d8ffe0c1a10c877bbe74d32818063289b06aa57ff26d048455625f1f8831efb353318f197", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435738, "uuid": "2d5a35de-51fe-4015-95eb-56a6173f5047", "value": "T196171202FF45E9DAC0F357368D71817301475D259B83A2936D28B27D187BAF88B4EAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435738, "uuid": "c0251fb0-a98f-400e-ac73-3fd6747916a1", "value": "393216:0l0QdCwa9dumGZ1M5azaxtOUJKRyofHqmqep9bDhE/A/D+OuG:0l0QdnSde30x4RR3HqZKHEUuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435738, "uuid": "a81c550b-68b7-4745-adb2-e478f3a07e05", "value": 19483937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435738, "uuid": "ea43b034-e718-4dff-bbcc-f3bbe8f474b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435738, "uuid": "f4b58b51-4a99-4bd2-9a53-cf197d74e998", "value": "71.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0222b96-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392401, "uuid": "1bf3f775-cd54-4655-9478-781514d19a6a", "comment": "Malware payload (Mirai)", "value": "a7a12a991c49eca40e3415a976f7e92c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392401, "uuid": "1d841e07-9ed3-4581-a1bd-5ab980aa5414", "comment": "Malware payload (Mirai)", "value": "71bc509c6964d96ed477ae45941e7ab48a7d8d7d9973da2eefe7d7a5be02204b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392401, "uuid": "e49128e4-9e10-48ff-b538-fe6bf953a96d", "comment": "Malware payload (Mirai)", "value": "74647eba9305fbd6054c3e44a6df3bf0b332c7c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392401, "uuid": "848530d8-e3c8-4b7e-b8a4-e16e2bdad8f2", "comment": "Malware payload (Mirai)", "value": "d16e80e904ffe1213502425570e4e1d7ce25f723b036f03166518cc89c82bab3764abb0a42e802468d851a7ecf321e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392401, "uuid": "726d2ac2-eddd-4b8f-bad7-f5d45b1393bb", "value": "T150F2F781B8825A2BC2E423BAAA6F518E336173ACD3CF7717D8115F117B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392401, "uuid": "d333fac5-b30d-4220-8cdb-cb2bea814d24", "value": "768:hTbc4lzXL4ugq3GSKWKKCBo2T4DpjqG3+WHrQi6Mj6:FX5gmGe2T6plHrQiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392401, "uuid": "8196ba61-3b0e-415c-a617-b52339abfe38", "value": 37144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392401, "uuid": "17ffedd3-fbea-43f7-8672-bdce0ecc8733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392401, "uuid": "9f124ca6-5bb3-4052-b40b-d7f160866b7d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573904f5-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776432517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432517, "uuid": "07373da5-6124-4d23-bb18-9f38dde29dc7", "comment": "Malware payload (CoinMiner)", "value": "ea64201c205ad92a311ca9f5ada65bd5", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432517, "uuid": "e68bcfdd-e381-4951-a097-365dc932bcee", "comment": "Malware payload (CoinMiner)", "value": "71d978f1a0577030b864c7ea1ecc205a7b067c616009e6952b8d7b91412132be", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432517, "uuid": "e62b3880-c5f0-40c7-8273-18d560591b83", "comment": "Malware payload (CoinMiner)", "value": "f1bfd42162e067cc7fba83f7263694be88703147", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432517, "uuid": "0fdfd114-4201-49e5-a7e9-d45a4af299c1", "comment": "Malware payload (CoinMiner)", "value": "10356c8029fc932fd62b9a4a96485d32635d7b9080fcce3062b8a0735ebbc3d0dc680c8d0755052711d2aabf96c3c863", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432517, "uuid": "35fab99f-5146-475e-b8eb-b801a2b41e8e", "value": "T16FF26C0BF78248FEC04ED07998DBA73695F2FD2B0934930D5724EFA21E15A708E5EA05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432517, "uuid": "d93a9e60-3025-47c5-960d-dfa34c44cd7d", "value": "e1bea02c7b2ab8a403336ff299365735", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432517, "uuid": "7cb6a142-808b-495c-814a-4421196c0073", "value": "768:cPqLF3LMgVMewryoyKA16IikJ5w1hxhLU:cPe5MgVMHyKASGy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432517, "uuid": "1c87ffa6-65a5-4502-8985-debb79420d23", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432517, "uuid": "9c03c147-4261-48a8-8e96-955f6faf5d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432517, "uuid": "66c9f1c0-f66a-4bae-a2c6-fc0a62b40a3d", "value": "runtime.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1230403-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458545, "uuid": "7a79cbd9-56ac-460f-9e60-2d86985e7270", "comment": "Malware payload (Mirai)", "value": "9695f77b13f9eff29357439fc8091db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458545, "uuid": "c0219581-3479-4deb-b798-35f85de3d112", "comment": "Malware payload (Mirai)", "value": "7209fab38adb8da2ccb8f64d2b59d25647cd39a00a6fff8b7f90e28f8f43add3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458545, "uuid": "fea1f996-31ae-4927-8d9e-bc2e5b948f5d", "comment": "Malware payload (Mirai)", "value": "8bb40f27c7e0109807f6bf57ce6538c992363a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458545, "uuid": "13ce30e2-e6a4-4bdb-aebd-1d11475b4d1f", "comment": "Malware payload (Mirai)", "value": "e3cae06d43be2fedcb20e2f34a483c9f58cd69ad44fe4a9bd6bd28650fc2b685189e627018f78a698c18757ac5859f26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458545, "uuid": "d54f5744-6db5-487e-bbaf-0c6a9892fa8e", "value": "T112D3294ABD418F12C4D225FAFE5F508933139BBCD3FB70128E219F65278A99B0A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458545, "uuid": "ff595db0-9eaf-43f2-b65a-31987ccd67e4", "value": "3072:pAAHHOfcEyK+IJuemML9UpaNAZqLXEHuqTzm2QL4wQEC3/LH:SUBOKpaNmqLXEHuozmGwQEC3/LH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458545, "uuid": "659c4f87-08ee-49d0-b706-2d1a4125a892", "value": 136216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458545, "uuid": "ed1a67de-0b29-47de-b273-05903440a765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458545, "uuid": "185e9805-0bef-45b4-ac7d-1dd235b0f5cc", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dc218e-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455822, "uuid": "c257a29b-3edd-48e6-ab8b-5b8d9aeff381", "comment": "Malware payload", "value": "e7bc300e32fb778506528c21608b58ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455822, "uuid": "f77092bb-74d0-49be-8dd2-d65b8f8517a8", "comment": "Malware payload", "value": "7324e09fe7f30ad3810aa5f230efbd65cf9205d97e00a3a892b2f65c1844f68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455822, "uuid": "ca0e09b7-6188-449d-8bf3-a72f6353fc33", "comment": "Malware payload", "value": "3ba99059848de3175cb8a0dcd16a9b2eb56f0b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455822, "uuid": "634c2d89-cf99-428f-b8d8-67c60903e722", "comment": "Malware payload", "value": "ccf038fea41699051e4292bc4446de2d9c28e447f5a43a7d11783e4ee6d310fc5eb07b6aac86478f9902bfb674ecc12b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455822, "uuid": "1c37032d-d81f-46e2-8dc9-9c9e18cb2210", "value": "T174E37C8BF71A5C92C8900BFA4BD74B8C6BA3A1404F67C7D73D0C66341E666DE9D1A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455822, "uuid": "64322afe-2d5f-4420-93d5-30c3cf8352b7", "value": "3072:eef6QcL1ItXaHD4TSwwg6qjr9hVBnm7WG:ebQJas+Nq1TBnm7WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455822, "uuid": "c0782224-a9f6-432e-8950-555601f40c6f", "value": 143636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455822, "uuid": "ebf50cd4-777f-4cf0-9cf9-2ff92d1be52a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455822, "uuid": "93bc67f1-4ca2-495b-b1c7-8af97b4c6e28", "value": "circle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224c4091-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776426415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426415, "uuid": "144f6013-be85-4f48-aad3-937b1cd6876b", "comment": "Malware payload (Mirai)", "value": "41ee51dc453de3b0dc4b37181da68f81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426415, "uuid": "8b1d3718-665b-40cd-8f98-d81d98f6a2d6", "comment": "Malware payload (Mirai)", "value": "7395402a3012001dc6b0c67c5ab22713a8b35e81b6b769b96beb332b52af6100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426415, "uuid": "55338655-2d69-427b-b6e5-75049f70dfe4", "comment": "Malware payload (Mirai)", "value": "d18b5ffb463a740aaeaccf80e8706164f5eadbf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426415, "uuid": "9fded01e-545c-40c2-9c55-bcbe89024437", "comment": "Malware payload (Mirai)", "value": "1461d483d9b9bec940a41a83b51fac87ad5dde396c124cb8f8b8780d6960824e4f090851e6162e4c242487a74e7e30d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426415, "uuid": "7953b2e0-3cad-463a-93f3-1ba3c0507dfa", "value": "T1A753028260D98B0EF72E33BBEEEEF6891DB08236245345F7F9C031D28554B181D149EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426415, "uuid": "4e018855-ba8e-4c3d-8286-c254875d0100", "value": "1536:ZuyDuUemW2m73noamv23/QuFtCiUtSbfSBnouy8Eyj:rk7TnrR3/PFtCi+Ssoutp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426415, "uuid": "d64aa139-1e6f-4a04-b6fc-4b4a0b17bbdb", "value": 63160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426415, "uuid": "6f79df7c-323c-4ba3-a433-e11f54dc3976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426415, "uuid": "3b84a74c-a930-47b7-914f-45cb396b0726", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae4278-3a32-11f1-a769-42010a9c0008", "comment": "Malware payload (KermitRAT)", "timestamp": 1776412588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412588, "uuid": "ea37f716-8fa8-4da1-b9b1-95eeae710cbd", "comment": "Malware payload (KermitRAT)", "value": "fbd9910e36b07c6d4a095c8aabc2c801", "object_relation": "md5", "Tag": [ { "name": "KermitRAT", "colour": "#1DDBA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412588, "uuid": "d5c159aa-ca9a-4276-8c5b-57a43594e97b", "comment": "Malware payload (KermitRAT)", "value": "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9", "object_relation": "sha256", "Tag": [ { "name": "KermitRAT", "colour": "#1DDBA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412588, "uuid": "7592ba13-b1e1-4f57-a0ad-fa645d6b80d6", "comment": "Malware payload (KermitRAT)", "value": "fc5d8c3adade2bd27269d86a3883c6d9518e8836", "object_relation": "sha1", "Tag": [ { "name": "KermitRAT", "colour": "#1DDBA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412588, "uuid": "4d3ec0bc-a8e0-41c5-8c29-18f3fa480f32", "comment": "Malware payload (KermitRAT)", "value": "163203644db1cda7501e96a821275bff4870299296840df1a7a6b54359cf7b9636c304240983d12f813ec0379b115815", "object_relation": "sha3-384", "Tag": [ { "name": "KermitRAT", "colour": "#1DDBA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412588, "uuid": "459ea316-cb3f-49f9-bfff-a6d826ca49a0", "value": "T150620772B7A6D47591CAB1B5CC87A805E966816F816D0E0879DD86CBCF94038C3F83DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412588, "uuid": "466c8a6e-41bb-43ea-96b2-8b9507320061", "value": "192:KLicN9u364ENTwiwoSQcEl1sT6tLENhm83N7xxtQCUqjJGAsf70qXmo8idLqu9OP:KLicNg5oSkl83JUqjJ6f/jaeqgYFO9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412588, "uuid": "b9154a12-b295-4600-8af7-2023dfc6381a", "value": 15924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412588, "uuid": "eb0ab41d-fb2c-466c-abfc-6ce33b1ca2d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412588, "uuid": "b4a83827-05f4-4335-97f6-e995fb4f1309", "value": "KermitRAT.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27fc612-3aae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776465741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465741, "uuid": "f285c0be-6baa-415c-ad74-940dd0f36816", "comment": "Malware payload (Mirai)", "value": "2b4447bb5fc714b85ae3e5bd78ce9a78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465741, "uuid": "4c8458ff-abdd-4c45-bbc6-c8ef320e6d10", "comment": "Malware payload (Mirai)", "value": "740b4a0cf408bbf9f1d23c8e43fb1ae2f8f08709e8ebd9c8d6c9f9014b181f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465741, "uuid": "f3b94e25-509c-4105-bb2a-a8da5a3e3dbb", "comment": "Malware payload (Mirai)", "value": "7dbe1799f746563d84d696fff6d48b099f568c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776465741, "uuid": "222d457c-a112-4445-9e09-9fe81319f64c", "comment": "Malware payload (Mirai)", "value": "8ba7da71ac4a0211d1052467859eb5aea29e966d36dca453d2a7fbcd9b6cfd670ed1d0c38cd8243f04575206bcce245e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465741, "uuid": "45597efc-c2b1-41a0-8fb3-fd8e9f5dad57", "value": "T1F1433B06B952CA52D6D562BABB5F928C331523F8D1DF33039C199FB47B8781A0E7B580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465741, "uuid": "c58cca4e-94b8-4b74-b715-e11a30508d8b", "value": "1536:lxAVpuA7Pi0qfmWjFjw72JXETp+Fvxav77sKCtmVe:lxAVpuA7KpO+FjwYUTp+8EKCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776465741, "uuid": "caed70b5-a3a6-469b-99a9-c2f85e76e1b2", "value": 58472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776465741, "uuid": "57e340e7-e52c-4485-b183-3e921eb1b5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776465741, "uuid": "512ae5f0-9d0c-4375-90e5-59ec596289b7", "value": "triangle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac41f0a3-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455852, "uuid": "b0deaab0-8c2a-4680-8600-2ae6504cde13", "comment": "Malware payload", "value": "6a8e01a807e9cafdf19115bfe560a472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455852, "uuid": "b453b1b2-020e-4455-b7d1-bd7b22b1f806", "comment": "Malware payload", "value": "74218981370e6f45d0bf9c15468cd50533394783cac6cb680181202df8184d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455852, "uuid": "0221860a-5630-4c8b-9544-bcad5606289d", "comment": "Malware payload", "value": "3971fb0b7755a46c535f380449d93e608e8c51cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455852, "uuid": "2ecdd164-b7d9-4679-881f-7b734834ebe1", "comment": "Malware payload", "value": "f7829f960553d81c5c4b6ae1fd08a685c7be9e3176169cfcc54b8ddf4e882582ffe5a3acb99950bafe64691c95df7784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455852, "uuid": "2ff00ab1-b33e-4e07-b254-5e5e5188fe13", "value": "T143536C3379795D27C5C8A67D26E74334B6FE474534F8C92E7C220EA8BB0066027636B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455852, "uuid": "6a4cc689-f07b-4e74-906b-020b2a857b10", "value": "768:w5lwazSPpS0zZnkpC9q16KoIGwnrCu9rZ3O+l+u7AGbM:tbTY16KoSr5Zl+uFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455852, "uuid": "36c5e5af-b09f-4eb7-8a3a-661949a0b9c5", "value": 66672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455852, "uuid": "0d3d8324-38c7-43f7-987f-511ffb2a7717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455852, "uuid": "34b44e95-aef3-4bfd-8401-bc5cdaee42b7", "value": "star", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb780baa-3a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1776409143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409143, "uuid": "8c8ef5a7-8be8-4996-85ab-3624c5d79c3b", "comment": "Malware payload (RemusStealer)", "value": "fcbfd86c521e2ffc2dd58a2a58927921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409143, "uuid": "ea781635-e0f4-476b-8cb8-bf6239050ee0", "comment": "Malware payload (RemusStealer)", "value": "74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409143, "uuid": "492c4e5c-30b6-43eb-89a7-9bf65ff89f08", "comment": "Malware payload (RemusStealer)", "value": "1a5c6798b26ec4c58e3699223b59a65915c66d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409143, "uuid": "cf583c71-63fc-48ff-81b2-4a39d97c7929", "comment": "Malware payload (RemusStealer)", "value": "e97c0d600cddf5d7125515578ec8030892af3c78877a87907f3448a78292177edd1c6ac05a5ad8ce4bc0790ff96f14df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409143, "uuid": "d43ed4a6-77d7-4dd0-a82f-eac80e838353", "value": "T170855B5BAC9145FAD4AAA3368CF762917BB0F8080F3223C72E906A792F723D45D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409143, "uuid": "a6acdd06-955e-4ad8-aad6-e9d9e3cc6c24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409143, "uuid": "79e82901-39b2-49b8-bc43-e512d8e4ef2b", "value": "24576:2u8/vVX3awuqts1xX3N5++Y7Pcp7tqeK6coC1bOBSjPFhele5n923cZD3MR:2uoNX3zts1ccNMeK6cLaSfcUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409143, "uuid": "83cedc05-f607-491c-8a8c-64ce5ea1c7a6", "value": 1803904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409143, "uuid": "88228c36-a4b4-4a51-bf38-3188e1b92052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409143, "uuid": "c270f2d8-3033-4881-b489-7a6f70f4d5ab", "value": "74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c019cbce-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776446866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446866, "uuid": "33735cb2-19ca-41cd-b97c-5c8f264ccd2d", "comment": "Malware payload (ValleyRAT)", "value": "35300f285f5b7a573b38e1efcd9230e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446866, "uuid": "2c51cac4-7f2d-4158-899c-c9438ffe3da4", "comment": "Malware payload (ValleyRAT)", "value": "753e3923f63b122a65c886aac5932670d0dcd5c46a4cc4f5292da5c0dbea73ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446866, "uuid": "3a7ca25a-d59c-4de9-a9c9-b9a7a6b1c90d", "comment": "Malware payload (ValleyRAT)", "value": "177bd8f03ebdbcc3a10f2ce9c198829e29b49e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446866, "uuid": "f526bce8-1ee7-4dba-92c0-65f28594863e", "comment": "Malware payload (ValleyRAT)", "value": "d213a6f1d3177a218feb7458cc84074065088a5c1092c918350613ec949e75addde10a64c5a392c891b631290b40f352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446866, "uuid": "c3cf8903-0fce-4a41-ad46-62c0cc8f2ec8", "value": "T105060113B2CFE03EF4990B370572A15898FB77626527BD5B96E4849CCF264601E3EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446866, "uuid": "79826a3e-ff46-49f1-8c12-fe6b4589db5e", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446866, "uuid": "db81e3b1-0704-4740-88c7-d89199dc3eb7", "value": "49152:S+MRvHaXLY2/CHGfSrfjyiG4Ig70O0vaCngXqP/v67MZ2Z9ftchfudg87dqn7iMz:SrEqHGkGBg7/0vRngoX+MYchXqdnMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446866, "uuid": "8b34a28b-a771-42c0-ab4a-816676251f63", "value": 3930022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446866, "uuid": "eb282d34-cda4-4ebc-9b15-c3bca3574161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446866, "uuid": "6f3b8d6d-e45e-4a31-927d-f7b1beefbe29", "value": "35300F285F5B7A573B38E1EFCD9230E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9a31b3-3a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776409600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409600, "uuid": "ba076879-84d7-4db3-a755-46e15ef35022", "comment": "Malware payload (Gafgyt)", "value": "572ff35bd498c7ec48edcd0220c84bb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409600, "uuid": "eff29fea-1717-4770-bfa6-7a9bfe0301d4", "comment": "Malware payload (Gafgyt)", "value": "754e10f6ca0416cb56486737707c4451910bd0ec84022fcb2156330bd6a317e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409600, "uuid": "46dca8fe-5d82-4407-95f1-874b32629e4d", "comment": "Malware payload (Gafgyt)", "value": "a61d6f258b6e7fdcab530f15a49c842ed42b5592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409600, "uuid": "eb2a2c33-dbc5-4f05-b078-5086423bd070", "comment": "Malware payload (Gafgyt)", "value": "cac5be24c4629f60a026b8ee0ef85e37a5690dc4850d7a5e65826175e45e19f9e174eff582223f84224d93c6e50d2af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409600, "uuid": "c2e02fa1-2119-4f4a-b9aa-831d5c75e483", "value": "T1D6C30705FC404B27C7D23BBAF79E438D773666586BD733115A296EB02FC1B982939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409600, "uuid": "2bc59bf6-16ed-46b2-84b2-99a24d98ff7a", "value": "3072:nFDcpqlgQSnoHyOKwrRUSyV7nbR5hLN/vi8bewsojUQQRh6RYAvZR:RRUSwnbR5hLN/veojUQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409600, "uuid": "7ff3159f-710f-40ce-96dd-ae8fafa3365f", "value": 128413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409600, "uuid": "6e69d8d0-d635-4150-8675-002e6851872c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409600, "uuid": "c795f23a-8fbd-4a04-b606-aafd7500d40f", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e34c9f-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776435785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435785, "uuid": "3021358e-fc46-4a91-8965-6ab3c55f7ba5", "comment": "Malware payload (Vidar)", "value": "82ed7fa97046e77235ff82778f8cfb76", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435785, "uuid": "aae830ef-5000-4c9e-ab7c-c5431c74edeb", "comment": "Malware payload (Vidar)", "value": "7568a93e1a901de35ca8362f10e71f1ee3e0a8ecbe0ea15b8581e6c349507a33", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435785, "uuid": "ba31e2bb-bc00-499d-a8fd-2953d3c8c539", "comment": "Malware payload (Vidar)", "value": "4c911d1cdea176396ca450b2271ae5239a0e1db5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435785, "uuid": "59b050dd-f4b0-4761-991d-b88c4e9d25d5", "comment": "Malware payload (Vidar)", "value": "6f6e043db3522c3e00d607ba2a3791be6e9b2e5803bc9c3a709c1c371503282ec2a30181eda69f040a486034f6f44b89", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435785, "uuid": "b6979f6d-50c1-4452-bff3-a462fa9d3279", "value": "T150311F111BB10329EBF78F35D8BA2212BA257806EF219F9F0190525884B5521E4B6F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435785, "uuid": "800e3811-d474-4b8d-9b18-83a6138b6649", "value": "24:8z8dmGjMDvSwjKUaWU3AcPWkp+/CWvHp6U5Qd6y8thhytv4wZIr4I0WK6c/6CabY:86meKpUQXA/duhAd4w2UIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435785, "uuid": "7fa81d7a-1be4-4d39-99d1-86d7311f64d2", "value": 1841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435785, "uuid": "e68daf92-8934-4af8-b8bc-5888d6285844", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435785, "uuid": "c8d2c64d-6b04-44a9-ada6-0d634ace9ed3", "value": "IMG-773521580.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf12413-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload (LodaRAT)", "timestamp": 1776432015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432015, "uuid": "662680da-fe5a-42c0-8c3b-f48a4352b866", "comment": "Malware payload (LodaRAT)", "value": "1122a857a51eefdcb0781c14627ca434", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432015, "uuid": "6dba69c5-5ef2-4747-9599-db13582247db", "comment": "Malware payload (LodaRAT)", "value": "76dbff8597d2b8673b444be6ae19964dbab73ef59517e519581e292dd5d639d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432015, "uuid": "0be5e71d-f037-4a52-ab5c-a3492d16d7b4", "comment": "Malware payload (LodaRAT)", "value": "8fe36c86361eaee2be47fb38c2e61b56e748dc11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432015, "uuid": "62c4cf5e-68e0-46bb-bcd5-a32b7b63ce6a", "comment": "Malware payload (LodaRAT)", "value": "179f048a6d0eb9e4b2064011abce5c5dfa99075ba1485e58641c3b174aa807368a9b9d6cfdad5aefc6aea66b1f8bc39f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432015, "uuid": "97400309-4e2a-47a4-875e-eaa0860e5e8b", "value": "T1FA24123EC5D19031F6ACB77E2C2E0865D24B82ED9D1D17543AD06ECC71CC976029AAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432015, "uuid": "98f7ce00-e727-4bdb-81be-409e4d549814", "value": "6144:CDJsWIDOewt8Mo3DVLxkqECtALkO1bl/v1JxR:MJL6wt8M+9iqu5bL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432015, "uuid": "20f0e24b-884c-4c46-8ee4-ea40231b3de8", "value": 216527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432015, "uuid": "66abb3ca-0f17-4d74-9bfd-a12e2ef3347e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432015, "uuid": "9e23fec9-5654-4ee0-87c1-94728f4c9bdb", "value": "Confirmacion_Reserva_MACH_REF-0160426_Documento_Oficial_20260416.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095fc834-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776432386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432386, "uuid": "b81e08af-cc55-46fd-b050-7c35ed01f4c1", "comment": "Malware payload (PhantomGate)", "value": "54653bf7c0115070bd7ce826cc645c6b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432386, "uuid": "347e1ff9-2684-4451-a322-81d7284c7740", "comment": "Malware payload (PhantomGate)", "value": "7764a5d266884437a7072f58bc4bf9077f3a47f03061c1f2a61d67216a623803", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432386, "uuid": "e450edff-8597-4308-bb84-8a8d90051013", "comment": "Malware payload (PhantomGate)", "value": "58de6bc647a30bbfe2779ac12583ac26bcdb5b37", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432386, "uuid": "334083f9-ebcf-4970-ad04-8f68f27de20d", "comment": "Malware payload (PhantomGate)", "value": "8625c4cd142a9d8b11593ef85d10ee2e383440b92f8dd801b251346f68438e65c09b2d127f9a17af56fe964566ce0c82", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432386, "uuid": "9eff732b-df09-401c-873d-a6a46063d445", "value": "T122521DBDC9D1FCD0875B62D075ADFBC2104E9B07BE6A2B9CB5D815501B80358EBB928C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432386, "uuid": "5542210b-0237-49f3-b26b-f044dc852edf", "value": "384:wsjNt5magOJi8capEyFylWcBAcZGeQ5KDjsC5Kp0prcYFcrz:fddgGcanylJBFwP5MXO0pAAcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432386, "uuid": "ba74cc68-5227-441e-8818-456728e97522", "value": 13478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432386, "uuid": "b60199f2-452c-4149-986b-86a296e375c5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432386, "uuid": "d3e6e14e-ed7e-49d3-b9ae-afd8e5070840", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2062820d-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435002, "uuid": "69723ac7-ec61-4a28-aa69-3005ce654637", "comment": "Malware payload", "value": "b0838358e68bb8c83a97c68a1113b100", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435002, "uuid": "662850ad-d937-4ba3-9675-87637af38988", "comment": "Malware payload", "value": "7772251f9973041149d84c7bb096014b581be5e81948489c541f16576413e169", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435002, "uuid": "2a0863ca-a356-4425-8c22-8065b592ee3a", "comment": "Malware payload", "value": "29db74afe04b84d3385f6c1d19af4c9786869a09", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435002, "uuid": "438a721b-acf1-4625-925b-b3f1af3f75fb", "comment": "Malware payload", "value": "0dac85c00d0e08d2f522ceca98b6bc3bd40cad5ade3d4e1fb513d95235c99e46a9ce046a548a4bbf1014669ddf0ca8ed", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435002, "uuid": "2c7b4535-da78-4fb4-9537-7967ce85ae9e", "value": "T14F247C1A14F4A054B6B2CB21F9A124E26337B7E3BD95AC8DE0E4174D0EBB551A0D07BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435002, "uuid": "53a55cd4-ee53-41ac-8d41-7c860d955310", "value": "6144:u3Rneaww0YGLXsWgqClV4l16StPo+J7burEK78vxYjJSDC0aLPfCzggT+tA7KwmD:4eaww0YGLXs/qClV4l1fos/VK78vxYjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435002, "uuid": "3c355bed-6419-4578-8413-3f9e4bfcc59f", "value": 220410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435002, "uuid": "f5bdaef7-310d-4ba1-93e8-d8d516476108", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435002, "uuid": "1a516ea3-84e4-499d-9826-a0b398a7f6ff", "value": "awb_DHL_shipping_document_docsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43308e9-3ab7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776469637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469637, "uuid": "e344ab22-9738-4e75-94fb-ff12019eb300", "comment": "Malware payload (Mirai)", "value": "5e8f6124a9a803857d94de335d4a97dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469637, "uuid": "f2aa9ba5-e906-4039-b4d3-1bccf5d272d8", "comment": "Malware payload (Mirai)", "value": "779bd92f2bec1bed3a9f23ea36cf401a4914e890b58bbfc526b7d4365c82d291", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469637, "uuid": "d306dbc7-de30-4707-aab7-45d444181b3d", "comment": "Malware payload (Mirai)", "value": "63fcaefa76b5e881cc7ebcd3c965b215db03e05a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469637, "uuid": "6f93ccad-aa3b-472d-ac21-cc233603624d", "comment": "Malware payload (Mirai)", "value": "fedccc36f8358169c74a0010376f4072d8e7f15d98c546949f618f5b926706561f665732ddaecf67fe7b725ac95c6cf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469637, "uuid": "706a940c-6941-4602-b4f2-e252d54a7a3e", "value": "T1F5517E8933D54432EFB599B672B4D108B89050A77AC67E88DCFC38F8C48CE0A60C1B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469637, "uuid": "771d51cf-0c71-479c-9fdd-0862663c3446", "value": "48:ip7UpZApWkpuEpYIpagp8O0phAp+kpTspkMpGapqWpNopKd:iWoNJnxUgVCDvPs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776469637, "uuid": "11777a56-867c-405f-af74-f9bfddc9fe04", "value": 2824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776469637, "uuid": "af3a67cd-d85e-47e8-b86b-a65414b30f7b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469637, "uuid": "05c0a210-dbff-40d6-9943-f70c39e5be6f", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27144b91-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432007, "uuid": "9127698e-c8ba-42a6-9064-655ddd933965", "comment": "Malware payload", "value": "3246366cf9bf912be1a3b380c511dcd3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432007, "uuid": "a2d40e1e-cde5-4f2a-8f6c-88f33bdcecf8", "comment": "Malware payload", "value": "7871daf34fe9dba3eefcc4bf201af97cdcb360f213f71458d8e4a07f3bd553d0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432007, "uuid": "f069020a-a28b-4c48-af4c-fd27e24d4890", "comment": "Malware payload", "value": "d28c7787f06caaca1b9abe0e82c7674fa1c52532", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432007, "uuid": "7c43500c-b33e-4ced-86db-2b07f92fb04e", "comment": "Malware payload", "value": "99b75e09eca6c74e9c7fc04f532b0931044a01500f57e6cc18f74132bcc0cd956320eb6e675f4ebd313f50c8b3f5ce08", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432007, "uuid": "08d0d2c0-332b-458d-bc7f-f69e370fa283", "value": "T1CAD533215ECD5F7BCF2C867AE02B5E1D20A67F9C576894FE27AC70AF107962013A3518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432007, "uuid": "2e826b4e-9b47-4674-8582-a302d68fefe1", "value": "24576:pJ0GtfYV+ZwqH+O8w063tSXHUaX4FK+id6TMkapkpw5bcb0QGA4mzgY0ezXvKJGq:DXQV+6qkXwCdLkNEnXJ/hlIH4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432007, "uuid": "21164766-79f0-403c-bce1-828439cbe47a", "value": 2874368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432007, "uuid": "3c325231-b813-48e1-ae4e-acfacc39b18a", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432007, "uuid": "72b9acd4-8960-418c-a3dc-949b237fda99", "value": "Cipada.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a840e6-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1776432249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432249, "uuid": "776135e5-3137-4693-982c-dc2ca88ba079", "comment": "Malware payload (ScarfaceStealer)", "value": "00557818588917156e59f148fd9fff1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432249, "uuid": "b8bc0f9c-d0c9-4128-864a-14bca828257d", "comment": "Malware payload (ScarfaceStealer)", "value": "78dc791cce78490b3f51644fa3b8d70b6e37ee2a028b219cf93f8e8d8cdfae35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432249, "uuid": "3f83b7da-686f-413a-bbc1-44ca4324967a", "comment": "Malware payload (ScarfaceStealer)", "value": "219cb5cf8c1364a5e8b582333cc6cf00eb454a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432249, "uuid": "f3c94758-38fa-4480-a3ca-128056a30b1a", "comment": "Malware payload (ScarfaceStealer)", "value": "a2fbfea925b0766492b428ec03984c541017cb0fddd1747751371c8aaa1eec3f3a3f75018942953f0eae14bcfc556902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432249, "uuid": "9f80f180-ec2a-4eee-b1d6-a2aaefc949ac", "value": "T18AF612A629D552FCD4D78B3061435399B0D079AB82EAD98F3BC71C032A21DDB451BBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432249, "uuid": "d33f7712-9e5a-4025-b1ae-81bd75fb56da", "value": "88b0db23e8751b980a8c0afe8832019e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432249, "uuid": "9c2f6795-dea0-46f6-ab3d-4306a5c56afd", "value": "393216:5U86sijyXzA0LU3t8fnpL8C+KeSIjfeX+2O:5U86yDA0LS+np/lIjfeXhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432249, "uuid": "5e473da0-49e3-47bc-ba54-4e8212f665a5", "value": 15702016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432249, "uuid": "8c87af53-6398-4482-8082-2d51406eb375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432249, "uuid": "87c985a4-e0ae-4435-b5de-f06d321680ca", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472c5da-3a59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776429291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429291, "uuid": "c91e46b2-600c-43c4-9ec0-fdc31902bb41", "comment": "Malware payload", "value": "61a3768a8b437364330d417dbbe08e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429291, "uuid": "f0fe40e5-7fbc-4249-8008-44e4974ed03a", "comment": "Malware payload", "value": "792669a6ea78e8d8b4d999ca7ced78b3e707300742be7f1231c59e3c14fba2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429291, "uuid": "19086acb-b7b3-46d2-83f0-a0561a69cc44", "comment": "Malware payload", "value": "c17e5ba80f87f0db8e65fcb8cd1bf7cc653b15d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429291, "uuid": "7ce6d254-3e1c-4708-9b9a-2040cb9a40b1", "comment": "Malware payload", "value": "d11b5a3afaccc8a32be896069de69def19a78a5d5ed6ba606ec017feebc1cc8d69e21c306a1dff3203dda5fc3cafdd62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429291, "uuid": "6f862fe9-d36c-40f7-8fa7-64a10a85e1e6", "value": "T13DE4AE6B76478E20C2882337D5DB8901A3B565967563EB0F708813A526073FBDE5B3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429291, "uuid": "64fcced6-1176-4691-a72b-3306bb14ed4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429291, "uuid": "262c542c-1235-4e5c-ad56-1f0e47354fe0", "value": "12288:sd0TEGk3pnmMZa1W8oWre7i7QnCRXu/sJHeBnbO3Cb2DujhVHUQFp:sd0TSEBWcre7iu/sxe112DuNV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776429291, "uuid": "74b8ea76-169e-45c8-9fff-b9cc4db615fe", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776429291, "uuid": "f3365c95-4308-477f-b54a-9e0ebf842a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429291, "uuid": "46f06813-bb92-4279-acf2-f2217f5ab24b", "value": "c17e5ba80f87f0db8e65fcb8cd1bf7cc653b15d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85c492c-3a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776452061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452061, "uuid": "91c0e700-da14-4474-8cb4-4f2db4c6ba91", "comment": "Malware payload (OffLoader)", "value": "3838f62b7a2c84e654c3845893ffc5cb", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452061, "uuid": "940a3fe0-d6d8-43a2-950f-f65f0f67b6c0", "comment": "Malware payload (OffLoader)", "value": "7984f98ec3362bb30f16be57c07ac40b2ce0e4bddc90478a3646f33e02f73471", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452061, "uuid": "dfaef955-a8c1-4cb1-a060-acae5878bffd", "comment": "Malware payload (OffLoader)", "value": "260732c5f2ae9bd1aaa9ef731c2d232a7f97b794", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452061, "uuid": "68d50ea7-cda8-4a15-b05c-e2308b0fdb4f", "comment": "Malware payload (OffLoader)", "value": "d38a6d6ea9cd0d5a2e7b9e7d2f1114cd011e551a9b76984a5d882fff0197e1fe82c6cad33462f8f0b792b3bf67001b87", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452061, "uuid": "e6db8fb4-e1f8-4ee4-b2d8-fdc54d788727", "value": "T127E60237B28AA33DE46D5A3799B2D1A05D3B6E21A50F4C0797E03C4DEF690601E7F642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452061, "uuid": "cae73fed-ff98-4983-b7e6-31dacdbeee97", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452061, "uuid": "2ea28534-a7ce-4e0a-a04a-6f52b589e9e3", "value": "98304:mN66AUKFDPtOLdmLE6wipp6QPj0I2J1VKPJwZCp/uDVweBCDD1wg3:2PKF0mLE6wippHgI2LZeWS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452061, "uuid": "032d7eec-0149-4c1d-bcf4-9745bb260916", "value": 14855520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452061, "uuid": "30ed9767-21fd-4158-bdf0-3140e5ac4f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452061, "uuid": "5c57791a-fce9-4c9a-988c-4a39bb9f640b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916c9767-3aa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776460961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460961, "uuid": "7b520890-de5d-427a-bf7f-d2ba46d6ae0c", "comment": "Malware payload (Mirai)", "value": "a2d148d138555c93abeeae9f48d1da52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460961, "uuid": "b97a48fe-9a5b-40e7-af3a-21775fc598d3", "comment": "Malware payload (Mirai)", "value": "799d2768f37ea03402ad0eeb625789f5518c71029828d095e77538073ac18668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460961, "uuid": "a08bbb3e-1c57-4aab-bb87-fa7c99297186", "comment": "Malware payload (Mirai)", "value": "466302454e4d8caa8941e52d9fd2bf3a69f7e1d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460961, "uuid": "86c9c3fb-ab47-4866-b25c-1506537f63d8", "comment": "Malware payload (Mirai)", "value": "094121159eb7a5b70882e0d8247b325fc80b1e10bb4355397a75175c0d10a945643dd0e5ef701bc38ce17d59192d63c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460961, "uuid": "ffdda6ed-0883-485d-93cc-1b6ff7b0970d", "value": "T116142B41F8919F27C6D522BBFB6E418C331B27A8D2EE72078C255F21778695B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460961, "uuid": "af5a6cf8-fbb0-491f-bb78-65cbf5e23705", "value": "3072:tPGpRPevXG0IphuDGs5lm/nwA42EocmUdoj46kxn:tPGpH0/DGsSwA42lcZaj46s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776460961, "uuid": "c3cb23b1-1542-4084-b980-b39ffd9f01c2", "value": 194848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776460961, "uuid": "873bf9de-8ad0-4593-b08a-a7154cdbbef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460961, "uuid": "569f31ac-ada9-443e-97a1-2a1bb356117d", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ea171f-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (STXRAT)", "timestamp": 1776435249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435249, "uuid": "b08a8bc1-859e-4456-b29b-4c4d9953ab59", "comment": "Malware payload (STXRAT)", "value": "073607628f8428222d381c1f53d37da4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435249, "uuid": "91618331-2c60-44ad-abce-e9881289462f", "comment": "Malware payload (STXRAT)", "value": "79dada86c51334b2a98374a7d377a5f629caeae83f3736d6d5dd097218b67ef5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435249, "uuid": "efc7fa32-be61-453b-897a-082fd2bf0682", "comment": "Malware payload (STXRAT)", "value": "b6e95572a2deddddd38ced40d358b51efff46f3a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435249, "uuid": "3d08eea8-4296-441e-8e12-16f4837d0b86", "comment": "Malware payload (STXRAT)", "value": "25ce1d4f20baea3a3601defab727b1cb67b5e6073917ea24fc6682e5feaf64f46d4f70fb136ea4f4938e045489a152d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435249, "uuid": "7280496d-b660-4463-903d-c4c40fe0f7ce", "value": "T1A4F1820815ABF28EFFA5A06A8DBBC02CF61D25C3CC8677CA76CE51CAD35074BE952154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435249, "uuid": "3ee8fa98-bba4-4c34-8302-b5addbc2053b", "value": "96:keHPunGa4npoxGfQf7U5BRcUqwPCaHGHpz:nHrpoxGfQfg5r7qaCJHpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435249, "uuid": "ed753146-7192-4888-a007-cd88a6911081", "value": 8127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435249, "uuid": "14b7bbe0-4dc5-45c4-a554-374215852d4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435249, "uuid": "44a92b4a-1bd5-4184-9f55-7f21a8fcaf23", "value": "GoogleDriveSetup.exe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6bf571-3a84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776447696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447696, "uuid": "c48fd0e1-e292-46b3-b4e2-241a47bebc5a", "comment": "Malware payload (Mirai)", "value": "39166dc0e9f4d724fa3efbfeec118043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447696, "uuid": "2e8cfaf2-8ffe-49d1-9693-f3cd28d8f7f0", "comment": "Malware payload (Mirai)", "value": "7a4bdeea32e0fbfa22858a6019b6cc4d862abb0b8769ae93bfc8b32c3fdfffc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447696, "uuid": "0941d296-f6f0-4ccc-8c2a-9c3f411ef579", "comment": "Malware payload (Mirai)", "value": "b1823334c8e2e5fbc57799c2177db4fadcea8e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447696, "uuid": "e0844e43-47bb-491d-8ba4-f8c62fbff2ca", "comment": "Malware payload (Mirai)", "value": "ebad439257c521ce9fe4070a2994bb6233ab2fc25119712cb73c2b937ebb0913e79e3a6581b6927550c12b59c28357bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447696, "uuid": "f9818b73-30ff-415d-a6e0-eeab05b68b9e", "value": "T1CA142A45F8818B22C6D412BEFE1D018E33272B78E1EE72129D245F65778B97B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447696, "uuid": "5b1bea8b-6c25-4b0d-8456-603c3c47eb74", "value": "3072:Ufli5issSC0qbiXdeFbX4cNUjN/2dXHL4jj6aGRMCBc/S6aSoDwfN/m:U+HqbPXfIgdXr4j+akzeS6sDwlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776447696, "uuid": "4fd44366-f104-4150-a52a-8e85729a3e3e", "value": 203676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776447696, "uuid": "b2e637fe-3490-49d9-bb2a-ba8b1574ce4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447696, "uuid": "b51416f5-1b45-433e-a3f6-28e1eaf678e2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3ec5b2-3a49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776422189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422189, "uuid": "a48be64c-3c83-44c9-b861-712ed0909eaa", "comment": "Malware payload", "value": "f38c845c7242240d3fb460f3f68e90c0", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422189, "uuid": "d0dd437b-fc3d-429b-89c6-ad0c280970a6", "comment": "Malware payload", "value": "7a8bc01c13c950f835b280f56628a0bcae6aef4967b0f80253e00ad66eeff3a4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422189, "uuid": "5e5845f9-8869-43b9-a041-f2162bbc92e5", "comment": "Malware payload", "value": "2ad5ef0013bbb9941e84671d39f4cd17730f5be5", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422189, "uuid": "fc5632a4-4cc2-4c00-ab0b-bb95f5081aa5", "comment": "Malware payload", "value": "8cd48ce70fb7b34bb6177bcb3b73b62c731f81bc236236b3c659015123c64002d199fe80bb55df421af27e4fc598e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422189, "uuid": "6cbf0d41-4508-4f69-9155-d3c0eea66bfd", "value": "T116524A5285285803DE969D70A2D8EE17697D73832B5086D7272CC4012F837E2B77A2BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422189, "uuid": "b315c98c-90eb-470a-b17d-799209cac07c", "value": "8f807f5d16a7d2b173533a187d77dfcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422189, "uuid": "910d1fa0-da70-4d55-b6ce-848836e5f81b", "value": "192:UqMVoPghXDEwXEhYCTzOjVS35IVnEy2sE9jBF0Ny1Nn4dd:UqMV/yh3XOjVSJIVE8E9VF0Ny1N4dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776422189, "uuid": "8cf63348-958c-4d75-b9c7-cac594cdb795", "value": 14416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776422189, "uuid": "315f4205-31e7-4b04-8bd9-4f2f5e2c112b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422189, "uuid": "95876638-7966-40e6-98bc-5b5d973ecedc", "value": "WHQL-20250629.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21138afe-3a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776451324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451324, "uuid": "e65bc358-fe38-434f-86d1-671fc699b7ee", "comment": "Malware payload (QuasarRAT)", "value": "4f84d69b2aa2bd1043dc8f4b31d89ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451324, "uuid": "5eada5ac-1fef-4a20-88e1-058e1c44c79a", "comment": "Malware payload (QuasarRAT)", "value": "7b50a77b13d232c264a0b2e0ade31332289b641637113f80677934f1bca688cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451324, "uuid": "138d0557-db1b-40d1-9c1b-b95888d2283c", "comment": "Malware payload (QuasarRAT)", "value": "03000f34e44d4eb366e8ab998c0a6e5216bbebdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451324, "uuid": "b3c52f67-2711-4fd0-a69b-db25b561ec5f", "comment": "Malware payload (QuasarRAT)", "value": "72f59d073f9258f7be41a12e09fceed735260e952ffd94959156bbe61f940c8b9dbbfe6729f5487b325ed9931a77358b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451324, "uuid": "09e3d9f9-35d9-4a25-8206-6e6f57446896", "value": "T1C3F52B44AFF4CEB6D27BF272D5B0A0F25BF0EC19A353970711417BEA28637454A0266B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451324, "uuid": "9b5e16f1-52ae-47f9-a210-433239dc0bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451324, "uuid": "f09cb46e-9e74-4812-b080-58b058e9e164", "value": "49152:2vFst2zlaWX6bPmlccBGyQxE3fFCRJ6abR3LoGdyLTHHB72eh2NT:2vut2zlaWX6bPmlccB3QxE3fFCRJ60C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451324, "uuid": "8b555454-2c2f-46ad-acba-66735712a417", "value": 3531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451324, "uuid": "e0f238bb-2619-461c-aa17-4e9600f735e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451324, "uuid": "9d28ff83-f18a-4c09-971c-5716e96c5757", "value": "StartMenuExperienceHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c605eb-3a2d-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1776410154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410154, "uuid": "9aea1e17-f47e-4b90-ab4b-d2d3ee2dd568", "comment": "Malware payload (CountLoader)", "value": "081a0d272e15efc23ddc62f70c50fa89", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410154, "uuid": "379912a4-05ff-4d61-9650-282e28083c16", "comment": "Malware payload (CountLoader)", "value": "7cb52d7b45182009d838921135129aec2c858d14a0df01da25341bf7cf3425ef", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410154, "uuid": "ccb9f79b-4922-4778-88cb-1bd1f0718b71", "comment": "Malware payload (CountLoader)", "value": "6bad5e1db7609b6318cb7b200482a44b40bbd14f", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776410154, "uuid": "12721c45-9fe2-415e-baa4-246ef57be977", "comment": "Malware payload (CountLoader)", "value": "cd8ac9e91777e56550c53426e213b39c3771482b87930b6a9a15d25fea32eb6b4b2c180effdb2fd961dc2aace32a7462", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410154, "uuid": "35d07b5e-7114-4d31-9e8c-f54d9101ed66", "value": "T1E1D3BD8E4A8E98EC8B5F7428451F5C03D96E61130B5EC990BEDEEF517F22D60B4A74D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410154, "uuid": "30894c75-e881-4380-bb31-f85afe6d0f3a", "value": "768:QkJZrtAm3crqmeXHSx9zgAAdKzsrSGNFqN+kBe0b5iKWP27t2K+jA18qLLEOBI20:3D6NHrb91HTtysThi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776410154, "uuid": "8a0cba94-eea1-42b7-935f-2503c8a3832c", "value": 138282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776410154, "uuid": "45e94fae-1d6f-4bc0-8bc1-5de9a7877fe7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776410154, "uuid": "c116d249-4c2d-49bf-9442-07099019feb7", "value": "Client_Video_Temp_5361.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adacb78d-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435239, "uuid": "05d66e67-ee60-48e3-995c-ed9881d9948f", "comment": "Malware payload", "value": "b45baad1a2ebca118034b0921284391c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435239, "uuid": "7d0e7fad-4bde-4ca5-88b4-cc7e7b50c77c", "comment": "Malware payload", "value": "7cc07090450b69e391cc029190f48d1374f929ef3548a26653a416e7656278a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435239, "uuid": "47c48d0d-d65e-4bf5-9a39-b0dfe2d07e4a", "comment": "Malware payload", "value": "2ad2be2e15dc60d4e2ef0796e14a82cbbad49187", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435239, "uuid": "023e0d3b-a469-4e93-a9d0-1c9ab032bc86", "comment": "Malware payload", "value": "1ee4fcf5490884f272dab6ba2dbac4473388a8c711efae64552f4b3c694c28569c7ac9f149c4a5bd70741761a64efd8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435239, "uuid": "82735333-770a-4217-bc2d-3507c8e24385", "value": "T1F1643038AEEA401AB173EF54AEE47497E92FB773370E589C1081038A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435239, "uuid": "2b8ac442-2ac6-4350-99a8-4e2fea27c163", "value": "6144:FSO10Lmpao6+WsIqZJoiuq99AJwqJEJJiZxeMxWyq2H9bWnZyCegsKzSVTomLh5X:R4mpao6+WsfJoiuw9HqJEJ4ZxRYZaUsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435239, "uuid": "dde8f026-43d0-4550-9cb6-f2fc0d520671", "value": 307892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435239, "uuid": "466f3733-d06a-4c22-a04b-4c04cbaa398e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435239, "uuid": "f7e25853-a46a-42d4-aaf8-cd991405c263", "value": "proforma invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf90148-3a6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776436523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436523, "uuid": "62a55289-00f0-4a74-b741-eb9600c5d836", "comment": "Malware payload", "value": "016d254c80ba17a6ccc5414666e21a27", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436523, "uuid": "d610200b-c385-4ae7-9167-b1739b5a3d71", "comment": "Malware payload", "value": "7cd43a5c899262c6e9039c6f746682ba30ddea98cf562a9ee8551cabe98f1b9b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436523, "uuid": "8ab259fe-1f89-43a5-bb43-e1bea91bc0f1", "comment": "Malware payload", "value": "b573d557e88d3618657e145048fe305ef3368f84", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436523, "uuid": "499528a9-27d0-4388-949a-5d13bb705a95", "comment": "Malware payload", "value": "e5b8981ecb99358dd7fd27f3c61b6c613b74641fb0c873994b96b2d103bb541857a20dc4fc73b2226b936c054691d6f5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436523, "uuid": "44b537e2-c8d4-448a-96c8-493e108b01bf", "value": "T1CFB58D0BACE518E6C46E97328DB666927B31BC490B3223D71E51B6783FB27D09C79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436523, "uuid": "d72f227d-2ba9-4088-96a8-3f66ceaf6977", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436523, "uuid": "76830249-06fb-4816-b9e7-220a39e9c725", "value": "24576:EbF3gcLa3Qr1U6zpHbwEI2CRnnnmnnnnnnDn2d5W30kVymTTzTUjGqlkP/Ts4gnQ:EbBXLa3Qr1U62EIZbdI3ymPzYGqlSHqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776436523, "uuid": "6a9ed96d-32ea-496a-8328-8cbbce0a4d7d", "value": 2344664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776436523, "uuid": "aaaf4239-ab86-4af7-b8a8-f7787ae918ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436523, "uuid": "73654e83-46eb-42e3-aa79-220780b63a6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdcf612-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776446727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446727, "uuid": "eda948b0-274e-478b-9388-c6897f854dfd", "comment": "Malware payload (NanoCore)", "value": "812042ceca75b04559da5d319464fa6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446727, "uuid": "ccbc50e6-7d3c-47dd-b217-2066e013cb78", "comment": "Malware payload (NanoCore)", "value": "7d4fa8546533a2bc077b20560cd7c32bc240c456c9606478f6253372e48c07fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446727, "uuid": "52fbc13a-ae17-43e2-86d1-49f9b8c23f97", "comment": "Malware payload (NanoCore)", "value": "cf640a0ed2e052f95025bc55ba23e9a5a0a11bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446727, "uuid": "df66a1d2-6b16-48ea-96e8-960aad59327c", "comment": "Malware payload (NanoCore)", "value": "da3d053d10b4f371d6ab51a545fa6da08382c0e1e9371246ddad7c410776c07e6a5a18b6ed747bf811a8ae733c1bb097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446727, "uuid": "75214b87-0a0c-4bd5-b480-b24c1954f96d", "value": "T10814CF1677A84A2FE2DE85B9611202129379C2E3A9D3F3DF2CD451B75F267E14A0B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446727, "uuid": "ba26c6a3-2905-45d3-93ad-3da5a0d70572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446727, "uuid": "ec421561-44df-41f4-b68c-2890c514eacf", "value": "6144:sLV6Bta6dtJmakIM51RytPfyPxvc3sNrq:sLV6BtpmkyAPKLNrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446727, "uuid": "411e5c5b-46b3-483e-a83f-e6fab2e168a6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446727, "uuid": "3eb5e888-51cf-4977-b93d-6659b2fab2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446727, "uuid": "70e19f35-5acd-46e2-9748-865a6b84e1a7", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd68050-3a21-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776405200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776405200, "uuid": "5176b406-f732-4511-882f-c6b0874ebda6", "comment": "Malware payload (Vidar)", "value": "1ae75df0464bbcc6e478c79165a58625", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776405200, "uuid": "6cfb06de-959c-4462-8cc5-f09855d8c801", "comment": "Malware payload (Vidar)", "value": "7e3eec7862a0dce685ba9466bfd9d4510d2ddb25801410319407787cbe685b1e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776405200, "uuid": "53d8432e-25dd-44d3-8d47-7953d5c55236", "comment": "Malware payload (Vidar)", "value": "a33ffd81f97673acd042916db324e29c8b819853", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776405200, "uuid": "b3204115-8390-45d9-b6ee-92c27be8b366", "comment": "Malware payload (Vidar)", "value": "19f58ced501afb8e4bed7ee78117d662f617c98ce60ba8db4193271ef999c1996050dedc06f592d549c658d1b3501937", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776405200, "uuid": "d90803e1-5857-45ea-bd7f-af020b665d16", "value": "T110754A1BBCE008F6C0AA9332896665917B71BC450F3127D72EA0B37C2F726E49D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776405200, "uuid": "909e7c1e-5e3f-4c16-98b0-38b934614388", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776405200, "uuid": "d8d72b7c-02f1-48d7-93f1-c67f88614b47", "value": "24576:J0hJZ6DDv72kJMQhCzKMUFv/QBele5zKD9/no13V0btCWjZun:J0PZODKk2QhC5/2A13zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776405200, "uuid": "7919c37e-9951-44a1-9129-183207720afc", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776405200, "uuid": "3a0a00ed-1373-4ec6-b149-57de4a5ef87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776405200, "uuid": "f068433d-5f26-49ad-8d55-71cc64fade7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e04d03a-3a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776407725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407725, "uuid": "804d895f-a730-4d4d-8cf8-70bfdd75868f", "comment": "Malware payload (Gafgyt)", "value": "337a7d521f917c932f21683d91a76978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407725, "uuid": "7ba9bfa2-d273-4d14-8ed4-27deeb63f226", "comment": "Malware payload (Gafgyt)", "value": "7f289f4031b5f7026895b5e5d6355a3debf2bff536a4d3ba1b64b971a01fd0b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407725, "uuid": "af25316d-c02c-40b9-b0f6-40cd36d052d5", "comment": "Malware payload (Gafgyt)", "value": "347b2b9dd38ccdef3bcf93177d90940c30cce6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407725, "uuid": "6245e9a5-6aea-4ae2-90c8-11fe9992a89c", "comment": "Malware payload (Gafgyt)", "value": "0f455410be6b1d182eb7241713aafd52f56c2ab0dbdf5a48bc517961daf23bcf04c1d6d49b8c2addaf5a98f370117cec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407725, "uuid": "851a8c24-092c-4f84-adef-107a60ed6de6", "value": "T1FAA35B86D643C6F3C4430AB1126F965A0632FB3A4E3B8EAAF71C7CF49B129D53115792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407725, "uuid": "ea7aa7e0-6e57-47bc-b582-37cf04d5fb4d", "value": "3072:KR3TUPKBVjBW/EZbb29akWbjN1Uh5hETeRrXnF0OzTyoQQub:KdUPKBVjBW/EFb51Uh5hwehXnF0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776407725, "uuid": "392426ba-4901-4634-a166-a98e2ddc9155", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776407725, "uuid": "4dcb222d-1045-49ef-8ac0-7770ffb5fe6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407725, "uuid": "a7c1a2ea-2989-44ee-bf7b-19c227c67ec4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fde973f-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452342, "uuid": "dcd471e0-f067-42bf-be0e-b6eec4012277", "comment": "Malware payload (Mirai)", "value": "8df7becf61b48e0a948af888ad7cdfe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452342, "uuid": "745eb153-ea24-4909-b50b-9ae6640f32df", "comment": "Malware payload (Mirai)", "value": "7ff8dce98fe2c1f35b540c053c29fb9101a1fba4a5c79fffa84ddf600eef8fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452342, "uuid": "c0503066-2a03-42f7-9cc7-c0fe9e28651a", "comment": "Malware payload (Mirai)", "value": "70492b577456552d305d9a695fbcc3ee98de6e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452342, "uuid": "a0d2f5d4-a119-4203-af77-90d35b5da458", "comment": "Malware payload (Mirai)", "value": "c9fb929fd2ea1286a3fac5de50ba33b6a0b53dcf150067a535868f678c4fd9ea46fba3ee64d76e782073ac9c96364c5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452342, "uuid": "f801f222-4c56-4d41-be2f-13f77cfddd90", "value": "T1C3356D2BA2B3B5BCD007C03457DBCBA25931B43526312DBF26C4DB352E65CE06369B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452342, "uuid": "3030a45d-419f-4e3f-b151-a189e984f9e7", "value": "24576:VpHdFJNgsy1S3QdFWPt118xzoQyggOLV+q:VpHvJNgsOrWlH8mQtBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452342, "uuid": "b4c13984-9524-4e08-87f5-e2142d1b6d80", "value": 1100136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452342, "uuid": "fc047f91-9c2b-4dbe-988e-525ef0148120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452342, "uuid": "b630247e-3438-40ba-88db-595a79924e64", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b405e21-3ab9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776470185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776470185, "uuid": "bea22409-c3a2-40ae-8bef-e18723141688", "comment": "Malware payload", "value": "135e27d780736361914d616b37564ea4", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776470185, "uuid": "06bf5bcb-f99a-48ce-9511-025a5288b0d0", "comment": "Malware payload", "value": "82236396a9c383d2d055e14beb0773aace03be4cca00647114b4603864aaeb17", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776470185, "uuid": "1c7857f1-b8f3-476c-8a44-b1b4b8ca1e1a", "comment": "Malware payload", "value": "954abd0849a98e49340e4462a8a5a0ae0cd33543", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776470185, "uuid": "3e4b3519-9a0f-4458-aef4-e9a1dea2ac38", "comment": "Malware payload", "value": "eb3a14510d537a0803b1f503494dbb0037ddd67088a72f02824997374fd3a81d28959a89ee8cfd6778aa43181f644b9e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776470185, "uuid": "91aaae9f-a98c-4528-9f9f-9b6baa1954c8", "value": "T1D7D3DB8ACDEE8CEC8B7F2038415F5C06CB4EA11B051DC544BEDDAD953F22961B1AA7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776470185, "uuid": "e8632bb4-f4e3-4f8a-9f76-3ad5be2d879f", "value": "1536:boKUoECEFYPfcnJ0kKShD9ClJXbAWGQo/2nW:boKUo8OPUnWXbAWGQo/2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776470185, "uuid": "de703548-1d70-41e6-be79-fd21e0b8a904", "value": 138109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776470185, "uuid": "774fd1ea-8f8c-4188-835b-9d5e5056017c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776470185, "uuid": "d41b7ac0-261e-44c3-a7c0-70482642b3ad", "value": "Snapshot_Monthly_v6.0.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea15d56-3a51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776425899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425899, "uuid": "737ebc10-bbb2-4804-ba6d-be0f2d113e7f", "comment": "Malware payload", "value": "69cf6ed0707291bb22ea20f142bd7966", "object_relation": "md5", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425899, "uuid": "766dbd11-c5d5-4257-8002-440d47c7d748", "comment": "Malware payload", "value": "828f697a02fb2075007a437ee3eb0170ed3cac706fa61e945d8c78b2677a0257", "object_relation": "sha256", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425899, "uuid": "ceeceae9-51da-445c-a6a8-a1be9f42a465", "comment": "Malware payload", "value": "021b31827aac91199b1e17fedab5921444cc0f30", "object_relation": "sha1", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425899, "uuid": "135f4838-f5fa-4710-877f-14c0034e3f7c", "comment": "Malware payload", "value": "bda2458bdb2d851c44974d5d46b7f58add4e13413d449da0d9a091da53bd1069120ca01ff7910834f3141fa86d73ff16", "object_relation": "sha3-384", "Tag": [ { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425899, "uuid": "9a4fc508-4fdc-4fb2-92ed-72d9a531c762", "value": "T1311365058EE39D147377B0A1E6CE64097A9B40C74F4BAE243C4D92AEEF52774A1F46C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425899, "uuid": "0b32131c-7a7f-4019-82ba-832e8a088123", "value": "384:J0FINvSo5o/Dw6Ioq47z2YEEFXBxBfZ4zLZP1hncu/tpbOfvuy/97M8T:OCn6Ioq47z2YEmXBxBshvbSZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776425899, "uuid": "5fe85828-8da1-4960-8e90-b4ae040751f8", "value": 42574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776425899, "uuid": "3042d268-5b99-44f3-bac9-e1abc3629268", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425899, "uuid": "6a2223e0-0e47-4016-ac11-2970ea3fdf9b", "value": "bot.pl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9641374d-3a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776424892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424892, "uuid": "0ef2b6b5-3ff1-4d16-8737-4bcb8eeec4ab", "comment": "Malware payload (AsyncRAT)", "value": "03d998d0ca126ffa4947b7512c4b7b36", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424892, "uuid": "9c7e9863-f93f-4fe0-a6fe-bc09065fa692", "comment": "Malware payload (AsyncRAT)", "value": "82f28b2ecc7158d827089712f84c664c124aa94fde9ea353608b22ee110d73d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424892, "uuid": "82935e5e-9aa2-44a1-b60d-1158f161cc03", "comment": "Malware payload (AsyncRAT)", "value": "38432d9f1a3b9bf9b1c8538d611dd3722a33c16b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424892, "uuid": "0da73e06-cf98-441f-8645-bbf97014b1b3", "comment": "Malware payload (AsyncRAT)", "value": "5e48ef5e5523c0491cb746e1a9cd706e46fb683238a10aff61bfe7f4cafafa354bc7d22f542950af482b70451def8b2d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424892, "uuid": "fed12ca9-6817-473f-9185-f56f0e72246d", "value": "T18EF3C4698FEBB242C59645747C7363814A395F7994CF75168EE33FEE0BB3C9421220A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424892, "uuid": "a62884f6-a9e9-43db-97f4-b8ceecf38a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424892, "uuid": "dada1927-7b07-462e-a34b-88f905f5b454", "value": "3072:MUaoSnb1Lb8BODp04NpVq8BxFRzaqF+o2GQJ7/JzqVfGvB:M1ogbRb8U0gVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424892, "uuid": "533ae4b3-edfc-4b92-bdd8-d4a60d54cb17", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424892, "uuid": "0013ba90-bf46-4f46-9ddb-48945c26eaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424892, "uuid": "3011e54b-715c-4e23-b29a-c75af1a41f0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a7f6cf-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776434395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434395, "uuid": "4ece30c0-3a4e-4dbd-96c5-6bd790941f4b", "comment": "Malware payload (RemcosRAT)", "value": "4fc1099d4df778ae584ebc5eb2e95849", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434395, "uuid": "bcfba389-e875-4431-b6f6-faba4cca09b0", "comment": "Malware payload (RemcosRAT)", "value": "8357d5620f2991fa16ae60944e9080a064fa2eed089839b754f8ac7dff0c8bd9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434395, "uuid": "41e9aef1-0b95-4b17-ba7d-1304a6d9dafe", "comment": "Malware payload (RemcosRAT)", "value": "7d773a1e8933267ca324918c4d4517280e378c59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434395, "uuid": "e1103f6e-f58e-4859-a40e-27f2aede56b1", "comment": "Malware payload (RemcosRAT)", "value": "c4185c7ac42198eb199b19c3fa207af646c2b2b2c3fd4c2991449cf701942aacdc8f78b5f498efb9a7930f4ee4a2d85e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434395, "uuid": "ce27c92d-0186-427c-927c-cb7a75199f87", "value": "T114D4790745C114288D4A86D8EB8A8489972FD2B35F6CCF5935F373A32B906FEBA74C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434395, "uuid": "34e99dbe-2423-4298-8826-705ff6c5fc7d", "value": "48:CrmX/vLQlrdSsdync0lWcdNDN445eunuqG+oElCKd3uwn+3d1BncLBKU6DDNgV3f:CoKBphRPQP7GPt7KXi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434395, "uuid": "66afa462-16ad-4623-ae99-9d14e091ba32", "value": 613056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434395, "uuid": "323ea6f3-6427-4031-83bf-fc19c67af94f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434395, "uuid": "272359ef-f8cd-45d4-95ab-85ce27118fa6", "value": "Upit za transport Kopar _ Prijedor BiH.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c78b34-3a59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776429345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429345, "uuid": "73a08492-afd6-4e1f-b1cc-7437bd48e664", "comment": "Malware payload", "value": "ac3414e97392c7eaf24cb1560e6e51f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429345, "uuid": "270837f6-2159-4d1b-9f1b-0c23b7e5a9c1", "comment": "Malware payload", "value": "840f83d4272b30a07e1c946d2ff3522e8a0489cca46a5efec59c2b1a58cc032b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429345, "uuid": "786ef35e-acfe-4096-abc2-502887f2e471", "comment": "Malware payload", "value": "8e3f1e5fafa090301c54a8f618d1cf70d0f2d84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429345, "uuid": "1e91acdb-c796-4542-b9db-9e7b2f5f5d74", "comment": "Malware payload", "value": "3337e827fbb64b3b769b2c748b46ccb424008c4a0bbeb4b63ea2206a8d5988c8e1501c1323c4714dec2b7f607eb99e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429345, "uuid": "6f2b5401-0201-49a2-8131-e8339a57f269", "value": "T1E6641F38ADEA001AB173EE55AED47497E96FB773330E585C10C10386472394AEED963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429345, "uuid": "34657964-0a21-4367-9e46-0ae2353cf9a5", "value": "6144:jPMiF1NEkoqFcx/Mi+u8QRn/sDddJ8Pualaso3LXQ:LMifNdodxEi+uFnWdJaOLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776429345, "uuid": "db4a0440-bc1c-4e2f-880d-c90b9f8d2a1e", "value": 312014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776429345, "uuid": "1caee01e-31c2-4f5c-89ef-c9b0feef91e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429345, "uuid": "bf858593-07cc-4276-a611-e41a6853bcdc", "value": "Request for General Cargo Quotation \u2013 CI PL Attached.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ea4622-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455860, "uuid": "12115d00-f00d-42d6-9e6f-a9c021573488", "comment": "Malware payload", "value": "e5952b2445f079f2d4b871925fb2af63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455860, "uuid": "27aff8a4-7e28-4a47-b9c3-69cf753940e0", "comment": "Malware payload", "value": "84e02800167a3202d85cfa3100ddf7f7283b76b2f4f045ff912ca2a1148e032c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455860, "uuid": "12b31904-b269-43d4-beb7-b5a3da939eb4", "comment": "Malware payload", "value": "a0df4036c8103893ac9374ae3e22abdc486597cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455860, "uuid": "9acc7276-b3c3-4e16-afdd-49559a9f6de0", "comment": "Malware payload", "value": "7875adb489ce8e78af41ef2c7f7c301dea9c02669b1dde9422816b2e78f6c3ba48c54caa601df29654e986fb69198540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455860, "uuid": "f6a1eb33-857f-438c-b148-b46e8ba36f7f", "value": "T18283C6197F714EF7D8AFCC3756B84702309D6A0622993BB97874D518F74A88F06E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455860, "uuid": "5c87c482-d441-4c0d-bf13-7c37c7a26305", "value": "1536:nAX0JCHVyFgaGRlbpmF6TbYTkqzDZayufO7h:n1mEobpm7zDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455860, "uuid": "e22fb943-e518-4a0a-83c5-b95fc8703d50", "value": 80936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455860, "uuid": "657a2937-98c0-4ae1-9ac6-299be74f3ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455860, "uuid": "edebdee1-e975-4584-8a62-a1d1d386565e", "value": "rhombus", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e447cb2a-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458523, "uuid": "8a2d5dc3-bf25-42ef-af12-33d2eebe09b0", "comment": "Malware payload (Mirai)", "value": "b1ee5ecdbec420fd71c0831ea087ff9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458523, "uuid": "1bbd735e-addb-4550-a608-46ee947c9e9b", "comment": "Malware payload (Mirai)", "value": "84ed97a13a82a82231c5fa8bcd63d895be9e06d1f1857460aaf6ed46a28ddc80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458523, "uuid": "d3e17a8f-f82a-4094-99d8-e6dda58ec3f4", "comment": "Malware payload (Mirai)", "value": "7e5a75c535d67592119d81c22d0b355ebb9e5bdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458523, "uuid": "9deb1388-9bda-4db2-9493-01af747c5656", "comment": "Malware payload (Mirai)", "value": "87ce589e656b2fe51c6bc668327771f74066e3111ebcaf25fc934ec07971cdc2a139967fbf4de6d00bbcaeec5d02419a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458523, "uuid": "6b0b6816-9e9d-4132-9b93-2b2cbf752e48", "value": "T1A3B31946BD428B13C5D231F6BB6F458C371697B9D2EB3102DD26AFB0278A4D70A3B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458523, "uuid": "9e3c3a1f-def1-4b22-8c94-97d9f0151b54", "value": "3072:Nfc7KJAn64ZpeDD2lQeAH9KFCoHQ+uUkQR1BL:Xtee9KFZHQYJR1BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458523, "uuid": "8e41a908-ef5f-42c5-9c30-0cfe2d235d19", "value": 111064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458523, "uuid": "acad0e6f-e334-4007-8072-7b14036b692d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458523, "uuid": "99b1d68b-6814-4a74-856e-6fdcb358fa77", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421d44fe-3a5a-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1776429475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429475, "uuid": "e56d1d4d-f290-4335-9f25-21695708118c", "comment": "Malware payload (GCleaner)", "value": "ee8ee0017def162a9056e8d7069dc4f4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429475, "uuid": "770c9924-ac9c-4208-a5fa-00228322fca2", "comment": "Malware payload (GCleaner)", "value": "85eafddddc17a03f7be9261b28ab49b2566cedf9d0b96d22d27f758b22cae828", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429475, "uuid": "94fcc0f0-aa7b-4ae9-9c05-2eacae9ec927", "comment": "Malware payload (GCleaner)", "value": "3a5a43c81c6c48ef30a0316d90ccd0097670a5ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429475, "uuid": "61da63c7-e684-4a4a-8be9-d0dcf6e3fd76", "comment": "Malware payload (GCleaner)", "value": "b9e20640ab1ea16059deb29466f6daef9e2551591945d4e6202cf22244dd7ec2fef5cf800e1251d6666dbcb612eb680e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429475, "uuid": "e79f206e-1085-4052-b7c2-94eb9111817e", "value": "T1F6158D23A2F18837D57317389C5B92655C3ABE002929A54A2FF41E4C5F3D2A13B753EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429475, "uuid": "84be15d3-0047-471f-8db0-c0ed8a266035", "value": "5233b9da4f58bff0d5c4fd950faa2db1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429475, "uuid": "db849212-2b70-4081-ba66-9e4171d8d821", "value": "12288:/YqNPY5nejvvfpvfGc+se7Hjk1Kz90cRchxJC+3hNec1bWkqtL0oOBKC9HBuw:A2e6fRuZ9HCKz9VcLTTbWkq66SHBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776429475, "uuid": "4baa1d1e-507b-428d-a530-a76e4c1edb94", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776429475, "uuid": "712d6aef-fb57-466c-86bb-762be8fb4eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429475, "uuid": "20670990-be1a-4d10-abd6-2b80fd67d0b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59808e06-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432091, "uuid": "846dd4fd-8f0f-4fdf-a772-4263a3264a16", "comment": "Malware payload", "value": "e65365381730ef5a71d58a3c41b31f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432091, "uuid": "91e58726-ee65-4bf2-8d9d-b2ebca98714b", "comment": "Malware payload", "value": "88a05814b83dae40f73aaea8343d233a144bc14b2f379983a4c07f0d414c6754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432091, "uuid": "d124c36b-881f-4348-8b7c-d6d2167a0285", "comment": "Malware payload", "value": "96deb7da051af482923bced074ac5a21f9b42b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432091, "uuid": "d2ceca77-9e04-497d-b700-583141ae4692", "comment": "Malware payload", "value": "29a82ab878fc7ddd3490c181a4fa2f91c85f62dbb791dbfba90d4e8efa069710279c476db3ea1bcc710c9d328d0157af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432091, "uuid": "e7a6a8f5-9b07-4ae6-bba4-a52da0115873", "value": "T1F3C4AE959BE503F8E1B79A30C9A14902FB77BC4527B09A8F039444B75F276918F3A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432091, "uuid": "c4eb6cdd-433c-4b58-b630-de76ab081564", "value": "a90dd0da2b8eddb963b8ea61476b1e94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432091, "uuid": "0a5f305f-8b60-4d30-87fe-ddf442c4adbe", "value": "12288:DXPGv145RG82AdkMzKCIio/3NzAiR3Ozb4P:DXPGdaF2ykM+b1/N13ob4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432091, "uuid": "d12a98df-67cb-4214-ae96-04f95b381537", "value": 560848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432091, "uuid": "6dd6fc11-3576-4138-b4c5-4e54aabe08ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432091, "uuid": "4511c7ee-777b-4874-8ca7-1f566c15593a", "value": "shjef2aVFDe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a1187a-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458559, "uuid": "6f3ef30a-efe9-47d0-a074-95106adb632c", "comment": "Malware payload (Mirai)", "value": "38defb47bffb8a507f57ed3716cf47d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458559, "uuid": "c615f821-1fe4-4e9f-8c2b-407d4801999a", "comment": "Malware payload (Mirai)", "value": "89fd6c771387c63ebe8d71d6326e10390550140a3385de99e51dc4ab9b7d068b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458559, "uuid": "fc07fc64-6488-40df-9390-368341694a2b", "comment": "Malware payload (Mirai)", "value": "6dfe681cb641d1e34db198d90a2d7ded41f56236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458559, "uuid": "9392266c-a087-4111-a3b2-dedccdfd34ef", "comment": "Malware payload (Mirai)", "value": "fcd1c8e366e10b36b2b6fc819d75812a107a3be412251119c24941120cd3d7a4ab2a10c035462237665b204af1f39165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458559, "uuid": "792ca02c-7fc6-4885-9f9e-0f9050b3081a", "value": "T1A8549E073B8A4DEAC66DC3B20EEBA3108B13F0350712E79F37646A647F4979C6C58659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458559, "uuid": "a9d29f54-9d7a-4f3d-a15a-b87621ebf176", "value": "6144:POd3iYi3XmEiIrWJOr/bMk59QlknPDM+k6ZxPOaP0rbyjbpblTE3TqjjicmmkZae:CEoOrDMk59QlknPDM+k6ZxPOaP0rbyjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458559, "uuid": "9eacd05f-98ef-41d1-b63f-7ba8005bc066", "value": 300506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458559, "uuid": "fe6956d3-cf7c-49dd-a414-ad6b7ff54d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458559, "uuid": "9e1ddfc9-1b1e-46c5-9e92-ee4260fe61e9", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75500941-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456190, "uuid": "8ae7adc8-c49f-4902-8019-a98bed32f055", "comment": "Malware payload", "value": "d397eaaa21b79a8efc1cb1a136ee397c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456190, "uuid": "71cc9f18-61fc-4cbb-b318-66eedf30a179", "comment": "Malware payload", "value": "8c4f8053881899f844a2e6dea8ce119124acac2b34750a47650e368c27bf7a3b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456190, "uuid": "eb49ea25-3d96-4a95-8d6a-7a736afe8bfd", "comment": "Malware payload", "value": "c2729cf74f3016f96c9ada3fc88257690242f86a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456190, "uuid": "44146f6c-7f9a-467f-ad96-941a792134a6", "comment": "Malware payload", "value": "fb31d2e2a6af5d2bf65cd72e659e37d2907fbe2bf57050b682cf6995c2ad5f00937e5818587f81e9a2f815825ab49315", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456190, "uuid": "2c4bbb77-bd3a-424b-9cfd-54a6e50b945f", "value": "T13AD5F145FB989E0EC8F393760C3A6635547AD827C713C383D9792679248BAF40F852E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456190, "uuid": "c358103a-8dbc-431e-aadd-0eb381169375", "value": "49152:GAqHWaqT3fG8r68ggI3tFX4LdK8bSlpASBpcjJbgYzJrksfW5gipFKVn96y:ZqHFop6PgI3TX4AIS/BpcjhgexLfW+im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456190, "uuid": "e4a2b8eb-76d8-47fb-b725-dc91daf70c3e", "value": 3016266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456190, "uuid": "442b413c-df1e-421d-b15c-5d4777336703", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456190, "uuid": "2d580f3a-8da7-4684-b115-2692610339e0", "value": "sagawa(5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc9c1ae-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392424, "uuid": "587c90d8-399f-415e-86e0-0d75bf27e7ba", "comment": "Malware payload (Mirai)", "value": "cad06820a476b038b4c7e04c2149d600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392424, "uuid": "cc3aa49e-5a77-43d8-b12f-8b02a4a6ca6a", "comment": "Malware payload (Mirai)", "value": "8d9525f2f98722c711f9fc75499cf98e59f4652ab23d086b5b34769771f421ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392424, "uuid": "53039355-ac68-41a0-a808-fcbd1e6aa360", "comment": "Malware payload (Mirai)", "value": "475a674e27fbb80db69adca5837c3c41870dc92f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392424, "uuid": "bbb1ffc0-9fb2-4b39-bf24-e31fc6dcfcdd", "comment": "Malware payload (Mirai)", "value": "accaaa8ed1e86c87e418e93ccef067cea31a1b7ccb9298ef84ad2fef923093fbc6224480ac939cda3b35f6de6db430d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392424, "uuid": "103b77e9-33ee-4bbc-94ac-cf4597398ecc", "value": "T16B539E77C8396E64D25581B0B8748E782B53F98482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392424, "uuid": "1b0d5c83-8141-486c-a315-937cab8094c4", "value": "1536:MaCwtuAPFqcgdEc0RKk3XgfuB+CS7fF15Zy:M58PMcgad4kiuB+FtHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392424, "uuid": "9f3b040a-761e-4251-bbfb-ccf81f8a4a25", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392424, "uuid": "9a5b6ec0-3ec8-43a7-afef-26e8cd81da67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392424, "uuid": "0e0826b9-e716-4b7d-ab67-9936f4a80b06", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bba33c-3a4d-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776424141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424141, "uuid": "2ea1df81-a597-4f71-87a0-8d92e0f421a7", "comment": "Malware payload (OffLoader)", "value": "222e197b1681c9d44f40677df2b31240", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424141, "uuid": "4301973c-8307-4264-a5ea-383023c61e6c", "comment": "Malware payload (OffLoader)", "value": "8e18190a2ab8319d753020fb8d614b21ca53ff7eee3b0af97efb82703d24ef38", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424141, "uuid": "3866187f-9eb9-4f39-a317-0ae54c7e0061", "comment": "Malware payload (OffLoader)", "value": "4447a57ff33da8fcd0b8883625af5ce704fddbd4", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424141, "uuid": "884edcc7-7d17-4e11-9df6-5b722a677aed", "comment": "Malware payload (OffLoader)", "value": "d1a5afd2fd83666717ac19bf879e33ed2981f07b95cc921eb5d1f2a03bbb1096ae8a01b33a6cc5226dcc36ae4660fd1d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424141, "uuid": "fa799888-74b5-4809-8779-bd8ec63a75b8", "value": "T1F7C6E023E785526DEC59A63785A1F3305B376EF1641F4C0696F038498B3A0E0DE7EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424141, "uuid": "6f774ed1-5975-4607-8edc-390dd80e0498", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424141, "uuid": "aa5fa056-9100-457d-af42-77c70be17ae7", "value": "98304:SN66wfP97g82MbLMRPbKiDUuz+mcOWXokjtmzO:6w9g4MDDhcOKmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424141, "uuid": "d2fd7517-2f8b-4da7-929d-0939f63d052b", "value": 11515437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424141, "uuid": "f619b280-0373-4386-85fb-2529a6fa7b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424141, "uuid": "6f6688d4-aa0b-495a-a778-34104894ede3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1b0927-3a6a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776436661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436661, "uuid": "dd053e01-77e4-41b1-aaa2-03fe0b1c32e0", "comment": "Malware payload (SantaStealer)", "value": "eab63c490102d94c5a3b3914195c3530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436661, "uuid": "d659b6f7-510e-45c1-8875-8c192915e643", "comment": "Malware payload (SantaStealer)", "value": "8f3ddbc6090f6bbb75805de8ca284953696e283b438cfa9a45c3713c6ebcb70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436661, "uuid": "c387677e-8512-45e3-8b12-7e4ccb5ed4b1", "comment": "Malware payload (SantaStealer)", "value": "a3806ea732afffeaf6a5168ba0e9192b2cfa8770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436661, "uuid": "7dfb6b7b-8031-483a-a3ea-833e70824fba", "comment": "Malware payload (SantaStealer)", "value": "aa45251004ae011f7438aaba089a69c8ced8310a5a87729b8675b5c2e490b3dea52b1d9ed97eda79c96920236ea25aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436661, "uuid": "e4807433-08ff-4f9e-b805-49507b6bbc6d", "value": "T18267E0DBF60DB9B4F315956AC7D0EA086F8FF8B180E391A001D11B3396AE946DB8741D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436661, "uuid": "f73284e5-f8c4-469f-bf8b-77e7a45dd04a", "value": "5db62f1c7bafdda66124cfde5230bea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436661, "uuid": "4a4410e3-1b40-46bc-a715-5d40d52a3ad6", "value": "786432:hP1TC3oQmx3imvWEmBjsWdMruJZrize+SkjRn:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776436661, "uuid": "71ac6644-ce90-4022-b3cd-206cfb69ad71", "value": 30016722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776436661, "uuid": "027d4f63-13bc-4352-8b66-0cbe7334e003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436661, "uuid": "4a759e0d-3271-4be1-b644-7fc17b070921", "value": "SecuriteInfo.com.Win64.Evo-gen.78237919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ea378f-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458550, "uuid": "8b4d7ca8-76a8-4d4b-8d03-8cf0b899e4ea", "comment": "Malware payload (Mirai)", "value": "96d25a28c227abfd549280af5e788bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458550, "uuid": "59734289-ca6e-41e1-a13b-1c4ef9fba809", "comment": "Malware payload (Mirai)", "value": "8fff8e9a86dcd7df612cad060a666911cf4a1d3ed470343c40b150af8b693ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458550, "uuid": "aed9fdcc-3b69-4583-9ba6-a8f234853630", "comment": "Malware payload (Mirai)", "value": "67a79368392ea8396bef2ab6e165b1146db7bf23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458550, "uuid": "a1748fbb-d84f-494e-b24d-49257af15510", "comment": "Malware payload (Mirai)", "value": "6f3aa94d00cca17b85076b54c7812646cee5d2491c98c215d0fb2a9bf6cbbbb9163fce079da8377c8e198b80b4d93865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458550, "uuid": "d9283b84-9ab3-4161-85e0-b6d9390fa788", "value": "T15BD31802FF601FABD42FDD3346F90B1524CC6D5B22B52B797A30ED28B61A58606E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458550, "uuid": "d259120b-5585-4d96-833c-13a4a2bbb03b", "value": "3072:lkjqFcxQ7G81sjbuE25pnvmYJ7N6LoU5ABdVYE6LernfR:6wcoyuE2HnvmIN68U5AfVYE6LernfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458550, "uuid": "948a92b8-449e-42c3-b810-ba03cdfb5f2e", "value": 133224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458550, "uuid": "129e02fb-e26d-4fca-92eb-518183f3808a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458550, "uuid": "c926aeae-4b78-49cf-ac3e-2489f1b97e56", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50f6bf7-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455840, "uuid": "968a7f01-2b13-4101-81b9-0251740f22ef", "comment": "Malware payload", "value": "5a6ae35aa311faf95748bfcfa0957272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455840, "uuid": "5985515d-dbbc-430e-8921-48144f8d1e13", "comment": "Malware payload", "value": "91e51a6c7d073613cf6238618c7d06851429f8b57eae456c1b5a35dd5c82df9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455840, "uuid": "828fd6b7-67f8-4c0c-8ae5-2e5177af1d73", "comment": "Malware payload", "value": "ab8268e66b9d658eb8864f329eda6488f6e87d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455840, "uuid": "f119d316-27d0-4da1-a0e1-7d634e536e5f", "comment": "Malware payload", "value": "26413b2e3eb727c1c67640786fdfcd6f3ed9010c48dc884917ebb36212a68ce852c1265ea7230e1cb25f128c14311b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455840, "uuid": "c6343464-b578-4d3d-902a-a8964253f955", "value": "T13AE37B97B71A6CA3C8910BFA4BD7079C6B6361408F67C7D33D0C66341E6A6DE9D0A381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455840, "uuid": "a656164d-41d8-4466-ab48-f679cb132e5c", "value": "3072:P2ZzLN2L1Y2OQQP3y84g5UqnrMWim7WG:P8LGOnC5qgWim7WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455840, "uuid": "abfb090e-abae-4271-87ad-ff2219805660", "value": 143780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455840, "uuid": "b98f1a49-deba-4e66-b16c-473a819f72f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455840, "uuid": "c4561c64-9398-4b74-a7b3-a0220460883f", "value": "h.cra", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4446cd12-3a35-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776413587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413587, "uuid": "dec6728a-924c-4455-9600-cfc9f7869182", "comment": "Malware payload (RemcosRAT)", "value": "960feabda4a66a3f3a472ebedfc214ee", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413587, "uuid": "c4358450-cb51-49e7-bc90-dabca954fa62", "comment": "Malware payload (RemcosRAT)", "value": "91fb5aaa9aba6094258f1a25ace0e1cdb4b2ef22520938ebedb400629e747392", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413587, "uuid": "deff668f-b976-4e4c-8ae6-a4c08e6c35c0", "comment": "Malware payload (RemcosRAT)", "value": "40f45e1d9d09d51147a6998c0d9edf0e291fcc4b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776413587, "uuid": "67f55326-1a7b-408c-a574-a947320b3a62", "comment": "Malware payload (RemcosRAT)", "value": "4cf85af9e3c935d24a47d9518c2f0db6086093e54ba72f980fa731a0da630ad8ad080f847af10d376d43059911b00ea3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413587, "uuid": "86e1ff20-9dfb-4227-8e5c-ababb254de58", "value": "T10B64ACF7C3D88191F2D9CDE83A708A86E36938EE2A26534F795DF9342FF94854088C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413587, "uuid": "837ac15b-2778-473c-91a9-81998c176b08", "value": "192:Fp9XIl2OWN9vd3l1tF2N9GMwDD5Od1o2/6pOWyK4gdXLI+klDVoBF2N9GMwDD5Ov:FLtpPj4Ake0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776413587, "uuid": "b109bc0c-3d59-4d05-a563-909c4749e758", "value": 328645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776413587, "uuid": "1fd56f1a-3537-4c0c-b229-dd709a1ed489", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776413587, "uuid": "df05349e-22fd-4465-a8af-ae160ddecf96", "value": "goodthingsforbetterversion.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93115955-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776446791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446791, "uuid": "d0a5af5a-b3bb-4ce4-9328-e26d12bc7274", "comment": "Malware payload (njrat)", "value": "0db6fb22487f6f155b467ff0cb96717f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446791, "uuid": "4b98466e-7202-484a-a29a-e4185fdc0c6f", "comment": "Malware payload (njrat)", "value": "925e77f832f141c3896bad0916539f5aed56401ddbe60a4f4cfa701019f40cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446791, "uuid": "acf9b0cf-f822-43e6-b229-1a66d3ba134f", "comment": "Malware payload (njrat)", "value": "4e3783dec8aa64e32f3105a651f0c25f6f889a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446791, "uuid": "42dfca6e-4a9c-4606-8e27-27e61ce91567", "comment": "Malware payload (njrat)", "value": "b139007d9d01e781ce7d8fc11f93258bef9ea76c76aa8c66c046509fa9e1b9e29c9b229f9c4e01058679dc10354514db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446791, "uuid": "42ae60fa-3282-4460-994c-87244b8f1dc9", "value": "T1BF83B395B3E5A5B8E31D2133B4D0A36C7BF4F60B8C834D6E4EC550A4BE525C92E94CE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446791, "uuid": "07aa71e4-4802-4120-aa27-417478b0ea7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446791, "uuid": "c3aa496b-d23a-4960-8a75-6c0f413e3d6c", "value": "768:vivOzTYOjEFItcL2VoKhFnSQXbVaTx2bZwjO2+UNpbmQZ9UWMoCm9:msTR+YoKhFnSWbV9Vwj7lpbmQZ9U7m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446791, "uuid": "0992f084-43d9-4b5a-ae39-5a15d30bda74", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446791, "uuid": "836e15b9-ba1b-4158-944f-b0fc6724341e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446791, "uuid": "03777af6-1e65-457e-98a6-b24bff96adbe", "value": "0db6fb22487f6f155b467ff0cb96717f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601fb7ae-3a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776400749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400749, "uuid": "d9df1666-de8e-41f6-809a-345937a4194b", "comment": "Malware payload (Gafgyt)", "value": "8672430b2bb3a7629331046897aad1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400749, "uuid": "8005c52e-f461-4ad5-bcfe-69387483f667", "comment": "Malware payload (Gafgyt)", "value": "93541eb0fe6215267d3066254ca0e9fe772de30d3eee5c3922f5db488f73786f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400749, "uuid": "d08369ef-1042-4edb-b12e-594e9f4692c5", "comment": "Malware payload (Gafgyt)", "value": "fcc149c01e73c63d6e01e82c2188638a5ab906e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400749, "uuid": "65f49ea1-07b8-46b7-af61-fe4ad583e343", "comment": "Malware payload (Gafgyt)", "value": "5db0342933106b7a19bbf006d16e5e2e486b5da50b9458bd52e83f451da59a7792c0b47ebb16355c4b773442388ffb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400749, "uuid": "31a4b358-8559-4b01-a4f3-fdb03d1042b9", "value": "T168B34B0795A59EB7C086FAB924A759300712ED220F6F1A8A65387BF0537F5CD700FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400749, "uuid": "a1941343-4f4f-479c-af4e-d0b59148af3c", "value": "3072:NGa+Y1loV3n39yRctegRFvmDcgYVy1IPYC:NGa+Y1iB3QctegRFvmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400749, "uuid": "79d40d99-4a29-4d8d-8b84-41475401a55e", "value": 109708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400749, "uuid": "2d09881f-2e7c-493b-aade-b24428537a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400749, "uuid": "1a45ff52-4953-484e-be0b-5e8d40b7e2f0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2e266f-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455849, "uuid": "be89850b-ffec-4d67-8490-8f1ddea852fe", "comment": "Malware payload", "value": "c5e5a4d1c16fc0cd8228af4850c150ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455849, "uuid": "479a726f-ac4c-4aa9-a8e5-4e57de1c15d2", "comment": "Malware payload", "value": "937d1f386667ee94ded5735cddc74c5cb33b8f4eab0b489b580ffd21e59444e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455849, "uuid": "227b7556-13ec-4625-92d1-1034a806f535", "comment": "Malware payload", "value": "af4ecf21b97d2525040936669b1115d8187917dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455849, "uuid": "c0445307-16da-482f-a67a-8e7faccca925", "comment": "Malware payload", "value": "bde8669efdb4dc0a15653307804bb22126607ece72ee303a4bc52a85a24ccf08f86a1439bc78918e20925a8709698cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455849, "uuid": "1970ee90-f2ce-4bba-af21-c201e122edb0", "value": "T1A1335A85E693E9F1DC4119B01B37E372AA32E8751034F677D7A9E77ADC22611C91238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455849, "uuid": "1a308799-8533-4ae7-a3f9-162e3a57b5cd", "value": "768:YtpxlQTTW454Xe9rKQrhtbFhQFhMTBah+r4CyoII41b26YswO:YTxcTYXe95rht5hEhMTkhzCP94J26Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455849, "uuid": "52dac5e9-c1d9-4a58-892a-104eb6eb5339", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455849, "uuid": "501d8695-dd04-47df-988d-637c70cb7b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455849, "uuid": "0bba4cbd-df20-4ae4-aa38-9b5d1f631285", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2490e97-3a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776412940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412940, "uuid": "58151cd5-e0d2-4700-8929-77486c6e48cb", "comment": "Malware payload (Gafgyt)", "value": "943313bf1a38548987a7138d98e58b8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412940, "uuid": "f81dcbe1-3015-4d70-b1c6-56f7e026a63d", "comment": "Malware payload (Gafgyt)", "value": "947789ee1dcabb73e7e8ac95da4ea1b890261f3486a1344fe4abbf87cac53030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412940, "uuid": "edfa9259-8640-492e-ab69-9619b7fa76cc", "comment": "Malware payload (Gafgyt)", "value": "36e8b2a1593e2b641703bbfef73f15ae42dfa48b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412940, "uuid": "5cee2daf-666a-430a-a617-bcb4b99d8a3b", "comment": "Malware payload (Gafgyt)", "value": "92291d61102b5491c2e931675c6e79740b1e80fe3b87fad057f4e5eb4169cbd80ad84805ca637911993c5dd5b7d9a00f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412940, "uuid": "0c267f79-e80e-4299-990e-bfee5c52222e", "value": "T12DC3F805FC404B27C7D23BBAF79E438D773566586BD73311AA296EF02BC5B882939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412940, "uuid": "e12b462d-2699-4e2d-b651-97457082510a", "value": "3072:vFDcpqlgQSnoHy+Ks/uUlKQ1Vp5hLy+vPQbrlySMv3oCxDQlD6ObAF5R:5uUlL7p5hLy+voLmoCxDQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412940, "uuid": "00aed5d9-129d-4255-b868-42749c315892", "value": 120867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412940, "uuid": "c1292a03-2566-4948-9260-dbc7eaa46735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412940, "uuid": "b10f4bec-b0a7-44b9-bf46-9aec85eaa214", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fc23a3-3aa2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776460372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460372, "uuid": "02fafa75-beb9-4949-9a89-02eb4025cd2c", "comment": "Malware payload", "value": "0a39063fad3ab3a12f83fcb7b6bbc386", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460372, "uuid": "1e806d55-7bd0-44e6-bd79-7c3635313573", "comment": "Malware payload", "value": "94b77ae3bbfe3365dc555ef43c7a533e971989435cf2d2f2828d757497f88ec3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460372, "uuid": "43b82073-14e7-4d1a-bf40-124faa8c874b", "comment": "Malware payload", "value": "378b18b5e5ce7ba0811b068d4631de2d0792bdad", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460372, "uuid": "58f3b9a1-7c9e-4196-ac3d-56724ca13df8", "comment": "Malware payload", "value": "5b6bcf0b8044ddbf7697197a6f258fdb8111f857c13d7be031a8d147b3f778752c79e2876636ca02187beb78628ca43a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460372, "uuid": "5d3d23fa-f91f-4c83-a1ad-f85c95f64f1c", "value": "T1AC5104012BFA075AF3B78F359477B2209A777811AE13D74D5090964C5472718E839F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460372, "uuid": "3aeeb731-f736-4112-8fac-ef4b13fab8aa", "value": "48:8EM4J5IqQlv8DvoVZrvud04CNC1XuHslyF6cc:8EM5qIAsTF5EdupF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776460372, "uuid": "ab9e25c7-32b6-485c-8380-868226e9feca", "value": 2826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776460372, "uuid": "0cea96ad-727c-4018-9139-9a7bc4dd6765", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460372, "uuid": "85be7df6-f759-4758-afac-c29878b62ddc", "value": "Eryx_cameo_details.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c352a2-3aa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776460945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460945, "uuid": "9aab46a8-8244-4c66-852f-0506e41b0346", "comment": "Malware payload (Mirai)", "value": "1419743414cafe0f3b5797739c478b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460945, "uuid": "f0c9567f-8e6d-4369-8a48-9dd048168c63", "comment": "Malware payload (Mirai)", "value": "95ec7739d50ac227f17a4214a57f2b9093a57f61a52a05cdf2681be13f595e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460945, "uuid": "2d89e4bb-f9b4-487c-a91f-12504966addc", "comment": "Malware payload (Mirai)", "value": "909008ba52267cca41d8503bc2909b207da3cadc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776460945, "uuid": "e5fa380e-2ad4-4d67-9364-0de8f991f8fc", "comment": "Malware payload (Mirai)", "value": "df1af562f2df575fc76e4b153ab6b72cd34ae327d485616d25da61ffd475d0868fbea57b012b0f60b3742b704a79a085", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460945, "uuid": "959d05db-9e88-4dbd-8e41-7f7de6dc22cc", "value": "T11E6301DF21B0C01FDA26A2F56D7C4E82DD92C3EDD5251AED0264C66C8009627B7FC96E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460945, "uuid": "bd60352b-a14a-406d-b605-17c545458e27", "value": "1536:/CDyBzDYILeWm8mIgZfqAotHTRrGuPYIFXN3Z5Z8YGIjAhiUMzv:eszUOUIEfSrhYIF93Z5Z8qAh0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776460945, "uuid": "09cb1d26-227d-468e-a036-588646dd4c2d", "value": 69304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776460945, "uuid": "b291af82-21ab-4dc8-883f-e80ada58045e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776460945, "uuid": "6314f848-68ef-42be-bfcf-2e3d0cd00267", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfce790-3a83-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776447346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447346, "uuid": "97d8d8de-35c2-4ecd-b992-1ff24edb30b5", "comment": "Malware payload (Vidar)", "value": "27678c494bd0fcef96159c4654c2273c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447346, "uuid": "9af29dcd-3631-42bb-b796-1e91c3c791b1", "comment": "Malware payload (Vidar)", "value": "971fa32e2c385f679da4df0b303d2fc484b68d1a1131d77cd4815fc2285249ba", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447346, "uuid": "85386c6a-9398-4e69-b3b5-6660514bd3a7", "comment": "Malware payload (Vidar)", "value": "ff6cbb63e0a72c2d9ba5bacc8f1f4e4498550405", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447346, "uuid": "04815f9a-e2cd-4f0e-9c90-9452b42cda9d", "comment": "Malware payload (Vidar)", "value": "17ecfd303ca98bb2fbb534c9d3b6e163fc68b3a574a36d2e33f93d21f9edb256ff20d5162b7629c158d9778db0d508e1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447346, "uuid": "b899cc14-5a8c-4cf7-8d6f-58cf1ab0eccf", "value": "T11CB58E0BACD408EAC46E97368DB765927730BC480B3263D32E51BAB92FB67D05DB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447346, "uuid": "5a6c87da-8984-4610-8027-70328a4d2211", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447346, "uuid": "378209c0-b9c2-4568-a2bf-c3193128559b", "value": "24576:XqxLBrzuBqxvRq0pHpVqkwVrHqUUu6H7QBFmgF1UpWNaWPyQR9qOtPo5:XqxLJzuMxvRqoIVDZq76CWiQR9qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776447346, "uuid": "9cb2a39a-39e3-4831-bce9-313d38f34008", "value": 2343128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776447346, "uuid": "d522fc76-f6d0-4615-99ee-64d84fad5848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447346, "uuid": "3208cebb-61f3-4312-ab3e-da4e08d3eb4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f30c83-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435244, "uuid": "5a2219e4-aa69-4f19-8d6e-e1e106b60965", "comment": "Malware payload", "value": "e3d0166a2814fa6fd4d46796169ce851", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435244, "uuid": "d9691346-55fb-4f5a-a6fd-c1066ca17448", "comment": "Malware payload", "value": "9858c8238f2ddb782e64e43b41de865f4b291f040eebd1a71a07f50f12d1b036", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435244, "uuid": "23d81bc2-c3ee-4d09-acf3-6d3d64aa477a", "comment": "Malware payload", "value": "a269e2b9b527e6c9155862a891a8ab1a2944e8f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435244, "uuid": "c94ae649-3343-4b1d-9536-a8fd68c4a000", "comment": "Malware payload", "value": "d9c4bbf4d633115bd597914bd6b96edc7f3bf207cb2591700bff27ceb0f09500f5db690590d0ed332dfd036ed93d62e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435244, "uuid": "13d0e358-18de-4f4c-935e-87d9e0cf4d5f", "value": "T18B642F38ADEA001A7173EE64AED47497E96FB773370F589810C103864723949EDDA63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435244, "uuid": "06fe9abc-c14d-44ea-9dbc-1708d9519d6f", "value": "6144:lsziy4+WzwD1cy4hNROHI4zw5rTaOKWQ2bTb6slK0zX7zDLwvV0PWW1NPn:0iy3WzCY1OHI4zw5rTaWQ2bZlxDgGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435244, "uuid": "179bab6b-4d84-40e2-b971-2bd34313fefe", "value": 309434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435244, "uuid": "d1dd5f64-33e9-4db0-9b86-6f182c71d4ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435244, "uuid": "406ddcf2-79a3-4f2f-9fb4-df11677157b1", "value": "SCANDOC154O.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bd27da-3a1e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776403841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403841, "uuid": "d2ab808c-6459-4e28-967b-e3b1690838b0", "comment": "Malware payload (PureHVNC)", "value": "c8dd0f2abd9d4e0efbd32316c75c4506", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403841, "uuid": "86aefba8-4b64-4f2c-954a-db8936c6ce05", "comment": "Malware payload (PureHVNC)", "value": "98cbfb00efdecbf68dd81e4e46d33d41ec90fcc49866d9ba4ee4651f5146ee97", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403841, "uuid": "8d5f26b0-cf38-4035-a32a-b845ca5151f7", "comment": "Malware payload (PureHVNC)", "value": "8ed38e06c638e5febe174589f28c2ec1bb83df44", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403841, "uuid": "eb049460-4118-4cf2-b1d9-192440a29f7b", "comment": "Malware payload (PureHVNC)", "value": "a52eb2eea278bb791e00777e49738c4f8d4c05db0879697a30d8aea6b11a42fcf6cb5060c293374d97082d3e0053148b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403841, "uuid": "8ffce234-b7b5-4b53-8725-b65656824c77", "value": "T10C353389D72DA6372C6C452124A55CE536E37F0FFB2E319E00ADAC75837E2918CE2E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403841, "uuid": "69ef096b-f24a-4b29-a79f-5c082921a773", "value": "24576:YXJUjhKR5e+ZUsIXgdH1b+VFrHZp1llC/oI91BLG3o2in:SshKe+pIXg7+rrHRC/PBijI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776403841, "uuid": "6b92b57e-2302-41c7-b641-5c95bce3f77f", "value": 1117094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776403841, "uuid": "c1511feb-75df-4f57-8b2c-629125d00ff0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403841, "uuid": "d0be26bd-04f2-49e2-834f-46bf91b1880c", "value": "3718086d3629b62ee66659c5a097847fdbffc27e486c2b8499e3daa0a3bcbe3d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc19f8c-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776423562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423562, "uuid": "1b3d3933-b1e9-40ad-abb2-989a25f88763", "comment": "Malware payload", "value": "881b1696cc160acfeb25d9aeb677511c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423562, "uuid": "ece22006-88b2-4636-b186-31d946073c4c", "comment": "Malware payload", "value": "992e03fcdfd9281f592e2f57fa392f1450631a4bd73757c403278005277a741b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423562, "uuid": "b69d4a10-24a8-4595-ab5a-b838004ee08d", "comment": "Malware payload", "value": "7519de6a6be735ebf507354a2482b2222fe488d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423562, "uuid": "7917ddef-ad19-446f-a550-54d2e79b81f5", "comment": "Malware payload", "value": "7ee9439e76968e82d3b3d3ed742da9ac33e4353164c4c11fa588d699f183c7b10fe526879f637b815259c8cf4688a1cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423562, "uuid": "0910c9cb-f0b5-4db3-b26d-930f1bb7b015", "value": "T1C8541D38ADEA401A7173EE54AED47497E96FB773370E588C20810386472394AFDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423562, "uuid": "ceab1e1d-5331-43ad-aa9c-ee9858aa5cb2", "value": "6144:A7giW+6LuqdpytSKh4PhuCAGOYbqd0EUfbrYwh+EIbWz1c2xh:Mgi56LuQpycKAAGOYbquPfXhCyxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423562, "uuid": "41567753-ec5b-416d-ad77-b410afb74580", "value": 302814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423562, "uuid": "22121c6e-3c26-4a67-89b7-30a56fdd6c8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423562, "uuid": "b297aaf8-de9a-43e4-8105-359fc69b4004", "value": "Order # CCI-357911904.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521e9be0-3a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776451406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451406, "uuid": "2b0606a8-023c-4b62-bc12-6a44f8ced4ed", "comment": "Malware payload (AsyncRAT)", "value": "29df5fbb5b139fe92e5ff7391a7ed9f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451406, "uuid": "e7ebc600-6146-40b9-a159-4378478c6bd7", "comment": "Malware payload (AsyncRAT)", "value": "99a155b641fd77436af856b8daf01c896130e915281f6e2287d86eb7408af6b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451406, "uuid": "41eb64b3-1c52-40c2-b675-a84424fd1063", "comment": "Malware payload (AsyncRAT)", "value": "3040eaebe6686aa46f6ae56b835e695d60c64ded", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451406, "uuid": "3a398650-a702-4097-997c-397dbd012a23", "comment": "Malware payload (AsyncRAT)", "value": "a26c9ba7577deeb7f188f14476288330b2981b19ab07a77a8a12fc6a51e91730ad2950662324f3bdd26f181b84a05549", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451406, "uuid": "5032e41d-1463-4b77-aa75-8ee87f2ae24b", "value": "T15F233C107BE9C12BF2BE8B7468F222454675F6632603D65E2CC412D75623FC58B436FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451406, "uuid": "90485e72-d051-48e9-834d-9d6df41896ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451406, "uuid": "fa619a04-ea8c-42f1-8887-7746f61cc883", "value": "768:Da8l/LI1CCExvgwpWHGGx8l6UydWT7KB6m1PmJIjbHg47FsyxjhPXgmM5b5f+:Da8l/MwZWQMcjemKbA4hswjhP1M5b5f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451406, "uuid": "f1067756-5ad0-425c-9e37-6844671ed680", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451406, "uuid": "c4394698-11ba-43e0-b04f-abe2c373398f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451406, "uuid": "f3022f78-48e2-43c3-af75-cfa70258ffb9", "value": "cmd994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa85798-3a7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776444817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444817, "uuid": "31cd1bef-097f-4d4e-aa4e-2a9725a5987b", "comment": "Malware payload (Mirai)", "value": "bfcc92dee5878276502a311429d52dc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444817, "uuid": "2770d63c-7f99-4d12-b893-8b076e0e335b", "comment": "Malware payload (Mirai)", "value": "9a9eaa133742b91a720a0f5c7e8fe400fb4ba19b1ee8a75a01e2e3eb55729437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444817, "uuid": "f3af6128-c767-482d-b4d2-114985dc72b2", "comment": "Malware payload (Mirai)", "value": "0d89a4ae94afd00dee4c105b59b915142d6ee50f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444817, "uuid": "5745aa29-7ee6-428e-8fc9-64157a678f41", "comment": "Malware payload (Mirai)", "value": "fc2cdd93b995d6c19844cbb4214279363e363fc441f5884d4d5fb39cb71f4e043e3de8fdebd57ca866a4d68dfdaf5748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444817, "uuid": "bb43db0d-2d6b-4864-ba76-06aa84ca8159", "value": "T1D07302F9594C5418C7F0C2F382B913509C70AEF612416A429942FF61778EAB26BF6F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444817, "uuid": "c96179a6-0a41-4e68-b241-f209b6397fd1", "value": "1536:FO1QVL2D9fy9fMPHkw64KTgShjSvAPXbYkD7GHtoQ0PalY/7VJu8:Xm9i8kxNT5GcXbYkGHeQ0Pal67VQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776444817, "uuid": "81659b08-1382-485f-a5a9-a0676ffaddfd", "value": 74456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776444817, "uuid": "b6dfcdc4-d2a2-4eab-b07f-3daffc3e7637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444817, "uuid": "f1ecb554-976b-450b-9000-3d24916d092b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec31c1cc-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458537, "uuid": "bd4f30ba-9987-45c2-996f-ad658dffcc0f", "comment": "Malware payload (Mirai)", "value": "b75c379a687af413220298285781c01a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458537, "uuid": "685206a1-466f-4226-9743-ad9294a7a181", "comment": "Malware payload (Mirai)", "value": "9be9baf58d9f1ab9c9dd0a0377540b53cf4c29694500e85d1a1b59c3d9f5f68b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458537, "uuid": "d32d5618-d596-4bf0-9c39-93db1fc8fd27", "comment": "Malware payload (Mirai)", "value": "cf0a3f384e7a077bc81c84141b94dd39b023de61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458537, "uuid": "66e9c8c0-1a43-47ab-a647-66563862cf7a", "comment": "Malware payload (Mirai)", "value": "5e34c662f20a0af578ba8ca36823b6d93d3321a492b8522694b07b54b571f448eb526c17ca49cf4b5f694040b247b2cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458537, "uuid": "700de53f-5291-4350-9bbb-e46fdd4c5973", "value": "T105B32926BD768E17C4C271B512F30734E5B2A7AA1C7C950ABE721DC8AF242D031667E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458537, "uuid": "1e970588-4fa9-49f0-a6ec-40f75039e517", "value": "1536:kGktO2lz+jtfieVCIW1jc2r5eU4kdhX4tJ0oD5VtlnpM+D7zx:k3lz6VSxhr5eULSX0o9xnLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458537, "uuid": "7f1bff6e-f032-4292-9985-164ef336fd6c", "value": 112176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458537, "uuid": "cab1cc05-b8ad-4a8d-892e-f11978c816a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458537, "uuid": "ff2ad095-2cf6-4836-987c-da2536bb938a", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97fbef0-3a23-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776406053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406053, "uuid": "06ac44cc-b07d-46b3-bc17-67aa0371766f", "comment": "Malware payload (LummaStealer)", "value": "951920a5fdc99dd74d424527e6bfbc92", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406053, "uuid": "65f0b7c1-9dca-41e1-9ff9-81b8dd106afa", "comment": "Malware payload (LummaStealer)", "value": "9d176e2a1d21e4b368cd06adfb0f38629781d4b7ca6ed7b738efb0745e77fa22", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406053, "uuid": "1e759474-95d9-4831-8ac2-ef399eea40a5", "comment": "Malware payload (LummaStealer)", "value": "3dd68dc07415136e32be8ead539301af4038212b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776406053, "uuid": "91e6486d-fa57-41a1-95a6-38914bd241a7", "comment": "Malware payload (LummaStealer)", "value": "055e0aa414ba4283a888856e5aba39cc6cef776fb7e90f38c58cfdc7ce3f629b8fa4b3fc8d5e367d949053650d189ad0", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406053, "uuid": "6e8ab7d4-10a7-49dc-a43f-9b7aabc8671f", "value": "T109854900FDCA54F2E5071A3655AB62FF2735AC094F76EA97EA403A7DBA773D00822345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406053, "uuid": "7c1b13cb-7f07-41c7-8496-8e3a728a01af", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406053, "uuid": "57c97204-694c-4f36-a1ff-65ae3c6b74a0", "value": "24576:T4AtLwSo+x1zrWQ/L63/t7u36hE1FfgUDdz+u9EcO4injXmB7Dh4mv12MxuyrHaB:TxWrI6adlv1huIaZHWGv1bQWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776406053, "uuid": "3cb65d91-77c4-4c94-a7f7-a4095f1ddeda", "value": 1864704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776406053, "uuid": "31e75007-89a7-4b04-aedd-071e2c5930ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776406053, "uuid": "8ae09736-7c5b-4f85-be2c-9e18fd3c80cd", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a650064-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776446803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446803, "uuid": "48b7e2d1-9724-417b-b321-075bd08fcd96", "comment": "Malware payload (njrat)", "value": "0b6c1fa2c31cbf89c32163c840e23a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446803, "uuid": "8850a622-77b4-4353-9220-fa81090c85bd", "comment": "Malware payload (njrat)", "value": "9da6fecd301bedbde2826b8bfdb3f391dd85915d329f05e08fe3e8024100ab9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446803, "uuid": "c62ec7dc-bb0f-46ef-9a8f-118676d8f335", "comment": "Malware payload (njrat)", "value": "8f684292c744fbe360abc21abafa1c1d75207c91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446803, "uuid": "eaeb98d4-bb38-474a-93e9-3ebb3f6195dd", "comment": "Malware payload (njrat)", "value": "f8d6ad6a50a7f99191d4b0b148b7fb493e50f127abb9ad70178f71f03eb21989f3acaed539a5ed837b45798361623728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446803, "uuid": "6ec09456-fd97-4f21-a60b-8f9c5dba8781", "value": "T17A93D74977E96524E1BF56F39471F2004E34B54B1602E3DD88F259AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446803, "uuid": "87bc945a-9b0b-492c-86ba-e98258d4590f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446803, "uuid": "93f41589-3aa8-4c55-ba4d-b447919ef43c", "value": "768:9Y3sUslorpLocxYZJ6aL+2apOXKC/WpndwruXxrjEtCdnl2pi1Rz4Rk33sGdpKgM:rUuo966aL9a+7+d5jEwzGi1dDDDKgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446803, "uuid": "6312dff9-c3b7-4626-9068-6919843a78cf", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446803, "uuid": "9cee1255-64e0-493d-8a2d-175cfcf1e29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446803, "uuid": "34c62a74-8ff9-4f02-a8b0-3de3a328c259", "value": "0b6c1fa2c31cbf89c32163c840e23a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9060cfc7-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776455806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455806, "uuid": "28f8a4ff-5558-4c83-a152-222ea9cb420d", "comment": "Malware payload (Gafgyt)", "value": "df6fdacba2c69caa140148187187e9fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455806, "uuid": "7f4fc40f-6c62-4381-8bb5-c863c3100b09", "comment": "Malware payload (Gafgyt)", "value": "9db4ea5016957840aca7e15c449731c04aa221d92f59138beb4c758ba9662695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455806, "uuid": "cfd67d57-9860-4903-b2be-1dd4b1e4bb2e", "comment": "Malware payload (Gafgyt)", "value": "28c383198f8a361719b69c1a4c54ca282130a139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455806, "uuid": "e696f881-4322-4f40-9d3a-0f9b0b1c5b9e", "comment": "Malware payload (Gafgyt)", "value": "0b15489b0cf5ed94a6adaede43909040f19f7e60946cad8a1599800a418493fbb380950012328c71a2eb6fac71886198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455806, "uuid": "fe80df63-e92d-4991-96dd-7a7fb116f7af", "value": "T19583C4197F714EF7E8ABCC3745B84302309D5A1A22993BB9B874D518FB4B58F06E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455806, "uuid": "e1b6d3ec-c414-4745-ab45-fdab9689d255", "value": "1536:fdtvzTXkwImWaT2byfjlbpmFoOp7n1CiJiZS3Nvv:fTRnTuWbpmNEiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455806, "uuid": "39158aae-69d7-4e83-8d72-4fb620163219", "value": 84308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455806, "uuid": "b0fac614-afc9-4c0e-81d2-21e57d47637e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455806, "uuid": "ca95684c-5ac7-4245-af4c-1225e9e87144", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72487805-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452319, "uuid": "b9daa604-a9c0-4db0-89a2-9ae3832eca53", "comment": "Malware payload (Mirai)", "value": "46aaddd1598c56b79efb0da070de9a89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452319, "uuid": "72c5872a-ec80-46fe-a3b3-e0bb7ece90cf", "comment": "Malware payload (Mirai)", "value": "9eb6095d1b258974d8b79cf68ec5e335a785e96851bbfffe57a6387bfbc8768f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452319, "uuid": "0b4b3132-9452-4ada-920a-4b4a4c9f8a22", "comment": "Malware payload (Mirai)", "value": "57f3cc0c228212b2e6e8bcfd6282589cecfa9caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452319, "uuid": "40b4b2ba-c163-4a79-a821-c68360843a45", "comment": "Malware payload (Mirai)", "value": "5cd4747aa551c40df414893524f1e84c4ebf82b9a19c3963b6720e6f7f28256078e72fe920aaa517c347f68ff7e874a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452319, "uuid": "6f25cb37-5de1-49fc-b954-93afab978b72", "value": "T1D5D3BF32F0146CE0CD1106B938B6663C0701EEF40AE95646FEBDE56E94B7E147DEDA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452319, "uuid": "b85a8fc9-4d8e-43c5-9c32-a7a94f445571", "value": "3072:IkZ6AcQdzN1ZwQjRRHPB5nESG9pt5Wi3vGZL:IkFZwahPB5QjzWifcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452319, "uuid": "7c3ed0fb-598b-4f2c-bfe0-2b220580fc77", "value": 131616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452319, "uuid": "3cd6cae4-6d4f-464e-88df-db5a6ee0ea09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452319, "uuid": "7302a43c-7d1e-4023-923d-9c91a11b573d", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a2e188-3a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1776443433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443433, "uuid": "a8523d3b-8577-4ec7-9eed-9f324d8e2901", "comment": "Malware payload (DeerStealer)", "value": "8b59578f5947e56c546d49d2f336c560", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443433, "uuid": "6c9ab867-518e-4f45-81bb-2cbad23b085f", "comment": "Malware payload (DeerStealer)", "value": "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443433, "uuid": "1c29b1e3-3e59-4f2d-8c11-102bc5892414", "comment": "Malware payload (DeerStealer)", "value": "d3fb1e0af557b6153c0496d25d9d93a1c2d3db29", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776443433, "uuid": "cb2e6102-86b6-4be5-b724-cfc6ae9ba048", "comment": "Malware payload (DeerStealer)", "value": "7dcdb43a50586dc235bc4b6ab99e3cee8f990faf03011af0dc787741d00859e579ecf6bd07ec5f7f9e940b11ccd600a4", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443433, "uuid": "e19c0be0-b85c-4354-b842-fc27ba579c0f", "value": "T1C94633437F808DF1C561C7B9DF1D9B1052B3E3A51A910E0B53DCAF49ADE7960620B2EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443433, "uuid": "62dafd9b-db5f-4e51-86d5-e2015f2a7400", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443433, "uuid": "08e1cbb6-b836-4e05-919f-15a74b85d0b9", "value": "98304:+pnEag1fPyl5ZbvjqQxjMZ20ua7KICPwPrc0tYyT5TYgt5nYUfzPLjJhTyENf:+pIPyprhxZ9IFPrctWT33nJf7/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776443433, "uuid": "6ce41d65-a42d-4396-9448-c7cee2614ecd", "value": 5515767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776443433, "uuid": "43847826-95a8-4b15-a6e7-3277b499673e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776443433, "uuid": "d9a93504-2a28-4bdc-b46a-a61b03e0264f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d557d9-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458528, "uuid": "fac40762-7b2c-47cb-aecb-7f59c2bd68dd", "comment": "Malware payload (Mirai)", "value": "e9deb20f04f023d4ab34685c2b1ce52e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458528, "uuid": "1a98cd02-5227-477f-8379-2666d468623e", "comment": "Malware payload (Mirai)", "value": "a017ca3c0a47d9896952b4517da6a8293b06dcb65ea2979616f92f6607bcfba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458528, "uuid": "8159fa83-70e0-4492-a102-7a0ac8bd283b", "comment": "Malware payload (Mirai)", "value": "a011d00e2c2d177f7c45512682808ad7cb83b670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458528, "uuid": "4d53d812-a7ad-4df2-996b-ceb68f07c41c", "comment": "Malware payload (Mirai)", "value": "282bbe34966bba0360762bb56985db5924d04d9b84ca2a6a3e16b825fa363387174d93b264730ff5a0126c6aca40e837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458528, "uuid": "654d3db4-1efc-4613-a35f-6a338c9f9ef9", "value": "T1DBB31846BD428B13C5D221F7FB6E018D371A17B9D2EB7102DD2AAFA0375A4970E3B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458528, "uuid": "baab08a0-73e0-4d19-aec3-7273f92a0a61", "value": "3072:EqRVY/eZn6OusUfyWBwZf69hMBAbsOp1Yq8OL:ks60UfPhM6bz2q8OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458528, "uuid": "80f75776-6bd0-4d23-9a1c-527f66653daa", "value": 112896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458528, "uuid": "30a92374-c36f-457f-ae9e-787457845836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458528, "uuid": "2215776c-1080-45f1-8bdb-bce8b3814a12", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dffbad6-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435642, "uuid": "5fb79f44-ae97-43af-8191-545ab7b904c2", "comment": "Malware payload (PhantomStealer)", "value": "68d00f516273cf6094fb1b1f03884192", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435642, "uuid": "6dcafcc3-02ac-43bf-bd47-5636c7b3bebb", "comment": "Malware payload (PhantomStealer)", "value": "a062606c44ae9c05c76f5ebc5d4f305197920582f0fe879788c7b263d3d73662", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435642, "uuid": "cc5d6c4e-a679-4a47-8c70-1c6ac5ac2595", "comment": "Malware payload (PhantomStealer)", "value": "a7dcb287260f25f5cd8c4f3b3d38a9bc4aa18e10", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435642, "uuid": "6ba5b36d-3de1-430e-a641-d18fca45e20a", "comment": "Malware payload (PhantomStealer)", "value": "814211ec48c330e26f4301033d00791249aec8de0ab3e2b2c5a6f2ce5e776616256ae80685981387f0fec78863d8438a", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435642, "uuid": "6ee39c01-44d1-4dda-a80e-9ce87cb1b0eb", "value": "T114C57FDE2096120432596A14B4C30E12BDF47BAB135F777A56E2FBF002887EECE56497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435642, "uuid": "4bcb9d95-596f-4cfc-8e6c-58de911de000", "value": "768:Ru465nzDUbX6NBiM2gY9jwzU3ajN9Twvmr62sj+W3N+EoWUmyV83xqYQUC2l1l/5:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435642, "uuid": "7dbffcb5-8d69-416a-8aa7-66a6cf62a8f1", "value": 2670105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435642, "uuid": "0e8ec51c-8bd7-4283-a6b5-d603ce2a5e0f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435642, "uuid": "46acc165-ca93-4ab8-9885-c75122d03067", "value": "Bank_Details_Confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089faec2-3a04-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392442, "uuid": "a7cbcfb3-48e2-4aa8-bc83-7c368b9471aa", "comment": "Malware payload (Mirai)", "value": "605b41f3df18243969918d4013878ded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392442, "uuid": "abfe3efe-2a08-40f8-9392-871fe3e9889c", "comment": "Malware payload (Mirai)", "value": "a0f8d5bef02363ff8d1daefc800d5152b0e637641945e780abb39585ef0261c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392442, "uuid": "c0c526f8-5378-4687-b233-2bf05508c350", "comment": "Malware payload (Mirai)", "value": "67f5d8dd0bf520e5ee4d25c3244dc2b4c4602c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392442, "uuid": "8cab39f5-b21e-4f7b-ae5c-60e0421b4727", "comment": "Malware payload (Mirai)", "value": "e970f7aee71372d31f459514ac2b5f68d76a0baf8facb86a93c59f222d602165d9da8a2fb6358658a9008b90408d9a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392442, "uuid": "7e467f95-66ed-4096-b9a4-3ec095232771", "value": "T163437CC4AA83E4F5FC9701751033A73B5A72F4361069DA87C769D83BBC52A11EA1B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392442, "uuid": "585f8c93-3b88-4e59-8d7e-4a0c4caa64ca", "value": "1536:ZyN5z8bAOpvnd02e98v2PORI7yguDTCJSz0RZ17+v2nzhNKSf:0N5wUOpvnReO2WR1Cgz0r1K+nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392442, "uuid": "94fb0c16-e4c3-4cad-99f2-cf73e923d914", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392442, "uuid": "9a7fc489-bf1e-461c-ac62-194393ea0b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392442, "uuid": "9ee80a72-05e4-41a3-8523-57e3a4c33a35", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa212fe0-3a16-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776400444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400444, "uuid": "42662821-e7ae-470a-a25a-8afb13cb8b0a", "comment": "Malware payload (NetSupport)", "value": "f2e67b07a22248e8b91da525b71b4672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400444, "uuid": "280483bd-b1c4-47ff-aada-fd2533db6f47", "comment": "Malware payload (NetSupport)", "value": "a11e4aca1a2d9480a10ec40c3cafc650107816b032460234490612c8bea692ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400444, "uuid": "b3b511cc-e0d5-4a35-8abf-4f5800dc3923", "comment": "Malware payload (NetSupport)", "value": "b2b8b6cec8162f9f27765857358fc24e6e546976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400444, "uuid": "8dfc36d9-96b7-4bf5-bfb6-cc1c4ccf675b", "comment": "Malware payload (NetSupport)", "value": "c968da89355bdbcff8c4e43231feed994fcb859a79a0f555b62f9419d30fbbe25a2e516a82cf721406a6974c9812b157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400444, "uuid": "3ced18b5-a11a-47f7-b768-056f04f9d769", "value": "T131F55C0BEDB94CE9C099A27484336216BF647C401B7273E72AD5B3642E737F0A875B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400444, "uuid": "be187804-6506-49cb-bc4c-64579cedbaa9", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400444, "uuid": "fff54db4-6538-4e64-a2b5-0f3c0666bc81", "value": "49152:v4xD/kul25iPcUCnRGxLPG9xA9W5UjE9clItE:v4vuSUfiU5Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400444, "uuid": "90622afe-f904-4150-b0a7-d632d277214b", "value": 3602864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400444, "uuid": "a862ffd3-b485-4a19-aaa7-827d61d5e023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400444, "uuid": "62995ef4-385d-4827-810e-0d9cbdd7947c", "value": "SecuriteInfo.com.Variant.Ulise.596178.6583.29306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b7b5d9-39fb-11f1-a769-42010a9c0008", "comment": "Malware payload (VShell)", "timestamp": 1776388622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388622, "uuid": "f05beeef-d73d-4286-8c1b-6d51cbd05086", "comment": "Malware payload (VShell)", "value": "a6cb3c9924bfd17433a44fd205fad209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388622, "uuid": "7807e274-48bb-475a-9406-ed25db11b2c8", "comment": "Malware payload (VShell)", "value": "a3c44344c6cf05470bb2c65099bec2229152974e229011c51185e475f07c80cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388622, "uuid": "6ce72714-cc14-4229-9c12-33ab94f846e2", "comment": "Malware payload (VShell)", "value": "b4f2ea0d29d3a0df6436a49edecfaeaca6324375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776388622, "uuid": "1e0b1822-8be4-447c-b753-cd91c409f5c6", "comment": "Malware payload (VShell)", "value": "af487e13af31f9493d7f422e08fe91aab272e686bcda61497d1d02edd47581d88c78ef17f65a42ba024933b19286d85c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388622, "uuid": "3ef4d3ad-6354-40d9-b0c3-be2be3d8b284", "value": "T1C9763345A20208E1E86A5EF985553798EF72FC63036081A6421F7F2A7E732D14FFE257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388622, "uuid": "840bd89b-3398-47e4-a326-69b0e8fd8942", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388622, "uuid": "a898f4d8-1d11-4b04-89ca-1c05faf482f5", "value": "196608:1NcCB9onJ5hrZERViLHdNpJA7R8svV/aj:kCB9c5hlERVix7y7RrvVij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776388622, "uuid": "8808fe87-83a1-4aa6-8239-ec1c03125dff", "value": 7598077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776388622, "uuid": "1e5d2710-8194-44c6-b73d-ee6041931ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776388622, "uuid": "6e860911-fd08-413a-b1ec-b9282ac4fedf", "value": "\u91cd\u5e86\u5e02\u4f53\u80b2\u5f69\u7968\u7ba1\u7406\u4e2d\u5fc3\u4e8b\u4e1a\u5355\u4f4d\u6cd5\u4eba\u5e74\u5ea6\u62a5\u544a\u8981\u6c42\u901a\u77e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18680492-3a49-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776422104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422104, "uuid": "62c1237c-4631-43de-a709-74369af91130", "comment": "Malware payload (Gh0stRAT)", "value": "9d8d2e45d51b64a3c23b8c541cd24b63", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422104, "uuid": "29b54dc2-ba08-47e7-8875-fde7b4e74165", "comment": "Malware payload (Gh0stRAT)", "value": "a4ac7e6a322f8ad738247897c50c4e272ee9b3ff331576b0ac5f86e389b34086", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422104, "uuid": "f0c0c6f4-ea11-45c6-980f-f946bef95e0b", "comment": "Malware payload (Gh0stRAT)", "value": "f8f204929c4627dbf8fc9fbe9f18fb9d7023ae81", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422104, "uuid": "24530be2-c64a-41d8-a805-337c64969e87", "comment": "Malware payload (Gh0stRAT)", "value": "0854a723ee68c8fe9a4b20785c2697615e6d413aec1e5045d8006ae4438f1935a18b361c7bcf6a87084f75a6cc807978", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422104, "uuid": "5754485d-8a39-4883-99f2-79f912f9ad8a", "value": "T12A173313A2CB663FE07A8A3A4E73D217543F7661A5028C53A7E4086CDF255D52E3F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422104, "uuid": "43aec1f1-9944-4291-89c9-593268d975d1", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422104, "uuid": "82659222-dcad-4fb8-aa30-b20366773e58", "value": "393216:CbynJg8JcP4Jg3BYP6yzIx383N+zIkIAHstcrZak9FCjkslYc7LS0n:lFc4g3aPDI0N+zmElaqkASLS0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776422104, "uuid": "e9a1a824-58c0-4175-8bf4-912262228be1", "value": 19540148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776422104, "uuid": "1be43cdb-6f4d-401f-9751-a7650177235d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422104, "uuid": "a984da98-56e9-4917-87f9-58f82a583a12", "value": "lest-latest-0.12.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b5dccc-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776423527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423527, "uuid": "278b2db1-7e72-408f-961b-2b975d48429f", "comment": "Malware payload (Formbook)", "value": "47a750d084284a01ba7ad138ef8c6f16", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423527, "uuid": "689e42a8-24fd-451e-97ac-2b443c0e8943", "comment": "Malware payload (Formbook)", "value": "a541b7ffad0c788b1b80d8476339627980d5d4142ffb4d3b8a89b90beb0e95ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423527, "uuid": "ee6a263f-f5e0-44b5-bc67-0ab9fc755e33", "comment": "Malware payload (Formbook)", "value": "b65b6dd6b6f5962334bda884af8ccffc400ac6be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423527, "uuid": "630841c1-1826-4f19-b1fa-46cb28ac4235", "comment": "Malware payload (Formbook)", "value": "544c1be6863862d34ab037444c1ea4e44bbabbdb80e65473b9ddd21ace12690797c76fe0de0beaf839fd59402c93d41b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423527, "uuid": "d87c539a-e2e7-4d68-b914-db719275e945", "value": "T120A5025689C43FA9CFE85A1D40FE1A0E63F04A8B445AB54AFF33BD4BBFA76004117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423527, "uuid": "793bc664-bfa8-4af1-b9dd-080c5e398348", "value": "24576:b3Iy7MYu8Bv5mfDQoHKfc+EZKGvmAGM8tT54wQp7udJ+4XQ6NYiewcFE1DC7Cqjm:bYCucm8oIcxHGJTk4XjKBby1Dacum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423527, "uuid": "5f31f110-2742-4e40-a070-ddd36ae26846", "value": 2100462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423527, "uuid": "4f556a20-54dc-4da3-82fb-369f6b020ca0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423527, "uuid": "9a8d2f17-afba-4fcd-8021-026b662f6c1b", "value": "Bozze dei Documenti di Spedizione \u2013 Conferma Indirizzo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed638c8-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776434597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434597, "uuid": "686ad52b-3bdf-4ded-8c51-62255bbecfbf", "comment": "Malware payload", "value": "4600507acdf37e999d5366c3c68b29ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434597, "uuid": "0ec2ff79-76a1-4495-8001-8edb3d630cd8", "comment": "Malware payload", "value": "a5f95a0eff12fc9dfa47f23a55fc599a8412877d2ab4a4c95f20a61bb816d071", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434597, "uuid": "a079630d-e2fe-43b5-aacd-c28a2a500204", "comment": "Malware payload", "value": "5848f6eb927aee7b0e892ed5c1f965c710d4224f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434597, "uuid": "b2674649-00cb-4099-9156-f85bf6c7163a", "comment": "Malware payload", "value": "14db38fa5a270e2bc5c5dc42ae8d6047acc6125ed2477317f353084de39a906d607599ea9d55061e703c33bde968b7c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434597, "uuid": "cbe60cf5-94c7-4ef3-92da-4f2c0e087468", "value": "T1FE640D38ADEA402A7173EE14AED47497E96FB773370E584D10C1038A472394AEDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434597, "uuid": "5474cb7b-9fa6-495c-8951-fcc04ecb0b77", "value": "6144:T8PvsL9FmEU/nCq2FIGRV13ofCbhKIoDE032LEaRmwaxH4T:wnsL9FfExaIyX3ofCbhKb3KBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434597, "uuid": "ed3d27b3-460b-455d-84e6-547816335c9c", "value": 310270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434597, "uuid": "f4883f53-edc2-4b9d-9760-18333d7ebe95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434597, "uuid": "e60aa749-a20b-4847-bbe5-2d6ba94ee40f", "value": "Purchase Order # CCI-357911904.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd76d69-3a7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776444873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444873, "uuid": "b093a943-0f73-4e17-bcaa-8e1472f5ef7e", "comment": "Malware payload (Mirai)", "value": "8558df897a81b6929e79caa3b89fc3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444873, "uuid": "8b307f8f-9d00-4fc8-8dcb-b6ce83e52c6d", "comment": "Malware payload (Mirai)", "value": "a72a51189614f7929b0d93195844bc1ce2994aec3aa715d399cd9e466b136cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444873, "uuid": "937d98a5-ba55-4b32-ba7e-6624afecc88a", "comment": "Malware payload (Mirai)", "value": "57f4cc8273b6a6c744332f1d273e7f5d5542cb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444873, "uuid": "56d56d7a-efa8-4b5b-9317-8af543552561", "comment": "Malware payload (Mirai)", "value": "3fc85c0cfb1d3f877d4494fab017c84df96161a96df4313bee44029d0c15972b1427454bf63be4af4041a82209ab3dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444873, "uuid": "1f1be737-9172-430d-86f8-08e2c6dd5fa7", "value": "T1FC34A61A6F228F7DF7A8873447B79A24975933C627E1D585D26CC2105F2028E642FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444873, "uuid": "80b91184-3c9a-48ea-bd3e-662e76ad8cc0", "value": "6144:FSjRrm2LUZf4fB7gDbmUU6448L+kwtfDQqBoqHUobkxGFwIJ7VlafKTOmljnmqZo:Z1nfa+OoqnpnJcPmrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776444873, "uuid": "c3fb07be-aa90-4ae6-92c9-360859682545", "value": 250276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776444873, "uuid": "6dcec7cd-e035-40c1-80ec-95fba3065d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444873, "uuid": "9183e517-b848-4c7b-b6ca-5e97ad387ab4", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ba48b0-3a88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776449325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449325, "uuid": "71dcd70e-ce8d-4469-8067-a7e28cbc9990", "comment": "Malware payload (Mirai)", "value": "9ef79f1466bb0355e9bd300a9b41714d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449325, "uuid": "87ecbaab-7f00-444a-a3e1-9f6bbfaef378", "comment": "Malware payload (Mirai)", "value": "a7923256b7d6989cb7868bd0ce52ac755c3f7181d7c394853681d17f203fe53c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449325, "uuid": "852fd743-0fa2-4f36-bcc9-12f1f6781863", "comment": "Malware payload (Mirai)", "value": "510493ac136ffdaf0695cbc7f91cdd7c00ae49c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449325, "uuid": "519a1f49-5a65-4f68-81cf-a144aa94598e", "comment": "Malware payload (Mirai)", "value": "a4379967a901ab72b73caf3b99d3888b7c28c9339617f7a953204f59e27f9613f32da4ecd71b13b48ec9140b61c65e52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449325, "uuid": "b97efbef-71c6-4339-9528-2713e63b8cdb", "value": "T1E7931991BC82962BC1E023BEB67E528D336667A5C2DF721BC8255F11BB8950F4D73B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449325, "uuid": "1221221e-dd66-4343-9e56-df35372adbad", "value": "1536:dIjgZXYVPubGWDGXew3L5gGSSoA2zL4d0GFV76khKLz08YwHJWsn4lb57:mjgZ4ubGW8dPF2xh4lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776449325, "uuid": "c7ef739a-eb31-4ef5-aae7-c0f91b907a00", "value": 93336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776449325, "uuid": "1efa4527-8df3-4aff-af05-96caa55772b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449325, "uuid": "d526235b-b9c0-4bc9-9a75-cfec0e721735", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f197a9-3a04-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392429, "uuid": "d98fd7e7-c8b9-486b-b2a1-22ea61424e33", "comment": "Malware payload (Mirai)", "value": "bbc9b7bd8ad328e3c9073ffb74a06c6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392429, "uuid": "06517b19-4d16-4cae-b87a-998e7a1ad74e", "comment": "Malware payload (Mirai)", "value": "a7a869bfe672dc97e0fd9d37a5aa5057627349b837330b81cf395fc2c4976fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392429, "uuid": "0fdc7f8d-92d0-4976-b224-856d7c2990a2", "comment": "Malware payload (Mirai)", "value": "d8e8addcfdc880ffe191de0f12ac85b767132d00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392429, "uuid": "8c38ee63-0c46-4a35-af86-f03f10a288a0", "comment": "Malware payload (Mirai)", "value": "d665058b4babafb761a8f66f160898e3c6f40d8ea25a79d110887e21d0e5c39ebaf809098779da2a5dc830801c2c1e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392429, "uuid": "ce955cdf-8b82-4a87-bd04-0d40f6ac2ce7", "value": "T18F732ADBF800DDBDF80ED77B44530A0AB271A7910A930F366357B967BC321A45866F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392429, "uuid": "12d9c9b6-b661-4b84-9375-a98228b10157", "value": "1536:/dOKk0xI+8XQPsZWhVzEE8Vyf1FuhpUhaqPUz96Nn7GdKk2D0Vm8Nx:/dOKzxI+vschVzEnyf1FYhqMz9KW2D0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392429, "uuid": "582bfeac-7339-477a-8fa6-f4bdffda01c2", "value": 80348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392429, "uuid": "f9a3daaa-a96a-4297-a3e2-b441567c859e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392429, "uuid": "fae49a76-a7ce-4b54-85b2-f610024236fb", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8546e1-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776404209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404209, "uuid": "71c48a81-ea3c-4d5c-a91b-c6c375c0b099", "comment": "Malware payload", "value": "343643336a38364c3aea6e016f9ce8db", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404209, "uuid": "32387447-f736-4e13-bce9-2e033a44e49f", "comment": "Malware payload", "value": "a83599e01ec4fef7b0cae88532c258bde1037b1f80303bad686532352912ae1e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404209, "uuid": "501075f8-f404-40a6-95a8-3c2f93accf64", "comment": "Malware payload", "value": "f0c9ab66fe146d9cc9dcbee8d0be6309fb8feaf0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404209, "uuid": "ac3fe412-ae78-4f94-952c-5f4e49f0fb9d", "comment": "Malware payload", "value": "61da1893784c66c005b8ab66d0c8437121b34da16954146a754673959f8f5748fe6a041e1d154d88576ed24e1d514f83", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404209, "uuid": "087f52d6-4d13-49aa-b3c7-c099e1320727", "value": "T1F9137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404209, "uuid": "1242a1e0-43cc-49f5-8a38-a338675a2e22", "value": "768:bdXRWNGxVJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bnlxYco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404209, "uuid": "a85fab6d-24e9-4d98-8f62-cf0301dd90e4", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404209, "uuid": "ed738301-e660-4096-a6db-0d789fb10e0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404209, "uuid": "105db10f-61c2-4fc0-9760-8f08232fb3da", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e029d07-3a18-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776401068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401068, "uuid": "07a77ccd-8780-449d-bd73-941adc80f5a6", "comment": "Malware payload (Gafgyt)", "value": "3f057c3fbf44c7a27568b036359b1ba7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401068, "uuid": "190efa3b-9635-47c2-aef1-5d080efc0dc0", "comment": "Malware payload (Gafgyt)", "value": "a8f89b35bd39d25e86109117fcc056edaca7f5c9189d20462709560e41bd2c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401068, "uuid": "243bea29-7088-41a2-81b1-aa3a2e1634b9", "comment": "Malware payload (Gafgyt)", "value": "dcdb76eba4134337d7502d29aced2b2e86349a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401068, "uuid": "0419c81f-2e8b-4150-b72a-00e17f0c1bef", "comment": "Malware payload (Gafgyt)", "value": "c897da45d0f4c8d7c77f72e0a5e41e36442f6290161597f8a91ebf9166a393f3403bfdbc1f84f4dd2a412a37a37f7626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401068, "uuid": "a67714c2-d6a3-448b-95ab-9bcdac08e2c2", "value": "T1E7C31B41F945476BC2E337BAE74A438C3B355E2857DB33156938BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401068, "uuid": "61662be9-7845-447c-991d-d53f5960e10c", "value": "3072:dRtUpepcQZa9CArxN30sClmBoHQuQekQnYW:dRtQQ4RrxN3imBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401068, "uuid": "cf99b714-6338-4546-8061-7acc04d64cc4", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401068, "uuid": "901c1b9f-406c-44d6-a185-3bfa83c2c8a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401068, "uuid": "afa98f3a-e683-406b-8009-0070b579846d", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9256fa05-3a77-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776442065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442065, "uuid": "c70742a3-58fb-4d31-bb64-18c17b7888a8", "comment": "Malware payload (WeedHack)", "value": "a5cf8bbba30068b02018d55acce90ddb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442065, "uuid": "53248593-01d2-4bff-9763-c8909147e287", "comment": "Malware payload (WeedHack)", "value": "a9490c6fb7b091f24abc80edf1a88b500fbcd9cf39cc3ce75f977a8a2f72d054", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442065, "uuid": "30bcb917-3d52-4492-a458-b4aa7b287dc2", "comment": "Malware payload (WeedHack)", "value": "e9e9935b9240d880242e008f80124ab7f452cef7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442065, "uuid": "50ddf9ee-93c3-4a9d-bfba-bd8787b43462", "comment": "Malware payload (WeedHack)", "value": "e9fa5b61852ed370e1dc02cf8a26e1b9101e1e635527b78df3d0f8b775d790c30ea66ed6d68319f59a3545ba29dd10f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442065, "uuid": "ca54f671-6381-4f6f-9ee9-eadd54118d3a", "value": "T1B2B2CF7A830BC208E4178739D6CAAC677A5654C68441B73FE0B0939F47A6BEF4B84F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442065, "uuid": "295f89a6-834d-49cf-9869-81849a22be55", "value": "384:g3w9gntIac1iAhqslHFQaAPYMfqZBBkSuHrBBOtYc7YNdLGqYDhp63dEou9dG07W:K9ne1icpFgPEOSuHrBIYDFPdED9dG0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776442065, "uuid": "086048ae-cccd-4f85-bf5d-ad019a5e2f3f", "value": 25648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776442065, "uuid": "dc72e338-5059-4161-b197-0fd6acfecea0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442065, "uuid": "6251b218-ac4f-4dfc-b16b-31b519262de8", "value": "Azolek-1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9df116-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434430, "uuid": "c177f5bc-45cd-4a0b-8940-61208aa72fef", "comment": "Malware payload (Formbook)", "value": "bb086bc87a91608789a2104b5c67fedf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434430, "uuid": "466755d2-e8b7-4aab-8315-6b56c6522f36", "comment": "Malware payload (Formbook)", "value": "aa42661229c9cff9f0dadf07c4d4a0ef58b44446ff7838e80ed99dcd683e074f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434430, "uuid": "9364f427-b6aa-47e0-970e-962146272de7", "comment": "Malware payload (Formbook)", "value": "4b8eade1c0d23c1db0b32b878983af393f2b46df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434430, "uuid": "f8be7a8e-a594-496b-bce0-fc9085762bb7", "comment": "Malware payload (Formbook)", "value": "b7ba97bfd349fe82fc91afe07c7bcb3adf312963066460389a6a07627cac2fa57566c628a89e52620d7a43f490ad599d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434430, "uuid": "35ba4b6d-94ad-4892-9979-37a626f6bd97", "value": "T136A5025046C43FACCFEC561980FE160EA3E04E8A9415B989FB73FE4ABFA7A045117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434430, "uuid": "1b85d07f-c730-41e7-90f3-12393072101a", "value": "24576:Tf86Og5uViQPysE6qnUMFKuGa+uwZx9vfcrn9tHH3oD0kgv9SNgYqdb:NGVab6UBKE2bvfcr95u43pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434430, "uuid": "bbcb0e7f-504f-41df-af08-5cc1acfd1888", "value": 2121921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434430, "uuid": "b2880e2c-bed2-4121-91ed-3b95bf933443", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434430, "uuid": "037b9e0e-1f66-49b4-a204-3fd89b9d57f6", "value": "Offer Quote #2026-025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bbbdc7-3a7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776444814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444814, "uuid": "1be5a5c1-c4de-4adb-9bce-951c17050cc0", "comment": "Malware payload (Mirai)", "value": "820afc405bc29e457059ab7215c82acf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444814, "uuid": "ac27a773-20a1-4456-bbcd-50d15c2ffb6c", "comment": "Malware payload (Mirai)", "value": "aa610c3c269bd0aff635dfde2741234a8247dee9c44a9eef57468b402fa86627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444814, "uuid": "af59b965-ee85-4b5c-8e74-735cd54ab445", "comment": "Malware payload (Mirai)", "value": "10b0a042e116ba1c829201b9ab71558744697b93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776444814, "uuid": "b7ba4be9-42c8-4118-adc8-a49927e5d952", "comment": "Malware payload (Mirai)", "value": "913d3b96fc1767d333e77a7b4c6d78b8384ba767e318afd65a4dfc2ff744dc78c588ee53ce85ba989609f298403cfca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444814, "uuid": "2e6742e5-d74f-4bd7-88da-cc78c3ba38f0", "value": "T11493021667978075CFB0A09331A80CAA2D1279B496FC63031FDB2A6077D6AC48D437CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444814, "uuid": "788f6cc8-2048-4a25-b06b-367f2573937b", "value": "1536:z8lECoavVOGLz+XP5c557hf38v16QtFqHODF6pJnELohyc3Xu+FEYkaKhYFi8d:IlPoatz+i55N3EXWuDQLnELohycuJYgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776444814, "uuid": "84522de4-f1e4-4747-92e3-084f2f87cbe3", "value": 88908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776444814, "uuid": "9c801a52-2bb5-4cf2-ae6b-aed381e1d114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776444814, "uuid": "9eb85508-1087-4726-a72d-3a750d835fd6", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d603f8d-3a55-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776427427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427427, "uuid": "dff9b960-6400-4598-8844-34fdca74bd41", "comment": "Malware payload (njrat)", "value": "7f59c9e6705c0ff10089977639515673", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427427, "uuid": "717a078e-dfe2-42e6-b50b-90bf8b3781c0", "comment": "Malware payload (njrat)", "value": "aa9c31a09d58142f32bf306fbfc628d14467a68e05bb55ef5c2fde98b84b0688", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427427, "uuid": "83e26ce3-87d7-4870-a7c5-482d85f0541e", "comment": "Malware payload (njrat)", "value": "53073c6a07c8e07645fc791b9c62ce274003f6fc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776427427, "uuid": "eb8c1241-250c-44f2-a2bf-5fccc9166fd7", "comment": "Malware payload (njrat)", "value": "a075039f7029ce30dc27dd948629b1320d66c70644618798ef07f3edff1a02f37add012d3d9b27dab50201eb0f7a5354", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427427, "uuid": "6cced761-9bc1-4dbf-a57b-b0b2b280cfab", "value": "T15945334B23952650D60E4234AEA9E3B177346E4577E28A4A843FB1CC3DB1780D3D9EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427427, "uuid": "338e98ff-c304-4170-b2bc-9bae33a172f3", "value": "24576:rbDObES4F4spC4yT+mTnmI53LTF6LFBqQ+H9seck1Scmm0RUnwF:P0HamTnm43LwCZ4m0Gnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776427427, "uuid": "d115ba48-8624-42a6-b537-dc05f6ea9f0f", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776427427, "uuid": "f8a07f6d-bb18-4514-a195-7faa3fee3bcb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776427427, "uuid": "3b3dd44b-8492-4941-a473-c8efd9a07575", "value": "T_setup__V4.17.212.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c49cba-3a6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776437699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776437699, "uuid": "cf945db5-1887-4eb6-ad2a-05fc3fdf5a02", "comment": "Malware payload", "value": "5de45b3da83aaa2ad64a55ca7ca69642", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776437699, "uuid": "fe096531-7716-48a7-a398-ea066a38f05b", "comment": "Malware payload", "value": "ab69ed7d6ab0e85a770847e0e763f68e87bfd6e1b560646c3690b7f4c71c5f26", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776437699, "uuid": "feeb92a5-f87b-4fc4-800b-2c5204ed0b92", "comment": "Malware payload", "value": "c335096ca4f33d5155fe2178ea82324841c5d70c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776437699, "uuid": "0f16e240-af5b-4068-8600-f3d8570732e5", "comment": "Malware payload", "value": "26b878c8bb61e21c040e0c0d8747cc8d2cddd8041a5454e2b0d2a5b14c5c5a9d0f5bafe1572747830f00f8b53e89704a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776437699, "uuid": "8917ca55-46f2-48aa-a5c6-56dc8798d680", "value": "T1DBC64A87F9A614E8C1AEC33489669663BB713C480B2123D71B50FF246F76BD06EB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776437699, "uuid": "d873033d-c15c-4cc8-a679-d8baea68c335", "value": "ae872242a8628b16d68845c52eebe7fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776437699, "uuid": "8b3ca0c7-bb89-47a7-aaa7-6cf5377e6a45", "value": "98304:2c+P7TefYemTdAm4ofj0R1lRLprDZbBGhE3y7U3mB5y:2TifYemT+nRdVnjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776437699, "uuid": "425ceb73-47df-4f36-9b1d-5c3a0cba6c27", "value": 11796480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776437699, "uuid": "8d1126ca-c134-485d-9c3f-b4a03ff18fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776437699, "uuid": "f5e0c869-2d36-46db-bf7d-3203502d9d5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e218e5-3a6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776438360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438360, "uuid": "b11672b8-837f-49b8-a517-ed501311082a", "comment": "Malware payload", "value": "ee254071cfa81c6f9e4c6b2cd9807c6a", "object_relation": "md5", "Tag": [ { "name": "irpf2026multa-com", "colour": "#D3D1F6", "exportable": true, "hide_tag": false }, { "name": "NinjaRMM", "colour": "#AE8158", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438360, "uuid": "d92122bb-2a42-40bf-ba1a-6176ab555e88", "comment": "Malware payload", "value": "ad6eb5d8a61159e40b5d0f1aea9dc12425d2afb0830b15d330121b2543331469", "object_relation": "sha256", "Tag": [ { "name": "irpf2026multa-com", "colour": "#D3D1F6", "exportable": true, "hide_tag": false }, { "name": "NinjaRMM", "colour": "#AE8158", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438360, "uuid": "3d4de090-3788-4c98-bb63-2d06d8778a8c", "comment": "Malware payload", "value": "2484b5a332156499415c50115f495a4ab23cf326", "object_relation": "sha1", "Tag": [ { "name": "irpf2026multa-com", "colour": "#D3D1F6", "exportable": true, "hide_tag": false }, { "name": "NinjaRMM", "colour": "#AE8158", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776438360, "uuid": "3159514c-4e21-4dc1-a9a2-bd35d0c9ef00", "comment": "Malware payload", "value": "9326caedc1ad80faf437bfd0d04981d92cc05c20eb93debf56593b4065c97aff564e5f6b47ad6561ab241139cba4d7ad", "object_relation": "sha3-384", "Tag": [ { "name": "irpf2026multa-com", "colour": "#D3D1F6", "exportable": true, "hide_tag": false }, { "name": "NinjaRMM", "colour": "#AE8158", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438360, "uuid": "c8d4ed93-51a6-4801-ab15-ac660bc00884", "value": "T17F11631D2B6C3CB8FA60D1BF1009E5D14C16B6A4FC042F3367F4E04E4E67828B9D61A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438360, "uuid": "4dcbfdab-dcad-457b-a374-8e0afe61aaba", "value": "24:93ztHGphR0IJJqJnuN/qI0EbIlAkft3utmbFPIWri2RzXx:9Zm50IJUtuNwj9f1dFw4b1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776438360, "uuid": "cbd50545-4b05-4775-9353-3752bfa04f5d", "value": 901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776438360, "uuid": "7224cba9-8a78-429e-bf34-39ac00dadbe6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776438360, "uuid": "11d202fa-8c29-499c-8d07-2c9d19d0d175", "value": "gmdxbvjkockw.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b980ab6-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776426431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426431, "uuid": "5b1427a3-3567-4bdb-ad86-4b1c79f46888", "comment": "Malware payload (Mirai)", "value": "4bbe607b2ba4ebe1f41e63adfc4a6a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426431, "uuid": "17118287-2aa1-4be6-89cf-a66532a71896", "comment": "Malware payload (Mirai)", "value": "add97f691f8bd8af5efe0480a90f12bcdcfa089f7432088b4ff8bd0606ff58de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426431, "uuid": "1a92fa2e-7c06-4887-aa24-d554ffd1ef7b", "comment": "Malware payload (Mirai)", "value": "78d23f781f3445fe820af8af266ca90850f60b85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426431, "uuid": "f48129b8-bbbb-4e71-9191-94d7fab4419e", "comment": "Malware payload (Mirai)", "value": "938720efe63437e635aeccbc9d78381cf87de8ce5719c08e6132a31e7cd80ebcd808f64328dff6ac250e6896951fa135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426431, "uuid": "44d78713-98d6-46f0-b454-0080967e7a27", "value": "T11864D08AEE00AF25E9C026BAFA5F034973774B6CE3DBB111E610D72936CA55B4F36045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426431, "uuid": "6ca5f0eb-0685-43c7-b674-a98bee8ba2f8", "value": "6144:p3lOYoaja8xzx/0wsxzSi5SDP99zBa77oNsKqqfPqOJ:p1CG/jsxzX5SDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426431, "uuid": "34247379-d2e5-4635-aa37-c210aba1d936", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426431, "uuid": "e2990fd1-e78e-4bc3-a164-36644c21bdfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426431, "uuid": "ff30a217-b4f7-4986-8ebf-a346bdb87e40", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7939e1-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456177, "uuid": "9e1d01a7-2d6d-4fd4-bd04-604710f814ad", "comment": "Malware payload", "value": "8f5d94acc22c5593ea2350f676e4846a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456177, "uuid": "5218bcd7-8e1f-4f0e-8941-0e436c1c7770", "comment": "Malware payload", "value": "adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456177, "uuid": "e66a3423-6c8c-4255-882e-7e947ffa5c9b", "comment": "Malware payload", "value": "6479eb53cff0cf75bbfd78f9295251c4db60dd5e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456177, "uuid": "31c67a62-8767-46d9-b029-c8780ec72281", "comment": "Malware payload", "value": "4b3d775ae7e3ed059d445c7df65eeb3c2e909bce7b90f24f822815d7cb57eb3ae43626c1a889e7354d29bb94385685f7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456177, "uuid": "ebb3b498-dce7-4ecb-b41e-0bdf2da437e7", "value": "T113D5F145FB999E1EC8F353760C39563A547A9823C743C383D9792679288FAF00F862E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456177, "uuid": "498f2110-a36c-4852-82ef-8f5538df3364", "value": "49152:7cjJbgYzJrksfW5gipFKVZR1WO/esOagDFehJ7AZ9mZEAXuhq+96U:7cjhgexLfW+i+VZRQO/esONiAZNAcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456177, "uuid": "97c8f3c6-1949-4169-b388-d16c078b6f8d", "value": 3016266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456177, "uuid": "db01eecb-b43b-444c-93db-766067fb1a0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456177, "uuid": "82f02422-c3ee-4934-bbd9-5c70b5a2acb2", "value": "sagawa(4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3115902e-3a81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776446197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446197, "uuid": "65158b03-77cc-4e2f-adf7-c08e50767a50", "comment": "Malware payload", "value": "c576c255c464563dd2590647c84c59da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446197, "uuid": "815fbccd-5713-41de-ac37-32448cad7bbf", "comment": "Malware payload", "value": "ae36f1dbe7414f267794c5d63db249a8611456114b3e618657b49a874ac12d6c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446197, "uuid": "085e38ba-ba05-496f-b8b9-3f46f602b363", "comment": "Malware payload", "value": "af9226f5e6fd03f11b782947993abd0ab3da3bf2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446197, "uuid": "f1e1c1b5-0a64-4921-b9de-4578d1dde83d", "comment": "Malware payload", "value": "e88e390f2b499e126fdf335fe714eebf841c40b40192879c33e178e632306ae7ecbb793d85c544a3117b199b9fbfd939", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446197, "uuid": "df6e229e-9e65-473e-afc8-ef9c1f170420", "value": "T17F137D6956857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446197, "uuid": "4daf4286-b715-4811-b237-810db045ff2a", "value": "768:bh+T9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bh+0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446197, "uuid": "d59edd76-a1da-4085-a65c-5531a824bcda", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446197, "uuid": "f222be21-dd03-46b0-89ca-2d60fb3b4099", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446197, "uuid": "b6dc2529-f483-4d87-bafd-bd8a72c11bb2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94493919-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440350, "uuid": "49a9c73d-454c-47c4-af53-230f4487a7a9", "comment": "Malware payload (Mirai)", "value": "c46ffc0e44dc51a2258f547943083542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440350, "uuid": "8b311d9b-8084-482d-a393-5ad2d9a0c655", "comment": "Malware payload (Mirai)", "value": "aec7929432c48afe30fd6be9e86b576e980bbfcfb11f6ae5e2bcd8a7505f1cf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440350, "uuid": "418f7812-4b8b-400f-b0e7-39f15520a34f", "comment": "Malware payload (Mirai)", "value": "6a30b3f9fa59d0b41ff099391b9d4e88aa2af7ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440350, "uuid": "fa7e0ba2-ecbc-4083-8093-f96b9a0d05e4", "comment": "Malware payload (Mirai)", "value": "cbd8c1d5bd473dd77acc6435e6fe2978bd0d9b5472a9e7661442ab0a138fc78c090d2df6b8f49967499c48db4108ca7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440350, "uuid": "61bc3125-95f2-40dc-a971-d0061df7d553", "value": "T1B133F1A2A38D9A59C7694C3B0D8B3F0F2539A71D8F5601B12D6C11292C9BF45F36E2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440350, "uuid": "dd9de91c-5798-4148-9484-9a08a681a9fc", "value": "1536:cLUxKzNNUip1vIHGaMJ5lVstfXM1jO3pT7nouy8NqV:yUxKzzPp1wHnMjlVfZO3FoutgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440350, "uuid": "375d3fe2-fbb5-4a02-9260-1620617f2eac", "value": 54532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440350, "uuid": "5061a4ef-c5a6-43d2-ac7c-c5cf0bf85222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440350, "uuid": "c9d94cf5-ce2b-4f05-b0eb-d9d2a77afc93", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caa323e-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776434996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434996, "uuid": "f404d008-1116-4400-b090-cd456628bad1", "comment": "Malware payload (PhantomStealer)", "value": "ecf16bb675b7533c99e86310e6fb3857", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434996, "uuid": "7ae40f11-eec6-4733-beb1-fa67e3e21716", "comment": "Malware payload (PhantomStealer)", "value": "aefdbe4df01ac90cae7e10c7d4c49b82a313bfd87b9095fdd6fcd70c5fe1b36a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434996, "uuid": "ec763eac-82af-4946-8692-5e894d757894", "comment": "Malware payload (PhantomStealer)", "value": "9f656efee474b1fc783b14a75abf95ae7fb9ae81", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434996, "uuid": "e9fe7847-a10c-40d4-9674-99de7234f3eb", "comment": "Malware payload (PhantomStealer)", "value": "86a4ae82f59b1c8f48d760a381ef2d040ab5b94fc596309de58b6fe4242db77abaeeb0ac5fc28a739be3b5ab6e7ca3bb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434996, "uuid": "99b474e0-a285-4917-8e9c-8c3494a562c3", "value": "T1D5338274290C45EF24D7EAB4B084A7E3FE6C0A5C9FED664F525087DA163EA8734C3981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434996, "uuid": "a6935be7-d885-4858-ab47-d5131e4cf112", "value": "384:CIiGaHfkhlW1qgCv4bfjSic05nvdNFS5r5S9:/iH/dDNfRX5n1NFMtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434996, "uuid": "acdc708d-9bdb-468d-812d-f233c983a6ed", "value": 53348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434996, "uuid": "08c2584e-7bb0-4c7a-808b-df18f8ed3155", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434996, "uuid": "a00ac2c5-9f00-4f2b-85c9-6b46faeb9839", "value": "DHL AWB674287468283782 DOCUMENT.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593e5218-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776434668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434668, "uuid": "efc1acc2-d5ca-4248-9174-c3f9da6cf28f", "comment": "Malware payload (MassLogger)", "value": "abffc482859bda995062099e1eda4f12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434668, "uuid": "13b7b9ca-c93f-467c-b01d-47f5800e5a6a", "comment": "Malware payload (MassLogger)", "value": "af4075090864dbaab0feefe9fbf188ef575ecda17256c6655ba5bc1a18111e49", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434668, "uuid": "36232853-ceed-4f58-9f78-c4e55bc62b6d", "comment": "Malware payload (MassLogger)", "value": "32d66b7bcb703bcba3147842a42bbd9c5d10e2dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434668, "uuid": "bbef73e1-ae33-4e0b-aa07-8a8183c9c07e", "comment": "Malware payload (MassLogger)", "value": "bdc68b97102c9a6155bec6c69e2f64c2161b20b93c7fe032ef740cefb2bd63be1e5f18712f8b0bdfca15172004532dec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434668, "uuid": "39996d7a-bd2f-488f-8823-a6e1ce1b8586", "value": "T1F6F2B49B75C6B051464730F72B27E51EB16E8C84750C8420FAE4B89DBC2DF2CD6BA9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434668, "uuid": "501a8212-d89e-4196-b6d9-e7aed7933527", "value": "768:EVx36snO7Oo2e4CvdWjJXhscC2buL3wZWoo/vsaFya3ICUzmNj5+:jYA0nKaRK3wo/vsaF5ICmuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434668, "uuid": "3d032513-d934-4087-852f-cc960663ab4f", "value": 35016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434668, "uuid": "73b8781a-be2f-4d1c-b4f6-ecbccbfb0567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434668, "uuid": "6b03c9dd-bd0b-4e94-a92a-eba1aeff42e4", "value": "Cipada.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05063db-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435780, "uuid": "68469347-234c-4845-af8a-dbd3581d82be", "comment": "Malware payload (XWorm)", "value": "ef534f50808c1e91e0e1d17823f8c5b1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435780, "uuid": "70754aa6-0937-4e0b-8376-08836987c5b1", "comment": "Malware payload (XWorm)", "value": "af5bc8fc2df1debff6eeeb376cb5bd84ae7a16f22eff147241f520cc9966e51a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435780, "uuid": "06ce9dd8-6c51-4546-8e4e-facddf780f90", "comment": "Malware payload (XWorm)", "value": "1d25262637f29232dcc0d0bc25e0f8db868119a3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435780, "uuid": "e12153c6-7af6-4b0f-9729-bf118b49fb91", "comment": "Malware payload (XWorm)", "value": "3cc5bf85b261731666d26a1abf4c278f8484994254669d3c19551fc0871acb1e382e4d05d561a2b86c3775e0aad4b577", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435780, "uuid": "0a796d7f-e1b8-42ae-aa0b-3a2ea332017e", "value": "T10F2146411BE96796E337CD320976F21107367951EE42D35D4660B18C4878E10FA75F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435780, "uuid": "73c7ce90-def4-452a-bbb6-98d7ea2ee48a", "value": "24:8KjCnmiwTXb8AWZ+/efVx4I0Wdz13z1NvMK28y/msdE:8Xm1TPlID1D1F28a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435780, "uuid": "cbe7c648-848f-4274-a564-b37381977b1a", "value": 1325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435780, "uuid": "dd87921b-f464-4a9a-abff-63ee4cf01a44", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435780, "uuid": "3549d59e-48ed-413a-922f-93b5008631c9", "value": "Password.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3c10e2-3a9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776456928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456928, "uuid": "3fb8bd09-3f85-4d65-8e84-25d3abc84cdf", "comment": "Malware payload (Mirai)", "value": "9da88eef9ea35b09d2e11a72e32adaf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456928, "uuid": "215ab033-80e7-4f56-85cf-c72b16fbd13f", "comment": "Malware payload (Mirai)", "value": "b0a12cc3b6f878647c01ee35a7ddfbcd58878c83e7e04fdf92bba3cffc663593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456928, "uuid": "26b76636-41d6-4242-ab55-964bbe452233", "comment": "Malware payload (Mirai)", "value": "864b80e423c3c32ea7ccd40e2e503d95f8e56dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456928, "uuid": "3aeaaa51-cc11-42db-b5a9-9d2a96f6a9e6", "comment": "Malware payload (Mirai)", "value": "2a0f4ddf75b63dd5e83be997ddbfbe6df9a9600c809afd8cd0c6bc033e90cbfefe87731f7e2490fc132b698745ca482e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456928, "uuid": "11db4a33-bf8c-43e2-bc8d-240c50b6cfc3", "value": "T10CC3D74B6F128F6EF26986704BF34A31D65876D727F18681E16CE9401F242CE642FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456928, "uuid": "1749bcc9-7249-4662-9b07-955056146d37", "value": "1536:jsyvmr1z0FJ8pYcoJx6j5gvpHAIJ4xtypbSDUM1bOQ7s2PrRbetaamBeOtYGe7aw:g0m+gwDJqt0SDd6+eDgeyAa2zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456928, "uuid": "5c4d9699-aff1-48eb-96a9-b895265aade1", "value": 129624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456928, "uuid": "8dfb7416-abaf-4166-934f-88982adb01a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456928, "uuid": "a68a16b8-b711-4902-ae51-bec6422a6985", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccd7037-3a76-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776441707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776441707, "uuid": "326d2758-aad3-4030-8766-df5a65e5864b", "comment": "Malware payload (ConnectWise)", "value": "d6ccac10e23c14d9e4537aec621f156a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776441707, "uuid": "b76e2818-66e5-4e02-a2ba-030a0c074413", "comment": "Malware payload (ConnectWise)", "value": "b10f221605f807870f2990b66784dee0007fe9501a30f8b7b2878cfa60d4b4d7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776441707, "uuid": "ce87e6e4-3a71-4802-b17e-e3b638c6b1f0", "comment": "Malware payload (ConnectWise)", "value": "149566e9f26b63ece76101e77c9f348cbd00523e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776441707, "uuid": "08a4c731-0df1-44fa-91d6-63c2d64e7221", "comment": "Malware payload (ConnectWise)", "value": "ec41e13757d5181bbf9aeaab8909b4d9e883d2036d6ead37857c210242bfc0126b5183fdec4caf68717a817bd8cdd509", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776441707, "uuid": "950b8397-9a96-498b-b242-b62bdc3ba562", "value": "T1162723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776441707, "uuid": "9db10828-408d-4b32-bf2e-bd048d6292d3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776441707, "uuid": "b050524a-0467-43fc-8c46-385316ca459e", "value": "393216:MhUOvTi7hha62C3N11SOvTi7hha62rOvTi7hha626OvTi7hha62H:MhUOvjC371SOvjrOvj6OvjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776441707, "uuid": "e14e9388-f5a4-4ac7-90d1-6f4477969bba", "value": 20511288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776441707, "uuid": "b7bc066d-4ca9-4e4d-ae3f-6a9e4680f63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776441707, "uuid": "b1919679-a81f-42d3-9025-a307e69ae9b6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c181551a-3a5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776429689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429689, "uuid": "8e41ee0d-d6a0-40e9-ad25-d93e9c91c751", "comment": "Malware payload", "value": "40298ce81a5d4f5af6e2ad65eef94d92", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429689, "uuid": "3a5f72b8-a9b9-416b-9e72-d5a9fd527754", "comment": "Malware payload", "value": "b22660a71f7ec32d151d1c0b330734ef453d65f6eec786c6876ce96e51808fdc", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429689, "uuid": "e19ce0de-4058-412c-bcac-60f9042cecff", "comment": "Malware payload", "value": "6a98fd0924523cdcb4f20cca3f166f76473eee60", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776429689, "uuid": "068dd04a-55b6-40bf-ba3d-008c4349bf79", "comment": "Malware payload", "value": "a9569c1d41978ef03d19de47eade4fd42c656b26d40dcfa8b851fe7fcdd0651ccb8b7544777b7532d65ebb61cafd5191", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429689, "uuid": "81631284-1371-4b10-a9dc-987e2e788cb7", "value": "T127E6239AF31CD82FC8B764319ABB032261570C458A56E7476519F12CAEF7AC88F19FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429689, "uuid": "02f0e23a-18a7-4f3c-9948-80666392ad95", "value": "393216:l1aLNlJOlNYqIzwjcab+Bkxsf65yqdbIU1xXrAPcpfP:faplwlNk6ci+ysS5yqdkU15AE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776429689, "uuid": "8a386b89-b4ee-4d01-a207-6ef007fce829", "value": 14605848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776429689, "uuid": "ef51c9c1-28a3-41cd-a191-41f2d7a55d81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776429689, "uuid": "32e60ae8-2e51-4d4b-aadc-a6c2f5b55f3c", "value": "com.allax.live.animewallpapers_1.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f91d2b-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452332, "uuid": "a9d18a40-2aa1-4ecf-b3b9-7b1137dcf1e8", "comment": "Malware payload (Mirai)", "value": "274b69fb84356f330c37cc050546d4e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452332, "uuid": "462dad30-6c47-4248-bbfe-c3d14c69e345", "comment": "Malware payload (Mirai)", "value": "b24dc73df4149584f1fe09e30c7d5b314c6661a7e81ced2528edcfd0ac8355f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452332, "uuid": "219a074f-1df8-44db-88f7-56e7c1396a73", "comment": "Malware payload (Mirai)", "value": "f9a1257123f7ab2441aa6bb36dadb5877f06275d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452332, "uuid": "45515f56-6b1b-41ec-9d95-424afd5906c2", "comment": "Malware payload (Mirai)", "value": "3731ec6a8fe870c7e798b7456daa56eca52efe9dc519b43885eece51a6fc202af026c04092fab78ac8538b04ee754922", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452332, "uuid": "bfeb9f54-982b-40e5-8e2e-2bad7a2e8e5d", "value": "T1F7B3E185FA676491D1A342F9949047C383A12D76CF9213480689FB38387D9FB1FADDE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452332, "uuid": "51c5b4eb-28e8-4749-a574-2099b455e416", "value": "3072:HB2BdeVRJsnC/Il5jC9SnMKfJyiA9HpNMMTnX:gaUCglCeMKwH3xTnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452332, "uuid": "a2cba634-06c5-4973-9dde-cf13f49b93db", "value": 115444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452332, "uuid": "4f7427e8-448b-47e6-a841-1c9fd2a842f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452332, "uuid": "0260c142-c552-41bb-b97e-dfca0860a7d3", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053173ef-3a49-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776422071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422071, "uuid": "c19d1772-6ebb-4658-bd43-f0ddda1794f2", "comment": "Malware payload (ValleyRAT)", "value": "aee728dd5bd247f2f96b2386989a8ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422071, "uuid": "5fec4614-e42f-4830-a3bd-170684027909", "comment": "Malware payload (ValleyRAT)", "value": "b24ebf90587e25daa475f46f9d2650e84b125c8ff260aa673617d5c75cf04ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422071, "uuid": "b4f92000-ce53-41f4-804f-fb9ad4e5d8ce", "comment": "Malware payload (ValleyRAT)", "value": "dc1ba155d130c5c98cc1488d1f06fc93606c1a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776422071, "uuid": "0500c0c2-4890-448c-80b2-96f6840a59b4", "comment": "Malware payload (ValleyRAT)", "value": "6951974954665845573811e64a77e1a3e7366568a8d82f5d646076e0ae2f46535c3a0659f863ec6457c074a3bc53b100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422071, "uuid": "5f58ffa0-cec0-4c70-b9e0-c56d64ffdf55", "value": "T1084733C349449DAFD724CB7ED297228D4931BB233712766B3A955700BC5310AE63BEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422071, "uuid": "a581f7c5-50f6-4366-b2bb-30b9462c1ef4", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422071, "uuid": "d4312459-3edd-4ec3-881c-ce630f1f6d80", "value": "786432:hbHDSt91MbKqyiGygwVpyZZYWF9FGWSZ9o5AO:VDSlMDoyg8WpGWooCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776422071, "uuid": "0477dcff-cec3-45fe-820a-296507a3aef5", "value": 26335428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776422071, "uuid": "e907f0f2-3e77-42cb-a9a2-1970b3e0e93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776422071, "uuid": "2feb019a-0c7d-4671-abb9-a3b02fb829fb", "value": "Clnrome51b7-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691096b9-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435124, "uuid": "e1e95ec4-d3ff-4cb8-956b-c98eb5244f60", "comment": "Malware payload (PhantomStealer)", "value": "21a1309d493edafc14d16cfae2858659", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435124, "uuid": "590ead61-2ffc-41c8-9263-ccc99a3d0546", "comment": "Malware payload (PhantomStealer)", "value": "b31a02caad591b90d832673d25c533524d1a3a73a4d3208abce82fe74ff22997", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435124, "uuid": "d6bdbbd7-95b5-42d3-ab81-dcfbb4ee3daf", "comment": "Malware payload (PhantomStealer)", "value": "ac01d136917bb81a26572f42bafc7f95aaee09d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435124, "uuid": "dd2b59e3-2be9-4fe0-908b-48a76c3136ee", "comment": "Malware payload (PhantomStealer)", "value": "b00f84614687638a4f5e40d92147ca2968cd03bd5ee31e1909c31597acadda80aff85b535cac19a585f9eda99cc0d5d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435124, "uuid": "c0059b2c-7272-4202-8a3c-e2ae0f963be3", "value": "T1366325E925CF8C0CBD6BDB02F316275CC9E674930B303636A6671688EFF794A6A14474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435124, "uuid": "d1fffed4-10ef-4f05-a050-9b868dd93804", "value": "768:hC71U80/mdqV61bt0INWELnqKId7TJh1TAsSRPkr1ruFzYW/+AQbCi8VSrhqWS4X:6y1hQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435124, "uuid": "122db3c1-26dd-4c9f-9a1c-3daf3c264942", "value": 67120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435124, "uuid": "55804262-0db1-49b7-a1b2-29b955570e31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435124, "uuid": "6d4214f5-4597-44f3-8065-91ab94d97b5a", "value": "Factura.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8300321-3a5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776431928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431928, "uuid": "f0e71c21-2044-4686-9e3b-c313097f4693", "comment": "Malware payload", "value": "12947b9484bdae55d646dc02be4ef887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431928, "uuid": "5e5a3ff9-3afe-46fa-bd4a-1986105a9722", "comment": "Malware payload", "value": "b3243794f6d3ccc8d752c604683b1bc2233ee875c6c31cbda027ffc50a120a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431928, "uuid": "aee68bb2-2ae9-4636-b937-2318d2fc7ad3", "comment": "Malware payload", "value": "8c4a07db54a30d092acf9b2e87d7c045ebf40100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431928, "uuid": "0b0539a8-44e7-4294-950f-1e251015bf89", "comment": "Malware payload", "value": "2db33c2b50c46d158fa0faaee4ab641995f4615fc7679bf113215fa81dc4c8c9e1c80b7522ac479a52c21df55e08316d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431928, "uuid": "20f04b9f-dd56-41a4-a848-85f03b36de95", "value": "T1BF6512287A2ACE02D8D983B85974D37513B45C5EE822E3178FECBDF37476B512908257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431928, "uuid": "e5ada838-4301-4f25-a27c-99eba44f29f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431928, "uuid": "a406356e-c196-40b5-aecc-f6724a91159c", "value": "24576:MsyrDa26h3Hor2gHUkVQcOKsz6/lyng5osXYgImRjqqA8+v9:LDNpIr2/+OKsz6/lwcev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776431928, "uuid": "90055b00-6657-4b6a-a464-92c54f53e61f", "value": 1428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776431928, "uuid": "b66f40d4-4009-4f3b-a82b-19f56e6df271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431928, "uuid": "f4b081a1-cec2-4fa2-bc01-87938bf6ceb1", "value": "12947b9484bdae55d646dc02be4ef887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b1ef8c-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776423367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423367, "uuid": "8bae75ad-5862-4b4f-943e-4797a897ee5a", "comment": "Malware payload (Vidar)", "value": "714d128270f970632b16b8695525e5b3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423367, "uuid": "b6968c0e-a5eb-4b4b-8c2a-94898ce079e1", "comment": "Malware payload (Vidar)", "value": "b3a498b4c7b58b95b3572244072909c2930d9902568b88782c465e884d6d404b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423367, "uuid": "cbca5b33-cb48-4617-b188-ba5a81b37655", "comment": "Malware payload (Vidar)", "value": "8260d097f439be7ff92e0c8c699f99342769394b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423367, "uuid": "b1952877-fc06-4dbb-a55b-32eba5bbca43", "comment": "Malware payload (Vidar)", "value": "54d25b7d855446fb8216317b0710d64a32a68611e9a92f7fe3105b40d824cc0c0ec818012a2ba6d7d25e703ffc9d0617", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423367, "uuid": "70bf20cd-e509-437a-b547-cd7e27a954cd", "value": "T1A32412BE046F9C4CE0BA84326FBD64815C48870A5D6F92BAA68743D73436F75972438F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423367, "uuid": "07e50b79-0f4d-4252-a88e-5852e0c7aedc", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423367, "uuid": "147be140-feb3-41fc-b629-fbf0a8fecb0d", "value": "6144:KCstR0ExkMBgWHnV5Ge36ATRbYytakzTu:gxq6HVIo6Nytaea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423367, "uuid": "5ba8c3f9-3e9e-4c7f-8969-f7171c3f1873", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423367, "uuid": "e21a7001-4e64-4f2d-b0ff-94ea8782803b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423367, "uuid": "22dd56e2-3454-4d60-85b6-6286ea5a4c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ae4539-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435410, "uuid": "e105e8a1-2ba5-456c-8464-7c343ad6ff26", "comment": "Malware payload (XWorm)", "value": "71f4aed32dfb178afa53a49da71f56ed", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435410, "uuid": "b0286556-1568-49c4-9276-305069c96a86", "comment": "Malware payload (XWorm)", "value": "b497901579155f4f4644e26fea1d859eb0669ca2f273a55818bda19cf8592c91", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435410, "uuid": "6056b497-7fcd-4d47-a2af-be371cbf7415", "comment": "Malware payload (XWorm)", "value": "5d575a3504b5f0702422fbccf95614ae702c8ca2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435410, "uuid": "cb827c87-ff97-4265-a984-d91f25b256e6", "comment": "Malware payload (XWorm)", "value": "81b04e3895e64010e5f24292ac29d500cc9dccf8d36f1cafe4468063d6650f620bed4eab982c355c7e14635cd3205a5f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435410, "uuid": "c193fd33-c992-4175-a671-4254f7a6c49f", "value": "T160C5EAF4ACFE9573F24F40A3A781E83ED881245EBA1F9D475FC89B0114526F4924AA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435410, "uuid": "b097b874-6cc0-4f67-a951-cabac80ce352", "value": "192:MiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXiXa:xGiyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435410, "uuid": "102376eb-9728-46e8-9e4e-e5ccf31fffe8", "value": 2727464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435410, "uuid": "fcf9704e-23bf-4517-bfdb-5ba393bcb83c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435410, "uuid": "350b2a7c-5bf2-4332-9ca9-19297ad84f47", "value": "TransferCopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f630f2-3a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776411261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411261, "uuid": "639cc649-c68e-4644-8b57-ecc878239a37", "comment": "Malware payload (AgentTesla)", "value": "5120c6e9bd18d28342595219ff06e2d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411261, "uuid": "3e131938-c678-458b-9765-0860047ae98b", "comment": "Malware payload (AgentTesla)", "value": "b510efb2ba6dab5713e568f45173b32967acf6282564fe5736576f0ce6a4ff41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411261, "uuid": "95201f40-a9bb-40b4-8229-750574cfa01f", "comment": "Malware payload (AgentTesla)", "value": "5e4fc77cdc73199e845169b840c3e2a61596b6a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411261, "uuid": "d66f882b-eb96-4a70-8e38-418eecbc5676", "comment": "Malware payload (AgentTesla)", "value": "1fe7dc9ae2b1f2e02b5746d28cfaa55c858deac0055f130d9496c6489ef03ee7dfd3104a76a8da47314d792f6ead5fab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411261, "uuid": "b4d1f82c-3553-4ca7-8e7f-1c67d7c9d409", "value": "T1CCB59D5FACF154B72CB0ADC343151BB7C85E928852EB77AECE48C5007829B1079DAE79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411261, "uuid": "dabfb32d-ea19-4cf4-87c0-1aa93b6cf542", "value": "768:XoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoMoM5:/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411261, "uuid": "d3c44d5e-47d7-4dda-9586-0886d86fcdf3", "value": 2290355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411261, "uuid": "d0b45bcc-9ae3-4659-a40e-ce12e64f200d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411261, "uuid": "420f03e2-895e-4204-9ed7-3ace52073bba", "value": "ANG FORM MODIFICATIONBANK DETAILS_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70fc4cf-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435308, "uuid": "dc144012-5165-48bd-bcdd-93ef2385f6fa", "comment": "Malware payload (PhantomStealer)", "value": "786b9f966dc46c0da8dd3dce59cac2ff", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435308, "uuid": "4e190a5f-18d8-4063-ba5e-9f88124ad7ba", "comment": "Malware payload (PhantomStealer)", "value": "b61840fe8bb0aa16fd4d45470b8ea7b1fefbd639e197bd182b202ed7b083279b", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435308, "uuid": "c20aaf9b-0000-4c83-b5d4-d84d75227524", "comment": "Malware payload (PhantomStealer)", "value": "a3b436202b59eb111310a804aa9b2ed80c186a90", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435308, "uuid": "13ed2be6-fe59-40b5-8609-a384bc91d28d", "comment": "Malware payload (PhantomStealer)", "value": "4c5b421b24244e322cd1b7b8ec4fe8fa77ce3a78f8dc8ca81b65576706c9b705d8587b8b18909a770c641661791a3ea4", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435308, "uuid": "267fe932-e34d-4fb9-9b8f-bcf31af4fcbd", "value": "T190245B1234DE940EB0F256D0FFF5B4B18D22FA7D0A9655EE0071174EE6A7C828E617B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435308, "uuid": "dc521a49-06cc-4304-8a4e-55e983064f76", "value": "6144:GBu7wTikf88LUE8ALnVERAsnpj8oziQnSAFOzcfgl4:8uYxE8LUENrVgbnp7zpnSKy4gl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435308, "uuid": "61623e3b-53ac-463c-9007-6ef36541000e", "value": 213372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435308, "uuid": "54d20c2b-2a7d-41d0-976a-cc2e4ea75dae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435308, "uuid": "20387209-78e5-44e9-96b2-f8b5e5039a9d", "value": "MV VALUE TBN - SHIP'S PARTICULARS.xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89c9a48-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440384, "uuid": "7a02804f-ce16-46e3-85e9-5ef2697f6651", "comment": "Malware payload (Mirai)", "value": "640995548918da036e53d491ba236e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440384, "uuid": "f64638c3-266a-4582-ad11-bdc1526fab98", "comment": "Malware payload (Mirai)", "value": "b63290159d4975f21dcf3738f7593221b86a680116101d11e7679861ea582495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440384, "uuid": "d7d31a9d-8b01-4a47-b595-4892c1b6ec12", "comment": "Malware payload (Mirai)", "value": "5e34a57a61d6ab98e4e2252f3e9b690bf56b61d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440384, "uuid": "b6508ebd-27e2-44d2-9eba-47881592d9c4", "comment": "Malware payload (Mirai)", "value": "b6da74e9c0db5c541415f933bb10b85d4f754a9d352b03b4c43165537c8def26dd2eb335f120973bc67da443ba24d353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440384, "uuid": "4ed3a04a-776d-4d79-b577-c0fec7719eb8", "value": "T1A3F3F971984CE6C7C53321BCA0ED9FBA8E7E72DB2B59CD027CD151309AD5EAB2906C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440384, "uuid": "a7b825d9-368d-4977-a40f-0d9d64c453f4", "value": "1536:wrUk158gadBSgy5vNK9rTt5dJHK+pK7DKrtwp+Vp+wEiMc1l88j:wIkL5vUVTt5dJcc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440384, "uuid": "34c25246-f400-4848-b831-c4b2489c0370", "value": 166040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440384, "uuid": "14683edc-87a9-4fe3-8e6c-4a54bd421931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440384, "uuid": "d04d1c8f-8726-4faf-8aad-c43550a1441f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f7eb8c-3a94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776454631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454631, "uuid": "ec2f56f1-fb52-47e9-bff2-072888769bfd", "comment": "Malware payload", "value": "ffb2ea71e1a8550e4cd89ffeb805d583", "object_relation": "md5", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454631, "uuid": "e9101024-b493-4f9f-9936-ba213a7f1e64", "comment": "Malware payload", "value": "b6809707effe89691dad21c854aa44a68dcd4d686e56baa1d856139a8b217e0b", "object_relation": "sha256", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454631, "uuid": "f6afeb07-e780-4729-ae47-9285948536c9", "comment": "Malware payload", "value": "346e7e23282661ddb65d18b2e8597a45a49054cc", "object_relation": "sha1", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454631, "uuid": "f766db4c-5838-4212-8876-6f21505a4baa", "comment": "Malware payload", "value": "779224deb9f9f119e4fe6dc7d5afa142679cb012ce8ba8c735fcf1efb14a1c56925a3f0130db1276426a61621e83bf88", "object_relation": "sha3-384", "Tag": [ { "name": "179-0-179-51", "colour": "#8F4F6D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "brkl-1dd9c-default-rtdb-firebaseio-com", "colour": "#B08801", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454631, "uuid": "4cb195e4-bfd9-47fd-8754-8654fde5b5a2", "value": "T13B1422A1DF0915A8A286C572FFC9370E1D3A9F813259179E3DD0C7A8F4125C8B6B718E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454631, "uuid": "e461c305-6d75-4b20-a142-c73053c7e12a", "value": "6144:tLlskypYsqORLN6okyuhBW8mBLDlPU2ORXV:fwGkJkK8mB1PURF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776454631, "uuid": "5c526a61-cbc8-46df-a746-fc3d99010351", "value": 201724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776454631, "uuid": "22181b51-8335-49a4-8e1a-95a256bfa9b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454631, "uuid": "7ecb6c18-c46d-4686-a323-a9ffc80266ef", "value": "b6809707effe89691dad21c854aa44a68dcd4d686e56baa1d856139a8b217e0b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042cc283-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776432378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432378, "uuid": "54208ec2-7d73-43a1-8247-6578dad515c9", "comment": "Malware payload (PhantomGate)", "value": "1b23f338d98dacbace5f5abd63b2d77e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432378, "uuid": "4ec0e7e7-c710-4a06-9956-ec6334ef76f1", "comment": "Malware payload (PhantomGate)", "value": "b6a29ee040d6dcbb9168c19299b4b1578a58dda1e2cb329f24b65dd7a94e027d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432378, "uuid": "43d5d36d-9160-4817-84e4-2056eaab4e68", "comment": "Malware payload (PhantomGate)", "value": "47a27a2133a8e9ec1d74aa353f1e3ec687391e79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432378, "uuid": "8715e8cc-caa1-4bfe-ada5-62533d6b676c", "comment": "Malware payload (PhantomGate)", "value": "66178f9e887ee78b3f1b8e353c1d39a4bf233efd4ec799e250cdffc3972953489a8db8505ca2de02bd57ec6f4698c8d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432378, "uuid": "3b0856fd-7f68-4d60-8cb0-7c3c55a3007b", "value": "T1ED5320550B424F349BC3E5946D3736B44522C8A5259F081A29C8DFFADB35E79AECCCB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432378, "uuid": "889a18d7-5f20-49ae-9727-bbe29fdf57e6", "value": "384:9i1iKFQ0YLT/YwRtUJG7rqMGyb2pfKMZe7zCRPwHe5rDMOPLbLnlm2:vRrqML7uDffI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432378, "uuid": "522a6a7a-d932-42b3-a5bf-78fee3735b35", "value": 66028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432378, "uuid": "46ed8dc1-601e-4161-bb58-50e49dc4d4b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432378, "uuid": "6e13c733-6b7a-49cc-ab01-a96b40c553b6", "value": "SOSTENER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594ee7c0-3ab2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776467310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467310, "uuid": "561e40c7-17a5-4db5-b2f6-50a94802cc01", "comment": "Malware payload", "value": "80d8b4d98a7d47934912886fbbb2a9ba", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467310, "uuid": "09ba8332-bbe5-4bab-b37b-cf4b80fc8ebf", "comment": "Malware payload", "value": "b6f90c7d0a74fc5a25fa5496812a3522d7c64775cece5a87cf941203546a07bb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467310, "uuid": "7212267d-8616-485d-8527-472da1b0e515", "comment": "Malware payload", "value": "2e5dc693c561d99e6e98d72f84f6418103477f69", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776467310, "uuid": "16150fcc-0a06-43bd-a8f3-ad2693dba24d", "comment": "Malware payload", "value": "de6cb5bed7a52fc833aa053be6acd3214776549480887459f609ea96558ba26244ba6ef6fc2655c44f47bcdea3167826", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467310, "uuid": "570660f6-62ae-48c0-98f2-bce7abaf9a83", "value": "T14A62C046AD189C66B65ED4138C9B383051D2B07B3D35B83329891D83FF48E2805EFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467310, "uuid": "2f9da5f4-60d8-4004-8e98-d73b87b3e809", "value": "192:9GtfWLfwfdjWoDgUo1bymHr3iSlY1mT9O48HNfb2gVxZ3WNmkNTguav5Mb2WUmV3:9Gs8l6o07rblYQ9wfSej3WNj282YR/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776467310, "uuid": "6874c7ee-2274-446a-af94-10f868812ca1", "value": 14578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776467310, "uuid": "4e5b99de-6185-4a5f-afa3-da7540e816c3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776467310, "uuid": "9cc41879-66d2-4fdd-8de5-accf50417cbd", "value": "EKMYAKrCRJ.js.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e6949a-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432562, "uuid": "52d58243-4979-4eba-b34e-ed813174f546", "comment": "Malware payload", "value": "443b9108eeb30902cdc20d5463a8c82e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432562, "uuid": "b6273858-57b3-49a9-b178-259e93edd68a", "comment": "Malware payload", "value": "b76521694206e5290173c3073054fc5e7de01b797b509da92ca2b904d4333489", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432562, "uuid": "de6c25f0-ad5d-48b2-9f60-03ad36fe6439", "comment": "Malware payload", "value": "3446df026c2fa310bb0c2a740bf811907e536ad1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432562, "uuid": "bac5ef65-3367-4fbe-9ae1-b3090ed16701", "comment": "Malware payload", "value": "b121c3ef02de93618c78dc786e4084dace548e6d75c4f4360791194f6d0cd56284bd65f36b740885fe3714a2b727d05e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432562, "uuid": "74a0f6c8-18a3-4d73-be35-086ed7f72496", "value": "T1DAC25F965D048A9D897102BBB875C9D9E83A63BB8F180C63745CCC32DF302DF82B56D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432562, "uuid": "067f0b56-6128-4034-a2c3-088410072ff8", "value": "384:pTIca16rsB00ryBi7pN9VtuqXkbBgdvjy:CnaYNykN9VtuqXEEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432562, "uuid": "8f6ce0ff-cba4-4aac-9d8c-e970126b4b1e", "value": 25829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432562, "uuid": "05aa198e-e9ad-49b5-aa3c-c8d5aa94f936", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432562, "uuid": "383e74fc-55bb-4a0a-b7a2-99cd802a52a1", "value": "fm_20260414_113541_Win32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46ecfa9-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458497, "uuid": "846dd4c4-c856-4042-aa14-9717b51f3f0f", "comment": "Malware payload (Mirai)", "value": "532d0cbb94edfec21fc2373e18d177cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458497, "uuid": "acf4e3e1-4299-497f-9ad8-376f337a857a", "comment": "Malware payload (Mirai)", "value": "b76a5774a2d77ad4be7ad4b93d85ed335c67fec30155d62f3f0ff3a9e8c63d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458497, "uuid": "eb0bb70e-5fd8-4f11-be78-46aa88b5874a", "comment": "Malware payload (Mirai)", "value": "875174c7fa558d7ab4af11edc6eca3df39a0cf5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458497, "uuid": "0fb3ba4c-45c7-4b22-9366-a3e978f67533", "comment": "Malware payload (Mirai)", "value": "d2a3c726dfc5ea36533bbf21d600d586c407acc8ccbb1f68aee152cc8892cf9922e771afaee1d383e963543e58c3fc1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458497, "uuid": "7227fd08-86e6-4114-9f84-c112372c5db1", "value": "T100936C03FD165F4AD14764F061F2C9704B12FCA649271EF6B9B6EAE98247EE870027B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458497, "uuid": "611fd8a4-b747-4c27-8838-adc5e1d7312b", "value": "1536:5tUAJGkkYq/B6LohE9lwnlE2LKAgdi7CQpfCcTBfIlDwSmIBH5:bUAJG1IshQlyRuAvLpfnBzSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458497, "uuid": "2f519f9b-6f44-42a1-888d-9bce616bf8a7", "value": 96572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458497, "uuid": "3c683590-e879-4fab-82c3-5524e4d620e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458497, "uuid": "726dd8af-76d5-4962-80ca-c1f51accec07", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913e2e1e-3a79-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776442922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442922, "uuid": "3a585a13-3bcd-4ae5-9288-9734937efc4c", "comment": "Malware payload (Vidar)", "value": "99775c9078774ed124e37d089334de5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442922, "uuid": "cd869209-28c0-469f-9f9d-f15acbc5eb10", "comment": "Malware payload (Vidar)", "value": "b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442922, "uuid": "8c435520-b688-4fce-9d7c-ef554c0531ab", "comment": "Malware payload (Vidar)", "value": "1fe42725e5471a3f365a1180f798946643924d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776442922, "uuid": "90805689-826b-4d83-b0b9-ec116c12bd3e", "comment": "Malware payload (Vidar)", "value": "84dd9e1f779b0122e3127028641302f4130eba0458f37dc150653d5e3d0ef67b12c5b985d27fbd7f4ea62f211d13c276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442922, "uuid": "07a8088a-f59b-4183-8d67-b26fd6a32a87", "value": "T137C58C07BDD148BAC46AA3368DB612927B31F8480B3663C32E53A6792FF37D45979344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442922, "uuid": "22da3c9a-6d31-4b9a-9ca5-bdd1a4714d20", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442922, "uuid": "446b2d36-0b1b-440f-b6e7-726314612201", "value": "49152:IPQHj50PVTn9V6YYgeIDIWSKPzZ5I+ZsU:IYYL9V6Y9etWSKrYqsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776442922, "uuid": "b70731f1-606e-4b61-b7ee-2d7480587539", "value": 2613872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776442922, "uuid": "35847421-6751-42f7-aee6-b5ab00a33222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776442922, "uuid": "8971b134-b88b-4a74-bc6b-558e63a274cf", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22deec4a-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432000, "uuid": "883c1150-fef7-48b7-878d-837e81d69053", "comment": "Malware payload", "value": "6e0722a700af97cc6eb757c919f880fa", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432000, "uuid": "a0274804-2c5c-4f93-bb58-385fee329291", "comment": "Malware payload", "value": "b908e32fa44d7672a1a6058355404cf26315ea9e1ff07a34c8ea14fd99241c4f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432000, "uuid": "3d39e056-d379-4e61-8204-54ab9f5d0b58", "comment": "Malware payload", "value": "c6806d6020310665ccaad4740a9dfe9905006460", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432000, "uuid": "07a1880c-e1e3-4f5a-9356-1ded9c846126", "comment": "Malware payload", "value": "a110638284b96115f8aebb60c34198fe7bb099017300dc1ca81990030f44c0b15820c2ca0ad056b033fec1586ce5a218", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432000, "uuid": "c5936824-ad73-4df7-8014-9fa428c4b09f", "value": "T16A45333EB298FD7DE7378239C26772F275DEA023530920982524E56859B5322E39CCDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432000, "uuid": "ec80c0b2-2173-4282-b34e-3569f832f9e2", "value": "24576:tRKZa3wXfh6t9zv3IRqmaLAhgZn0X3tDCOd7lKFahY8yzA8C:tQfWz1vdZ0Ht7lSzAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432000, "uuid": "fc16b51b-fae1-436d-8fd1-989140379e12", "value": 1207163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432000, "uuid": "dcfc34e2-0a9e-45bc-a3f3-afe933c0f4fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432000, "uuid": "6e3a9897-4982-4f2d-8aed-9f637b3e4692", "value": "eTDS-XL_Blank_Template.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825da8a3-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452346, "uuid": "0a22a873-38fd-4dfa-864c-46e791b995c9", "comment": "Malware payload (Mirai)", "value": "1df405ae065001e74d3fd35f0b7bb086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452346, "uuid": "bf28911d-ebd4-4a72-939a-9d8369dd3612", "comment": "Malware payload (Mirai)", "value": "ba1c99a948add11f8d8d0d1ede84139290223b9257f8ad2fd5e40e1e5d7d5ad2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452346, "uuid": "6a8afe42-a709-49c7-98c2-6c870508b6a4", "comment": "Malware payload (Mirai)", "value": "89c1a19e7a8fa16809e09734abb4ce0659a080d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452346, "uuid": "93dfcc59-476b-4d4b-a8a8-76f64141b40a", "comment": "Malware payload (Mirai)", "value": "52241f811c1cde98455985c2cd7fa74545a29af1a3030a179d95528c667dba55d43b275b7bb055de66cfe72cb65ef8d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452346, "uuid": "5da31131-42c0-4a98-978f-94578726f8f0", "value": "T187145C2BB3C39CEAC91067315C316362771FDB041918EAFFDA0B3794A9977125A246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452346, "uuid": "0f9d1fe6-336b-4fe3-9607-98a5e8d05d26", "value": "6144:lpdOm515luF6mFO0Xdiybte4ut2Q7IKTt4:5uFxO0X9pePsQ7IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452346, "uuid": "681c1152-2a74-4d1c-a58f-68f911cb1061", "value": 197272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452346, "uuid": "89cb6337-e204-4295-95d8-f8bb9d8b7aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452346, "uuid": "8b5e30e7-c155-4de1-a1a3-e8f7a0741660", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705f02fc-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452316, "uuid": "32003085-af7e-4d35-8295-f45e047fe453", "comment": "Malware payload (Mirai)", "value": "f075808515ee8fffd27e4bbc34ee17da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452316, "uuid": "89cb4893-e2e8-4366-a508-824dd9462109", "comment": "Malware payload (Mirai)", "value": "ba29405a88f6c44deb5acc24d9c2d40dbe796138f33278608bbfb520d68e351e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452316, "uuid": "e6274af8-869f-462b-830f-78538c05478a", "comment": "Malware payload (Mirai)", "value": "37f4c996c899d95638265773643a2c6b9ac6d612", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452316, "uuid": "e8c169ee-1b26-4632-9520-4175db8a563f", "comment": "Malware payload (Mirai)", "value": "1b3c59bf4544cfaf13ff59bdf721969a2f100bb5d424656c995e4d839da6e9bbbe7434c0c9065c6b7084d0223009ea03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452316, "uuid": "e9d667b9-ce85-41a7-ae39-9aeb54deff9a", "value": "T122A3AF87B1517A7EE4756D7F84139E19AB159FB089830B3EA1FCF9805E3A3803266E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452316, "uuid": "cda37a26-4865-4a05-9c6b-1ce8cdc972e8", "value": "3072:8KD8kJDihIJBi1d7BmUdHsa28SySlUSVN:8hkJDihV1dtpBpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452316, "uuid": "57abdb1b-52e5-447f-b7bc-7d70230ad951", "value": 98692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452316, "uuid": "83358e64-af60-4295-88de-d0aff71d79ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452316, "uuid": "e2e909f7-28f9-4f9c-a291-b1025a120a95", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0195ed82-3a69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435809, "uuid": "4f0fa5a2-04af-4adc-9f6a-6a67c808954b", "comment": "Malware payload", "value": "15b14b9829f34521450e4e7d8d212052", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435809, "uuid": "5a36163b-0f8c-48d4-93ab-b6ef9907c183", "comment": "Malware payload", "value": "ba929388ae8b854a9c98b37c4dae2bda4f15dd1cad97388224c4f636d7d26c6c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435809, "uuid": "7786f19d-e192-4e7b-af22-e1f3d422b8d7", "comment": "Malware payload", "value": "f52840234797dfaefd29e8c42cb3868ccc81ec96", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435809, "uuid": "24589661-8a93-4c5b-9f2b-17c6c0c29f8e", "comment": "Malware payload", "value": "59edbf4a0fa0db08da7a8086e3f137f25a1e37181dd4a431b05f0c12904e984e527cf0792218dc128c1622ad55def214", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435809, "uuid": "e7ff0d89-6312-4c4d-b225-6ca3b7e19cc4", "value": "T13E8198C0A2D44608F1B62E39E97F3955597A7B1EEE02C28D0858D20F04F0A29C87FF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435809, "uuid": "5c4d3b05-e0e0-4ba7-98bd-9219532f4af1", "value": "96:8iJFpLrrSKC9CnAOcO7+1RNY5Evp/MCc8KtwxFssAwFlsaAyZAHcGgli:8iJFPC9CAOcO7wRNaEvp/MC/KtwzsTwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435809, "uuid": "346858d3-e981-43f1-9978-56c59e8155ef", "value": 3903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435809, "uuid": "b4c9ec31-14ae-4e09-808b-c02a9bbb0413", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435809, "uuid": "12b9e0c4-5c06-4f33-95b3-483b0745b1e4", "value": "Dienstangebot_J_Hinterberger_07-04-26.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90605ffb-3a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776411138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411138, "uuid": "29af6aee-d49c-4891-b178-a6a5aab7014a", "comment": "Malware payload (Formbook)", "value": "f2a7677e448fa05ad7d154b3fa0ac06f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411138, "uuid": "d8ab4440-de8a-4b82-a586-6714e472b190", "comment": "Malware payload (Formbook)", "value": "bab2072b9bca8b95658cb2198a5b2c33cc9acd94f5afa820e99b1d7559589657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411138, "uuid": "9a3230e3-c660-42bd-ab4f-1bc840a35638", "comment": "Malware payload (Formbook)", "value": "e80fa88a84a26d045f0a87177f92b2086b578750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776411138, "uuid": "63a120c8-8ee3-411b-9e4f-3a0fb7916206", "comment": "Malware payload (Formbook)", "value": "bdecdc56e76bba45fe53dbc0e0ff5024337ad9012ceca53fef6b0e0664a7d1ced4ec5c540acd5b8122355fe6ef4b98a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411138, "uuid": "ba747f4f-e962-42b4-b8f0-e6d3c28c2adf", "value": "T10445BF0273D1C062FFAB96334B5AF6115BBC79260123A61F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411138, "uuid": "cb4aa77e-886a-49d7-80dc-f2c50273f054", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411138, "uuid": "206013c5-c370-4ab7-9012-46a854ba9a11", "value": "24576:S5EmXFtKaL4/oFe5T9yyXYfP1ijXdafo4sHrHWjjL1txcgi+z/zY1t:SPVt/LZeJbInQRafo/b6jxggi+z/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776411138, "uuid": "bcb334bd-cf0b-4cd7-bc93-7356ab031abc", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776411138, "uuid": "43e7df2f-dcbb-4137-bc81-c93e0ac753b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776411138, "uuid": "0b6f359b-ac6f-4bc8-a08d-1599df97bf22", "value": "Xloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b035cdcc-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434384, "uuid": "669dadf8-da35-4c87-bc71-dd0cf15d9c08", "comment": "Malware payload (Formbook)", "value": "ebd8aa98d332e96df15c36b2762782e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434384, "uuid": "e1aa159a-2392-4086-9501-43ea331164f1", "comment": "Malware payload (Formbook)", "value": "bb11d71564799f9f57ff9798238d6bce285483f03af00d35adee45352a26fb56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434384, "uuid": "e808533e-180e-4a8a-bd8f-72dd9b9fa83b", "comment": "Malware payload (Formbook)", "value": "3da92f36ea7c2578b08363d511ad8b6792a6660b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434384, "uuid": "e7357061-c24a-402b-bc4d-16f73c28aea6", "comment": "Malware payload (Formbook)", "value": "edb01da55fc9d6526f214a1e29bed85c7b4c60558ef7cd71d6579f498d7c9e359f8cf001e076ae4da0d850cfa7f41392", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434384, "uuid": "83f09aa8-4e9c-4c1d-9bdd-706a8f19a62c", "value": "T1A4A5021589C42FB9CFE85A1D80FE161A93F04A8A5416798AFB33BE5BEFF7500011B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434384, "uuid": "16b9a319-21ce-4ad9-b7fd-ade0d6ad5e0e", "value": "24576:Tc52NJYy736ryPVAbbDryWCsnFGzVlInPQn66FX5kmJiPh8I2OV5Y+BicPI/el:TgBN2N2bIsgplIP+pJG3V7Ptl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434384, "uuid": "b9263ceb-9fc7-4f94-be17-3a18dfc7cbc6", "value": 2097487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434384, "uuid": "f81867c3-816f-46c3-a6f0-2162a42bf97d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434384, "uuid": "88120a1e-2da6-489c-8a80-00257590e3b0", "value": "startup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd99e22-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452335, "uuid": "109bbe92-50e0-4d04-adf7-7e74259796f9", "comment": "Malware payload (Mirai)", "value": "143de8dcbe0baba3a3db44993ed4f391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452335, "uuid": "882c14b9-4bab-41ab-b0ba-0fc038c029fe", "comment": "Malware payload (Mirai)", "value": "bb20403b1b1799c90e4712eca4e654ab67b4e3e083b5bee5d80d3ec81c22f43d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452335, "uuid": "bc7f6c12-311f-405e-9dc2-d643b249ca40", "comment": "Malware payload (Mirai)", "value": "1f90e6b6fbace3f088a467989b0ed86aaea13506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452335, "uuid": "a9943c0d-be42-4179-a5f3-20943dc58c33", "comment": "Malware payload (Mirai)", "value": "c039b94ec23c8cc0ad72e937843c2a6a64208c60ca96476edee2af293e0e6a2a2d816aee28d0074a74d77c1458a1d50d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452335, "uuid": "cde0d20b-dac5-49cb-9116-3c819d714914", "value": "T1D0D38D68FA8F79D1D2C7E37EAD4A0FA2712779749555C0B10A00939FD9EAED888C0213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452335, "uuid": "0b70f6c9-18d4-4b2f-a106-735cabff81d5", "value": "3072:jFMoTh7M/i0hhgdFSJ013mpj+QyhYNHzPxZ:j7shhgdFkd+3wbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452335, "uuid": "af2e89f6-c48e-4f4d-9bdd-5737c9cca567", "value": 131872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452335, "uuid": "2b83625d-9be2-4cea-966a-d250415c0784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452335, "uuid": "220327a1-a967-4976-a870-30d30ac4bda5", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153ea661-3aa0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776459465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776459465, "uuid": "19e3f79e-d34e-4dd9-bd77-342092d9d74f", "comment": "Malware payload", "value": "a29676835d8529206b32a325ed8a4b37", "object_relation": "md5", "Tag": [ { "name": "dakatawebstick-com", "colour": "#32E772", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776459465, "uuid": "3ecced64-7ae3-4669-804a-892f92901c29", "comment": "Malware payload", "value": "bbcc6c5249d8e8f9d52e031fabb38a42469b57526f997fb06483581e360fe3a0", "object_relation": "sha256", "Tag": [ { "name": "dakatawebstick-com", "colour": "#32E772", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776459465, "uuid": "77d66793-79f4-4f29-b687-515d36a27d51", "comment": "Malware payload", "value": "705a5228eebbed1e999387e8dee9736f9e00ffb7", "object_relation": "sha1", "Tag": [ { "name": "dakatawebstick-com", "colour": "#32E772", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776459465, "uuid": "21414f1c-6b91-441d-bfe7-3e4dacdd4d83", "comment": "Malware payload", "value": "2da520e0251fa10ed568eacadd6827de9623014ddb26956e81f0f1a608934cf615864752daf8b5065f1ac80537d7c61e", "object_relation": "sha3-384", "Tag": [ { "name": "dakatawebstick-com", "colour": "#32E772", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776459465, "uuid": "32c9f384-b911-48fd-9023-9c2ddde78697", "value": "T1AA429307B501C62AC695BF328EA7CBA903767D04CE9B11073AB2730D2EB71D039963E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776459465, "uuid": "6b945786-305f-4983-85e7-4c95429b16ae", "value": "192:5CBi4w5L5uqCoNmX5AV0Pm3cBX/1G7PrVug8Al:5CB7S+oYq0Pm3cJ/1sPrVuwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776459465, "uuid": "0782b465-f691-4dea-880d-08eef4c577b1", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776459465, "uuid": "cfc81e37-0ecc-42d8-873d-7075658bdcc6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776459465, "uuid": "75243143-211c-4cdf-830c-d6c9076aa2fd", "value": "8f7f1d313b5ebf34.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5176c0bf-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432507, "uuid": "914390fb-42d6-4c36-9a67-0d3b70a56b70", "comment": "Malware payload", "value": "f18ae3c0ed60c0525fb9f6e19c3030fb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432507, "uuid": "2f62cdb0-8c7d-4ac7-bcd6-0536bbb2d384", "comment": "Malware payload", "value": "bc1e5d79eb4cc0df989e5c71a6ace1ec4b4006c7cecb7391d862090f565e0a7c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432507, "uuid": "48ab6927-4274-421f-ab8e-fb98c585623a", "comment": "Malware payload", "value": "e26941d7cdec241fd622bbf00581b640694e64c3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432507, "uuid": "b2602b91-7dbe-49a8-bfa8-1f6431e1307b", "comment": "Malware payload", "value": "7f6fb95bcb7b5e651a57b84184c92adc26288f783e657716448824e02da6736e5d71e9c7628d3fbfbf354543a113f09a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432507, "uuid": "08e0b8be-aff1-4c8b-b075-c03e9a2dce5e", "value": "T1AB3120D6F5454E4B0FEB555B8452E004ED7501636ACC3848728D8C9DFF0B01197DA8A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432507, "uuid": "b6b44253-88a0-4ab8-b484-a65e173f1595", "value": "24:DppFrq4JAPAgREjs9Pz7fQH5dEtLO5C1tBiEoxWnk/ldXktTa:DppdPAP56oF7wap7OBLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432507, "uuid": "f71b7ddf-59af-41c6-ac7e-d78bdbd374ea", "value": 1645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432507, "uuid": "386e11ca-1a7c-46e4-84f0-7f35e82f1408", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432507, "uuid": "aa808327-49e1-4372-bfa7-0924cd79c12a", "value": "fm_20260411_120802_enroll.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b39c71-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776434392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434392, "uuid": "f637e271-93ba-46ec-adcb-dac6778a0276", "comment": "Malware payload (Formbook)", "value": "05b2dd8caabb14615616ee53c2516a14", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434392, "uuid": "8c763058-a8ed-45a8-a785-b50e009faf61", "comment": "Malware payload (Formbook)", "value": "bc2c735f3db0ec47df461f832b275fc18f058562cf336670eaff5292a759526f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434392, "uuid": "88320bfd-80ed-41e4-99a9-80c9d0846d7e", "comment": "Malware payload (Formbook)", "value": "953799ecb31a56621c0cd62c7e1012307f1846f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434392, "uuid": "10bb15f6-a57c-44d5-9b61-cc9ab367750d", "comment": "Malware payload (Formbook)", "value": "55ce9b1193e0738f2af236cdfad147ed742566c806554ec7aa030d466ad7db2c0f1c4e1af1bf6d445f8cbdacfe577c9c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434392, "uuid": "5268a11c-bae4-440b-a091-28ca5c8b5ea0", "value": "T1E90375CC3EDBF499821639E31E76D443F5AE4E8071188334FE89A09EBC64715D57AA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434392, "uuid": "c74ee96c-6e1d-4ccc-b0ef-4f83e2ab1947", "value": "768:pfJw6sTNYhWccjpoSiH+rFR3J67WeCZXqV14gItfdQUQFL6UM+SsSQiUcEo:Lpqudip4H+hR3J67C0V1+tfajU+SsSGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434392, "uuid": "457a12ec-33da-445f-a8a0-cecee148acce", "value": 40220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434392, "uuid": "e0723c32-43ad-40fd-9d37-f956d92d7291", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434392, "uuid": "cb81d1ca-4234-418a-b436-7aa1a2283594", "value": "MODELO 303.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6767b5fc-3a53-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776426531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426531, "uuid": "19eab3f5-fc44-49ad-b18e-f4dc3a9c534b", "comment": "Malware payload (Mirai)", "value": "395d583a6202f3bfa396ab1f3ee1c1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426531, "uuid": "defb3c77-f839-4492-9d97-b04b59e21326", "comment": "Malware payload (Mirai)", "value": "bc5d2297d40ad1d96818ed09a10342810028404524c7d701b2c8a00edaa9a0c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426531, "uuid": "2549fce9-d245-4ef8-94a9-3feb4a685c40", "comment": "Malware payload (Mirai)", "value": "28f05fa8321e731ea8deb81a3dbcb3fb9db8a50e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426531, "uuid": "9456f9b9-5921-4029-9e78-3705cc0edcc5", "comment": "Malware payload (Mirai)", "value": "791a59168b252a0356e33469f5f92c18e280065aac23e7c2fee4820649848375537317ff345864366bba7688c80e806b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426531, "uuid": "cbfde0f2-7663-4778-a8b4-b56ffb917204", "value": "T18B44C71E6E228F7DF7A9C7344BB78E24976D23C626E1D546D15CD2005E2038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426531, "uuid": "7b19d8b7-568a-45d0-ab9a-71bd7472a84c", "value": "6144:5UibqncCUpXA6jm03uINpT5Y5uU9b2X9nLS3TJpSB0/TCc5+0oYGXWLiZClDb5vE:gU8khUIMX8b+bih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426531, "uuid": "5f79c7a9-dbf8-4af1-9e5e-d2c1d9c5880d", "value": 267988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426531, "uuid": "cabc0db8-4410-42b1-918a-c9c18824faa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426531, "uuid": "9bee87de-f6af-4d68-8c3c-61eb48e91936", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9092a6e-3a19-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776401784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401784, "uuid": "2209c14f-8578-4b99-a976-356893325a7a", "comment": "Malware payload (PureHVNC)", "value": "8f1d3f6cf650c4d3d1c0486c63f6de5f", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401784, "uuid": "7598a3ee-a3da-428e-a462-a62ef10904b6", "comment": "Malware payload (PureHVNC)", "value": "bcc76c8bf8e47a34a5b4d32f487c36e6f3172d0a56dff2d5da790b15a8bdca8c", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401784, "uuid": "2fe4ed13-e6c3-4dbb-b540-a6063c8450fc", "comment": "Malware payload (PureHVNC)", "value": "03d7e3d929a62d9aaf063daf21d540e332a280a7", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401784, "uuid": "731d9ed5-b657-4573-9d02-9e90f2266ae3", "comment": "Malware payload (PureHVNC)", "value": "70284a9fe7a7d085c5fdffbe66427a18dabbf120ae77867825fb6b2210d0dccd6b60dc47def8c1fa472ed32c91dd3281", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401784, "uuid": "25570995-447c-48fb-b0fa-a7ad48575cac", "value": "T1902533CE45BAA43289CE5B9A5694C52DF05CA33F0445E3DBEDFDE3C642FE2467A50280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401784, "uuid": "7ddc62eb-1fad-4b02-89af-61f495646452", "value": "24576:ekSOZrLUAH8ZnFwfJNKy+CAwITXRFYJoVv8jNIesI5rq2NxG:eOgAHUnufnKy+CAwITXzFVUjNIeRNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401784, "uuid": "0aa4cc2b-5c7a-4f9f-98cb-ea9b2e662fd3", "value": 993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401784, "uuid": "b2f33e1a-48e6-485a-b055-c6ac6d2c3cec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401784, "uuid": "b43e59ec-ba69-4ceb-b846-071daa610dc9", "value": "imagefre9003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cc7a27-3a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776409087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409087, "uuid": "31326381-2ff7-43e8-bc02-f956db645384", "comment": "Malware payload (Gafgyt)", "value": "fbb4e59114b7f518860d44f1813d5bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409087, "uuid": "7c4462fb-0f0f-4f32-afb1-d27bf22298dc", "comment": "Malware payload (Gafgyt)", "value": "bd0af9b9371a9930a414019edacd73fffe2cd985567c2b35db137fbd9bde4cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409087, "uuid": "3d8b5b44-0d5b-4058-ad22-2b7db20250aa", "comment": "Malware payload (Gafgyt)", "value": "b045faa0d97422ce172db24c0b921c2c8ec65189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409087, "uuid": "0e1a6861-3a15-413b-9633-0e6d3f86c492", "comment": "Malware payload (Gafgyt)", "value": "89d39a75db2c455ed23ed5452d181807aba050bc1be71d391952f413f6bbedf3d4e6a6968fa6bfd87e29017e7875cc68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409087, "uuid": "fd8905f0-c34d-445b-841b-f3823fcb2d1b", "value": "T1C4E3B65A77618FB3D81ECE3306AA4602108CD55A02ED6F6FB2B4C56CE78B84F45E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409087, "uuid": "f854c012-b6df-4151-983f-6f2425c30396", "value": "3072:JqSf87PE046LUNn5hdCgPumzxRxulq+1uPNd5R:JqSf8w046YNn5hdCg2mzxRxulq+1uPNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409087, "uuid": "aade6915-c565-4ac8-955c-e148c832543f", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409087, "uuid": "04eef0b2-79c1-48e4-a9dc-0c54e7cd557d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409087, "uuid": "3c7a3aef-1250-4ec1-8681-42f05c781ace", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97919101-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440356, "uuid": "d89e34d5-a1e5-449b-8fc4-60e9c0d443ba", "comment": "Malware payload (Mirai)", "value": "9fa3e4cb407b4a15244191292efac441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440356, "uuid": "6d751213-4175-4b65-9e30-5c567c69b6cf", "comment": "Malware payload (Mirai)", "value": "bd275f5b00c77a9fe5e2ce262693e820b22ab5515ffdbff1ebf907c50116b439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440356, "uuid": "1b6d0802-74b8-469c-99d9-cd73758da383", "comment": "Malware payload (Mirai)", "value": "7a7727f053b5bc88b86da589797c1aadb3677dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440356, "uuid": "6b4b29b1-d5cd-4171-8133-4982fa8e4093", "comment": "Malware payload (Mirai)", "value": "d21941516d672fce6d9028e2881d0ec5dbf7cd7f64f533482297aebf0fb88c69613da201e016d6d79b905c5fe4a99928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440356, "uuid": "39bfcc78-8b4c-4034-a0ac-1d563a231615", "value": "T152141D32985CCA87C526127D60E9DF7ACF7E72DA2746CD227CD451348AC7E9B7806E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440356, "uuid": "3d06289e-bcf4-484e-b108-f3a019b26d60", "value": "1536:HM6kc9KcdvWtzjE3vUcoKVNWjFnD8W/Ctyr/4fNTlK+pK7DKrtwp+Vp+wEiwnP9Z:s6kc9KWvwzQPV0nD8UkNTyP9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440356, "uuid": "dfd3e4c6-9425-4f62-9fbe-a422423bab7b", "value": 190560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440356, "uuid": "f4ac5b03-f76f-468b-a771-3b0a466336a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440356, "uuid": "a08d1318-872e-4bec-bd97-f19e19c09a00", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224ab058-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434576, "uuid": "e9990da2-46fe-4a2f-b62a-c30d026b5f95", "comment": "Malware payload (AgentTesla)", "value": "adeb0f8d5eddbeefb8ef6f999d1fc86e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434576, "uuid": "40ea63e3-6063-42cd-a4be-babfd9ea65fd", "comment": "Malware payload (AgentTesla)", "value": "bd71fc1f8aa88867d382050f75d112e29542b6c1ca3bacaa1d6da5e64a0fa264", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434576, "uuid": "a9ea1f14-e01a-4339-8d32-02afd86d2255", "comment": "Malware payload (AgentTesla)", "value": "6756b9bfa2d3f30250eeca47b0484264a5b67e62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434576, "uuid": "b946b006-8b77-4892-9293-3a977a8c7f7c", "comment": "Malware payload (AgentTesla)", "value": "5abf72f52670f6ac703b32b5222bf89250166f293d80d4ca9c65f38c5908cd2fb1da89b4f3ed285cbbcfb919c8ea4d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434576, "uuid": "0b707186-e4e5-47b9-bc3b-5a64cc6ff004", "value": "T19FE2875C33C2B5A0075634FB182F9926ED7EEDC434895B00FAD4F06CBE16B54E42A679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434576, "uuid": "e8f61c8e-c10a-46f5-bd86-3a677ee3951a", "value": "768:HYHnheDFrjaKRsfnQSCosBC0ordgQDsLMR74i6uBoulBKh68dlL7GHYU8DObmoJi:HSOrqfnQSCosBC0ordgwsLMR74i6uBoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434576, "uuid": "b2bb369c-4730-47d8-b35f-6f858af282cf", "value": 33903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434576, "uuid": "ff7a7d3b-9e8a-4218-9343-ff5db2ca0c24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434576, "uuid": "e4eccbce-060b-45e4-828f-0db5b20e7c86", "value": "4201022043.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21865a86-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776434145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434145, "uuid": "a593b85c-24db-45e3-86b8-646485ad06ce", "comment": "Malware payload (SantaStealer)", "value": "0f964e8ae75535f91f60aaafdfb1202e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434145, "uuid": "2ac715b9-5300-4cd9-ba07-9c2681a05430", "comment": "Malware payload (SantaStealer)", "value": "bde2db917c40dba4f7d17cb508a3fe9d84e7b00453402c99db7929df7fa50e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434145, "uuid": "566ebe29-d075-4e79-8bcb-d5e72f73cfde", "comment": "Malware payload (SantaStealer)", "value": "1244aa38899cd670e1e99dfccc3b847c4f82b3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434145, "uuid": "450781c0-050d-4185-8e78-38380ab561aa", "comment": "Malware payload (SantaStealer)", "value": "5f9d77fac9e4c52fe2479cbb1b212c931603d1e462ae02ac7bd72694df48173966b98753406cebbac295911ba12b9539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434145, "uuid": "90548225-6c5b-46cb-9f31-6a9935bd135c", "value": "T1C4251246F743ACFEC60312319D6F07BC6330EA9627896E274E1D63382C6A9D4DD16A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434145, "uuid": "f1b46833-c248-4e10-81f8-95725e697668", "value": "02e6d3f5774ba56f894b6687d0dc4f78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434145, "uuid": "4cd8c89e-5f90-4277-a745-06daf5fa0ce8", "value": "24576:sVvQdNCN9jHPXzzbnz0v2VzWswSi0xUQ4er3Rs:svoA7/zjSnKUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434145, "uuid": "47106abd-90ce-455d-8718-fc6a2f9752e2", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434145, "uuid": "a03eff36-2f6e-4466-9796-64f10b441ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434145, "uuid": "8a38ceec-941a-4285-ab8b-c27c22618650", "value": "0f964e8ae75535f91f60aaafdfb1202e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0675dc-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455802, "uuid": "f8f6bde2-f4ef-4a22-a797-a5ce3facfaa6", "comment": "Malware payload (Mirai)", "value": "bfb4c9d2a4e678f9faf4a382a002f6de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455802, "uuid": "ccec702b-9aa1-4e92-a93e-8c20f4273735", "comment": "Malware payload (Mirai)", "value": "be06206dfef5d6a7aca19f3686f148e4fa0d15f82a184aa2ea2f12bdd20c5265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455802, "uuid": "ed0fab53-726a-4b43-8e05-6f63947b7d59", "comment": "Malware payload (Mirai)", "value": "08d8b2dd83202a2a0bb3ee97648aaaa0e8ff48db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455802, "uuid": "89037586-e660-4a5a-a939-7581010fe489", "comment": "Malware payload (Mirai)", "value": "85b1dd82c2bc90253d4d98a7c98359c48767eee03f290f1c6ce8932bd54e3f5fa95270a51f3ee8a11a2d7eea6dfb7668", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455802, "uuid": "bd1a8059-8659-4e34-889c-764cf0c28c84", "value": "T1ED338DA3C4652E88D914B2B17036CF7AC383B460C6930DB5666AD7758883D8CB1AF7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455802, "uuid": "779053d1-aedc-45d8-919e-aef529b66e9c", "value": "768:+zFN9+PNSQUXaSnMsA6hzJQZZyoQwAdGk2WoJtAXcyuCUa7:2zQUXaAMsjhzJrVwA4dJyfuCUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455802, "uuid": "d3a7faa0-6949-44c7-952d-13408ccd24b5", "value": 52480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455802, "uuid": "d3052dc4-9db2-45c8-a343-e51f69c824bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455802, "uuid": "4d77894c-879d-46c0-a372-7f354f4323b8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bcbe36-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776455818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455818, "uuid": "53bc58ef-9191-4515-9421-33d5af5129d7", "comment": "Malware payload (Mirai)", "value": "ee39032f7c69f2e55bb274cdcebbc9fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455818, "uuid": "5184f97f-6820-4dca-9671-f49ef08fb669", "comment": "Malware payload (Mirai)", "value": "be5462a5aa74fe854dee72d4260d89084a9718a777492ce625ecedfd0863e244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455818, "uuid": "d1d8d6a0-8064-45fe-b824-b1fec4c5d231", "comment": "Malware payload (Mirai)", "value": "143f94f05c2b39d19c6e653e23a656e962064313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455818, "uuid": "e0bcb998-f4bd-4eca-8a0a-532af8bf1842", "comment": "Malware payload (Mirai)", "value": "a4ac4b4cf7a3b11a4fc46096186be50333b8d39dbf5b1c00f18ecb17f1bcb4743e10d9c0d8a32496cf1c407cbca9a32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455818, "uuid": "8ed929fa-8ea0-402f-99de-54d43a0de260", "value": "T127D31B47FB41CB53C4D22779BADB9249332397A5D3DB330649189BF83F8269A0E26905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455818, "uuid": "dee9efec-ae03-41ed-86c8-90fda8eb5463", "value": "3072:W02TDWxMQIwxBLf2is9juX9CE3o+mM/95FB:W02TDWx+6BLf2i+CXR3oPM/9TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455818, "uuid": "4ff29c46-538e-4cec-b921-4ba18259d521", "value": 135370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455818, "uuid": "487b9a1c-66c5-4262-8a1d-20b486378f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455818, "uuid": "fe2cc724-d039-4d6b-bd34-645406a1ce1f", "value": "heptagon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4455a3-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435775, "uuid": "a74f1e6c-75db-470b-ac04-a4fc415d6022", "comment": "Malware payload", "value": "791ead6b2a562f777d70e594bbd86b52", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435775, "uuid": "de872936-fd3a-4179-a42f-c70f5098be7a", "comment": "Malware payload", "value": "be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435775, "uuid": "c39b80f4-21fc-4016-9e6c-5f2fcbae3ab4", "comment": "Malware payload", "value": "886e568e4189d2f4ad912db54af82b1b6870f3a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435775, "uuid": "40c80957-4e20-45a4-8646-f375af1ef126", "comment": "Malware payload", "value": "ac8ace7b0b6ff03528060fdeaf2b255fd5a09544a827a55cc6cbda15bda1e2a8223443c48f932487d7863fd39cc38b75", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435775, "uuid": "536f28fd-3e25-4d8c-a35c-dee33418d639", "value": "T173B6D042EB958926C4BB63336AB3436176397E4A574387031858FD387C736E8BB427C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435775, "uuid": "92d595b9-9585-43e4-a468-8e5da718d312", "value": "98304:OZ3eNoU10SmZqVtTcpkK4EYr5eFmG1BSjbo3ANyLbD8ciFvPEo//3drmy0Tts6ya:JaUXmKwOaFmqBoPeobdrqTK9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435775, "uuid": "1abb7173-60a2-4848-9ef8-7abf87361361", "value": 10682971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435775, "uuid": "4476d9d5-2489-49d0-b559-62ff957484db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435775, "uuid": "41899ff2-4350-4ccf-b1b1-f1491ffd6e26", "value": "be.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26692fa6-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435442, "uuid": "59624fd7-49e3-460d-9a9d-b07f7c3b415c", "comment": "Malware payload (XWorm)", "value": "670ec3ac20c2e0a95855df8460165fc8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435442, "uuid": "795f3c5f-ca44-4d0c-80eb-7fbce1920dd1", "comment": "Malware payload (XWorm)", "value": "bf11196247528173195420fcac7cb78e58bec0af501e400f5830d82b9d031b67", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435442, "uuid": "a4005813-26ed-47b0-8f8c-b2ca9bc0337a", "comment": "Malware payload (XWorm)", "value": "ae661b832269024a9c6b5521d06800aa5d713413", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435442, "uuid": "edb4533f-473d-4d73-b5d6-c1cf91461f1b", "comment": "Malware payload (XWorm)", "value": "c7609591470547d795e303282b1d846ccb598cfda75ba5f534526ede973b5995d898b58773eb937ccede5b695af3c32c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435442, "uuid": "f2349200-6122-435e-aa60-22d1daeb52ca", "value": "T14CD5949816753D7A2DDB2E09200A6BFFB6C7FE6BC4347B44ED59288033D6D5F4268182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435442, "uuid": "aa820d20-903e-4cf9-94b4-b2c280d5a432", "value": "384:nh8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h88:ybD92yfre/US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435442, "uuid": "8d303135-24b7-4fdc-abfc-1d21e7b03ff8", "value": 2948954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435442, "uuid": "bd25a52e-11d5-4c7e-83b9-1884929b4404", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435442, "uuid": "5fa5f10b-6fb6-4b53-9c57-6c0b3af36b73", "value": "IVL_PDF_A002297532_20260415221501.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6830123-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776435656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435656, "uuid": "4f9b4364-043f-41e4-8a39-be02cadb7779", "comment": "Malware payload (AgentTesla)", "value": "d46ebaf281a432e3c11ea181f442c893", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435656, "uuid": "456bdc54-9e27-4b8d-8a66-98a149983846", "comment": "Malware payload (AgentTesla)", "value": "bf2b734d1cb30d917e9844d85ed079a00eb5d45278500ae94d502ee3cb800722", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435656, "uuid": "5e2973be-4d1b-445f-b722-4b0886964b1f", "comment": "Malware payload (AgentTesla)", "value": "708d01f625af94c4f27cb4d07e1455c34e8e5c7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435656, "uuid": "12b4020d-c2e8-411e-8544-06d74011c9df", "comment": "Malware payload (AgentTesla)", "value": "b36ed9751833a26acbdc0b01b5393982aa63bc5b59c0a98af5c12cfcc694c10d4f64ec55d6117e26713a669718a673bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435656, "uuid": "067488cd-af57-4cbc-96da-f9346b5f9b20", "value": "T1CEC5422958E181D0F651A93EC2C37465E29EF5C22E09002F4ABFBDDD50A7A3061DDFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435656, "uuid": "077ad7ce-9440-49fc-8b6c-54ad3111df64", "value": "3072:V2pQp//d2yDQ/22Q2g/VsDppsV2T/D/Q2d2//p2s28s/s2Ds2QstpV2dp6DD2g/V:MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435656, "uuid": "e30566c8-5f5e-4016-97e8-67ee0497a1ac", "value": 2653661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435656, "uuid": "6d53f8ba-0802-4d35-95ef-f482ed1d4d29", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435656, "uuid": "e959c5fe-46d0-40d7-bb0d-fcad27efec45", "value": "N\u00f3mina de ABRIL de 2026 56474783.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4d308e-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432391, "uuid": "b115586a-dfb4-4555-8542-ae1bd73f07bc", "comment": "Malware payload", "value": "2a9198986398d900f748231c0698d3b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432391, "uuid": "debb35a1-5612-4989-8d24-4d259d6d3b4c", "comment": "Malware payload", "value": "c06885e64a95fd91d5284c59b641a2d871f30920df08c84834fe3b1638e2e876", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432391, "uuid": "63def213-7533-44d1-8302-4a5cacd7b093", "comment": "Malware payload", "value": "a0db9048b2b609e3530b5bb0d42edc4ebe7a4c13", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432391, "uuid": "b898424e-f90f-456c-aa9c-20136a940399", "comment": "Malware payload", "value": "29aa6ed6c640932450e30e40903938f65e7dcacf3f0306333290eccd0cb6a2fc5b80755b76d5e49280e03f5969bbf5dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432391, "uuid": "68018f00-58b0-4d12-a997-1ce065dae2fc", "value": "T16385E60B9CFD88AC80EAE9788532B217BD657004473477E72FE256611F4ABF0A4B9F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432391, "uuid": "4c056a44-95b6-4ce0-8505-104ee502d390", "value": "24576:mY9VYfcOn5m6AL8KLZzrO94A0xmS0xvGFBp1LH00MQNCPMn5n8R:mY9Wcem6gN9za9RvvGp+loM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432391, "uuid": "6688abd7-89aa-4cf3-b90c-3149a3e59c1e", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432391, "uuid": "a3cae78d-5efb-4749-a7eb-25f611926e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432391, "uuid": "25b4e1b1-5eab-4fc2-8f88-3ae9c873b305", "value": "c06885e64a95fd91d5284c59b641a2d871f30920df08c84834fe3b1638e2e876.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546370e9-3a3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776416191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776416191, "uuid": "a94b1977-c835-400f-ab13-a759578c5453", "comment": "Malware payload", "value": "3512d0ee77445823157cb6a487576f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776416191, "uuid": "f6b78781-c948-479f-9ee4-5d4fcaddfdf2", "comment": "Malware payload", "value": "c2048e48933bf50ba92c595f15807c9b9b513ee284b0f05231ea5e52c2cc60e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776416191, "uuid": "7eadd3d6-35a8-4eda-8226-02276da93838", "comment": "Malware payload", "value": "d37085749a948691270d69ca58c4ddd85f37b803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776416191, "uuid": "9cc9a03e-c4c1-4396-96b7-88830f18d04f", "comment": "Malware payload", "value": "7bba4ecbda3fba17959b241f1df7ca678ed083ccc5d76df5711793a7c773e1b503da59b8276d3fb69c4f043f146a4ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776416191, "uuid": "05150aff-cb35-45de-a73d-769876e16ac5", "value": "T14D069D62B940C422E8E20076E2BD5BF65D3D9E74973990D3A7913CAC79301E3763E74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776416191, "uuid": "1b4b790e-642e-4916-83e9-59946cda1e08", "value": "d29ab681b34a50aa857299f51bee4106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776416191, "uuid": "8b1ecbac-6fa9-435e-a9b6-4ea16bfcad85", "value": "98304:hTR9J9RleBwl46gs/CO1O/J1AXHOhRP4HOlk:hTRnB+6gso/J1A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776416191, "uuid": "cf7c8b1f-af96-4065-978f-4c074c74a8f0", "value": 3899560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776416191, "uuid": "79d924a7-5030-4fe0-8a4e-9fafd56b75db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776416191, "uuid": "199510f6-91a7-4f97-b982-f0a644d34969", "value": "4k\u9ad8\u6e05\u7f8e\u5973\u5934\u50cf\u52a8\u6f2b\u5934\u50cf\u5408\u96c6v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8488dc10-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452350, "uuid": "371e03a5-91bc-4e6f-b7dd-7f882b3edb03", "comment": "Malware payload (Mirai)", "value": "0a957b255362c66a09e54652caf91f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452350, "uuid": "91c1ebd6-5468-45e5-a813-afc8af027169", "comment": "Malware payload (Mirai)", "value": "c262a3b0cb485797b3fb461725a49e6a1a65b8e40c51387df74ebe187c3dc6df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452350, "uuid": "619dc5ec-b5e2-4058-9e8e-cfa209133ef5", "comment": "Malware payload (Mirai)", "value": "c6e29b2069f77078e08fb15ff6276cc48251c4c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452350, "uuid": "b35de7ed-66bf-4cdc-b25b-b19292608a83", "comment": "Malware payload (Mirai)", "value": "dd23d284762d024503fa29e70278b587d18a24714d9ce7e76d98bf7912c65d920aa86af60e0b4c13fbca1d4f8a034c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452350, "uuid": "2c5b7eea-e637-4a0b-b1ca-42ee10c22331", "value": "T1F993E185B114EA1AC02272FC70850A44D3B16DFA4B4B2A0694A2F6B46FBCCD63F07ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452350, "uuid": "7cd11d97-4cd1-4ec2-a082-865a2a6f1f95", "value": "1536:JQP7Pqnaxwkj7+HenpZKbIMLPChbBxA147e9x758epl9ZLDSwSVPLSQppmpEwgFM:Izn7+Hs4LPCA47sx753RMwSdHmSwuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452350, "uuid": "c3a39944-c3db-46fd-b013-4acb14dd2494", "value": 95248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452350, "uuid": "817cf258-9359-4c93-af59-458bef840583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452350, "uuid": "3596bae9-7241-451c-8538-bef770ba755e", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf481a10-3a9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776458059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458059, "uuid": "4820a69c-437c-478f-87c3-e4e260bb1a6f", "comment": "Malware payload", "value": "c9c278232cc35489d9c700d6a7a40e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458059, "uuid": "a00034df-81ef-4178-b7c9-da29782d0a3c", "comment": "Malware payload", "value": "c28d23d8658abc1f5683c6b50239d5593eb7a274a3abec56124d7fb43fec1b64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458059, "uuid": "4750d9ed-9c31-400b-bb40-09d39ececa37", "comment": "Malware payload", "value": "38f5b1948a7777d8a09bf816e303a4ebffea9f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458059, "uuid": "c9b18a32-28b5-4ea9-8097-28ce17feb499", "comment": "Malware payload", "value": "fadea07afe3acc32e68807f12f3171d3393720f03eddfaee3472d031bda4d3e439997d35472982cfd4ce5dacf2e020e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458059, "uuid": "28449da4-5c61-4b75-90e4-f8b1d24b8c35", "value": "T10AF351D2AB898C39F66A793940219911BC6EFCF8FBD404CF0A8C76161AB13D864F5D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458059, "uuid": "0b36853a-ebb8-445a-8496-d9a9e7ecee3d", "value": "33c9c046a7417a256f268223ddb06574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458059, "uuid": "089d3f1f-2fac-4d3d-a903-9fd3a4ea9eb5", "value": "768:/umxDLrltvOML6nvCRdOEDGt8dzGjTpOR9MpbkvN+1kylhN+Os:2mHvvOM2nvCR7GtAzHMpA+1kylhNRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458059, "uuid": "7e9857d8-472e-4287-be27-cd1342b22c11", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458059, "uuid": "88d47fd9-a8a9-453c-bd72-379488763dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458059, "uuid": "aa52db9d-f38e-48da-9d25-6b427cdf09f3", "value": "2026\u6d59\u6c5f\u4f53\u5f69\u201c\u8db3\u7403\u5b9d\u8d1d\u9009\u62d4\u8d5b\u201d\u62a5\u540d\u8868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2920e35a-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434587, "uuid": "74984cf9-fd55-42b5-b1b4-45cb94fcc06b", "comment": "Malware payload (AgentTesla)", "value": "a40d1e2c7516dcb5ac7e2a71b4b0e1c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434587, "uuid": "dd85711f-27b2-4845-b774-2737e4a535fc", "comment": "Malware payload (AgentTesla)", "value": "c2ffe85aec4fa6a64f3e9d55cb50a2a69f4b8c2c4aab905c5d849fa8ac0551f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434587, "uuid": "5bf2db0c-e28c-4ac1-8411-ff21ea4ea36e", "comment": "Malware payload (AgentTesla)", "value": "2df83ea2371635e0499494c9be584042fa1568e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434587, "uuid": "cfed198e-075c-4f52-a2cd-c86d032dbdd7", "comment": "Malware payload (AgentTesla)", "value": "995f45f3779784aed61163603219048a691834823b40554acb519a8cf0966157915d73fe3edd8d01ffae899a414ec6a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434587, "uuid": "fbbc9bd1-232e-4bfd-894b-1066d65531e0", "value": "T1896502115DC43FA8CFAC6A1D90FE250EA3E04E8A5019B64AFF37BD4EBFA79045117198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434587, "uuid": "754c63c1-d872-489f-a1b1-535160f6a0ff", "value": "24576:iG1hW/4PbVGSRoyw9aE+qQnjUf+ZTJPJUMvCTuX/QhRXPf9mvuRlon0CI3E3A6vl:iG2YbQSepSIAzumkuir6I9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434587, "uuid": "551e469a-edca-4c74-838f-0c3cadd0cd4c", "value": 1528361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434587, "uuid": "79e73319-712a-456a-a2fb-3ce488e3a04e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434587, "uuid": "195de8fb-22ac-4575-9cad-73f591a16af9", "value": "Credit Note A12345-045_20260403_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96752ffd-3a26-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776407283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407283, "uuid": "2a2c4c02-3eb7-4353-a563-cabbd1a1cb0c", "comment": "Malware payload (Gafgyt)", "value": "e533b43164de8a87ca3f11a967f2da90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407283, "uuid": "73c45cfb-bf5d-4d34-b452-75e14c5ed9c8", "comment": "Malware payload (Gafgyt)", "value": "c4e9c7e8ddf9d950f60d5b59b6d3258959ea3346e4b1c3ea335950dbf3024dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407283, "uuid": "f153237d-2a14-4d1c-b498-342400c49410", "comment": "Malware payload (Gafgyt)", "value": "c6b0faa34cd5f8c5a913bcb4fdc94d71a9bfcbc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407283, "uuid": "866d3256-e5aa-47b2-887b-f908d47b5314", "comment": "Malware payload (Gafgyt)", "value": "fbe134fa44b3afaf287596188c55299253c9f2151483dc734a8dd803d1d309ea8d7b6b653e626584877f1160467b1087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407283, "uuid": "a7ce9c6d-30b4-4607-932e-f7ef9d12b484", "value": "T1DBC33A2B3B231E23C0C9507102D31332BAB5D76538BD57E7B9D06DAC2F1AA983416BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407283, "uuid": "2e4f9213-894c-4fc8-9309-256e2b0d9472", "value": "3072:9SRC0+2noxQHh0NPGHCphakTrnorm/nCEP/UnSQf/R:HlgCphakTrorm/nCEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776407283, "uuid": "74b40619-d9c4-4062-8a57-71e1b3cbfcbb", "value": 127477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776407283, "uuid": "f526e757-42c7-4e7a-8e74-db572ab01b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407283, "uuid": "550538cd-120a-4c21-9d96-17d3dbd7b086", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09c286f-3a48-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776421983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776421983, "uuid": "862c9498-53e7-4b76-8f47-d9039f96a9d4", "comment": "Malware payload (Gafgyt)", "value": "4f87305aa05396a4c45c355e1c9b7fb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776421983, "uuid": "a95d5d38-30a2-472c-be42-8345b3d22634", "comment": "Malware payload (Gafgyt)", "value": "c502d9e1791943b3090170a45de5e278d275c5ed1b58cf1b3be5059c6e36f3c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776421983, "uuid": "75e4f009-a336-490d-b405-e92c3b4d646e", "comment": "Malware payload (Gafgyt)", "value": "4a6674c5943edf429e5221f02d0e0913ca3fea69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776421983, "uuid": "9f7c6500-dc8a-41f5-ba28-cb874260c7b3", "comment": "Malware payload (Gafgyt)", "value": "16014d48f5c952507210fe29a8f3767507315e88bbc2489935b96efd5443b8e16377e45a3be6bc2523343c9dbdff504a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776421983, "uuid": "7b32fe09-792b-4e95-a2ef-5104f48f97d3", "value": "T1A8B34A0758606F77C045AA7129F75930072BBA220F5F1B8A757DAAB4174F8DEB00FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776421983, "uuid": "38840f4f-c009-49c3-a963-5070d48be178", "value": "3072:FxmbUnP+Yza5LUMSEB5hLwoSCpLkC0Px9gQNfR:FxmwPDmyEB5hLwn0LkC0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776421983, "uuid": "3412d2fc-25aa-466f-8c48-b245ec58d2fe", "value": 109055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776421983, "uuid": "246d33e9-7906-4b4d-ab58-d992b103e3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776421983, "uuid": "7145dd86-c717-439c-ae46-6abf6950513b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a86f39-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458554, "uuid": "8b8000ba-b719-4dd3-bc47-4a479e25a6c4", "comment": "Malware payload (Mirai)", "value": "cf449f8af27f1b60c6aa6ef55e392fe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458554, "uuid": "6fa6a822-a471-455f-bc3c-515fde1d9d89", "comment": "Malware payload (Mirai)", "value": "c6c3ac80bb1f31bd44a9bb9a2f811f573c5a12eedce5822c659c0a4c1be3bf49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458554, "uuid": "04ce7c5c-ec8c-4a5f-98fa-5d59d524bacb", "comment": "Malware payload (Mirai)", "value": "51927b665b8dd2b7f82dbc4d1c64ee622f4e6097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458554, "uuid": "d8206986-5a70-42ce-9c98-547147793662", "comment": "Malware payload (Mirai)", "value": "ee6ad724aed81975a7527b2836cdd9d37d1b3b4b1559f34729697bfff6e098891857dee3ce3c426ffca28938c24cd600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458554, "uuid": "f34ea12a-d5d7-4083-b6fc-bfbcabd0342e", "value": "T1BEA31885E3D3D5F9E80755B001ABEB769A30ED3315309EBAD760BFF265216C2A11632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458554, "uuid": "03c4d9be-6e7f-4e26-b441-580fa16f8d68", "value": "1536:YAk2AS47FQEUAWyMgxeKej04Mvp57txc3kKtfJQ/7PUE31ZXrVTW2txr:USw8AWBVVjXMvpDxc3kRrXZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458554, "uuid": "42df08b6-643b-4743-8617-909beee1bd1b", "value": 106348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458554, "uuid": "c160d06e-2a5c-4e6c-b4ee-d09c597d7803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458554, "uuid": "f4dd0f6d-96a7-4b40-a280-305f5ea4b1c0", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b713839-3a69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435826, "uuid": "8f1cbfd9-7e15-4ec2-a89e-0591f8116483", "comment": "Malware payload", "value": "3db8e136afd53dd438955fc938929d72", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435826, "uuid": "b18ed244-90ad-40ba-8072-9053ff58a408", "comment": "Malware payload", "value": "c6e203c681d5ba9786a870a67b11dd784468a640816844c197a4b5a14a9bcf81", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435826, "uuid": "d724800d-603c-4a31-83b1-886e4395b312", "comment": "Malware payload", "value": "7489835484fd970fcb540150ebeb009c62d244f7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435826, "uuid": "ed575815-57d8-4fbe-bc71-509f3b75dcb6", "comment": "Malware payload", "value": "235433a3d409e6e6f506cadd17891e8023223f8d9a7f4ace74d78a5f1b76b1390643c666f89310be37c8b856ac22898e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435826, "uuid": "4b0e0301-f91e-44da-a53c-465d2cc0a4c8", "value": "T1410127114D970221D2B7CE7F58DFB302C9A87D83DE418E69026491893554211F5F9D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435826, "uuid": "2e33e43d-1fe1-4741-b9b0-d6a1dc5c4f8f", "value": "12:8YlFm/++VSXzzeMDai0WMyDD1ZS6LiN37+lbYOqCMh18:8xp4T01wRs6yrab+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435826, "uuid": "d1661131-cd9a-495b-a51a-9fb647a0e5e8", "value": 716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435826, "uuid": "6dd681d7-0c63-4945-b0b7-0877d54ae66f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435826, "uuid": "2895c6f0-7c1a-4e3b-bde1-c9760835658a", "value": "fakturra__7062032.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2136cc5-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458493, "uuid": "f2efea4a-a1fc-479b-a243-f065f505126d", "comment": "Malware payload (Mirai)", "value": "16ab1fa2a6200963e0d198b61140ed22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458493, "uuid": "a2e89a42-4a11-4dd2-be22-48dca9f8295f", "comment": "Malware payload (Mirai)", "value": "c74035e16ff5fdc3b373d7bc6fb0731c5f8e52de625433251fe3481ccd585876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458493, "uuid": "5c11562f-31de-4036-8204-b21e7e80145d", "comment": "Malware payload (Mirai)", "value": "3e1d56a9cd25833f77d67e75e1c991651ef48645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458493, "uuid": "be0986bb-e2ba-4e4e-8d12-6ae2a87c7d6c", "comment": "Malware payload (Mirai)", "value": "206033c285c050f7831fc5879a8c3188808233971e73cc73a7e7afa78fec08fffe096eb8172c3e8ee4536f0dc78d39e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458493, "uuid": "89cfc263-4c77-411c-93ce-2cf179c7a7d1", "value": "T11B932AC6F683DBF6D84314B206F7F7329931FC3A4465D9C2EB643CA2D9129E1661229C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458493, "uuid": "5c03751f-24d4-4282-b062-3e76f4221034", "value": "1536:7EzkoU2h0IEvmIrdwZWyQOo+5gUdxcSqy2IJuUhGUWYLagd7L9brhg:7Ew32aZwUyQ9+5gMxPuUBjLlDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458493, "uuid": "53e84147-70f5-4b7f-801c-a189f20f300f", "value": 95016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458493, "uuid": "b5223ecd-3219-4db3-99b9-265b18f712a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458493, "uuid": "b7083100-00d5-48ca-9116-f648c55c3ba3", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a164c9c-3a26-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776407289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407289, "uuid": "fb013f9c-8a90-4e93-be61-8acd42886b72", "comment": "Malware payload (Gafgyt)", "value": "88ca9bd5e55ca6c95cba88b39e7a812e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407289, "uuid": "8137961e-e654-4cf1-be72-40f2c334bfeb", "comment": "Malware payload (Gafgyt)", "value": "c847d8cebe44eec7ae9c476391aa2a0d1fdf03a699e0b56552e8074cca3cf6fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407289, "uuid": "16aa1627-997f-4a5f-a9e8-dc78443c197a", "comment": "Malware payload (Gafgyt)", "value": "73efaa7b782117a921c451d5f9b969d4db710463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776407289, "uuid": "67ba4242-4c93-4007-b921-250f074a8ec7", "comment": "Malware payload (Gafgyt)", "value": "954be17c7654a6a2c7186a87c6d6a0579921eec1bc1ac45fdbf1052188421f6fabe2ed44facbc4c100e3ece2b7556dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407289, "uuid": "b1494727-10c5-4c38-bc75-55ad507c670d", "value": "T153B34A47671C0B43C58B5AF12DB737F187ADEA7106E22185E40EFF801B72A705622FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407289, "uuid": "2635d713-ef08-438b-b6d9-b9eebce1ca88", "value": "3072:w/ZpCk/EO0Z6i5JCmF5hyp+WvCtQna0PDG4gQNcR:eZpqO0Z6i5wmF5hyp+5tQna0PDG4gQN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776407289, "uuid": "31667de9-2199-485d-b0ef-1590ea236be9", "value": 116437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776407289, "uuid": "b7064bf8-c5fb-4ac1-9fe6-57a85deae650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776407289, "uuid": "94e92374-e915-4165-8688-87fe6d3c3885", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeafe436-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455857, "uuid": "7724d4da-1d54-41e6-a9ed-9f39b67b51ba", "comment": "Malware payload", "value": "5cd304383345501b6936cfd0f106dd11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455857, "uuid": "17e2eea0-84ac-4438-851d-269320772920", "comment": "Malware payload", "value": "c9fffa294bc09a9d9199b41403057a9a8130448f8e9c474512b5c0f2c89667f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455857, "uuid": "927719fd-50c4-4cad-b0d1-1bc6b7633674", "comment": "Malware payload", "value": "572b6962d60366a013cebc81f6d717793cdd483f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455857, "uuid": "d59aa205-a5e8-47bc-b871-98f52b43ef0f", "comment": "Malware payload", "value": "8cf7f132fcb59456e05913b071189ec954947ceed1e16e10ee4e776e9c05264340bc4174c526aca0ac4386672bc96b2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455857, "uuid": "b7ebdc09-e451-4bf4-8a99-8466781b52fa", "value": "T17273C34E2E324FBEF73D833947735E70C655239A26E1DA41C26DF9026E2020E685FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455857, "uuid": "1605a77c-67c8-4da2-afaa-93f32ddd71a3", "value": "1536:xPHXyg98Ow/q3Oo5YzZy6BCWUsko2CMBRTzqG91d8BlL5nQl:xPHekoRMBRTzqcuBlVnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455857, "uuid": "b6fbb6d7-e07c-4e77-82ab-aecbae5e3293", "value": 80632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455857, "uuid": "c12eba6f-a33d-455d-acd0-40670ce99d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455857, "uuid": "50eae24a-28c9-48dd-a82d-8980f2b62607", "value": "diamond", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2049ddf3-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776431995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431995, "uuid": "e33d16f8-a163-4eed-b8b5-b0bdb07ffbaa", "comment": "Malware payload (RemcosRAT)", "value": "634fe2861e181557b2c68a186943763e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431995, "uuid": "ca7ddf39-69f3-4688-90e1-05e5cb2f492c", "comment": "Malware payload (RemcosRAT)", "value": "ca12df158c7e0c07e1ce8ea3c083833469b6c60096238a30429c147fa3b55be2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431995, "uuid": "8e16d8d6-6273-442a-a594-adf02784ff3c", "comment": "Malware payload (RemcosRAT)", "value": "e298f3fb9ac12a5333039fc8f5826b4419a197d4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776431995, "uuid": "06fe72e8-8df3-4f53-8244-eaaafebc70ac", "comment": "Malware payload (RemcosRAT)", "value": "4f9b4f41f086980bd46f7a79d8078c8adcbc7c4f8ebef8c6f7c900686669a98991e7f8c1424ea9187f12b931cba1abd8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431995, "uuid": "76543840-a747-41b0-9f0e-3ab989436ac0", "value": "T165650126F1D9C88DD063C27A892799C1136DACB4A768BED3315F7373AC37B1A42A7141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431995, "uuid": "5b4b6187-3c29-45b8-a595-4e4cad3240bd", "value": "24576:qeCnGd4LJ7zYRT80/KadrVweCnGd4LJ7MYRT80/KadRic1ZlUX3lu:rCGd4LiRTh/NxCGd4L7RTh/FDwVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776431995, "uuid": "9376dde8-5060-40f8-b5fa-317232ca7c8b", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776431995, "uuid": "8fa64de9-6196-4e04-8168-2641acd9585b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776431995, "uuid": "c6c5a26f-d6a0-49da-aa43-4adb9b300f9c", "value": "ERSTE Primjerak kupca.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7441c8a6-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452323, "uuid": "4d2975a2-be26-4adf-8740-792d7cd7c699", "comment": "Malware payload (Mirai)", "value": "5b59d33d946fa0dd9f1b1170ced4cc85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452323, "uuid": "00066eac-864c-4e7d-bdba-86ef1edc1d69", "comment": "Malware payload (Mirai)", "value": "ca533c1f725164973890f67e3c4c607e85f16f85ae360833427e0f1dd7cce22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452323, "uuid": "50c0c346-90b1-411a-abd6-400c965cf50c", "comment": "Malware payload (Mirai)", "value": "4e65ad427404eee8c5eac21ce61a3f6cb170ff83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452323, "uuid": "f943bb38-0393-4274-acd6-30f93cc01034", "comment": "Malware payload (Mirai)", "value": "604d63321b79efdad60c0f0888705d9033ad3c6c7a8648c274dbc225598b3e30573263e59e84ee729df12b736bef5cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452323, "uuid": "25943e49-0b44-407c-a0a3-53cfa68eb7ab", "value": "T141047020FA0663B1CC720A3897966E5A6E7B04559FEB26312D1F533DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452323, "uuid": "fc0cb377-ab20-42b3-b257-1364d605acf3", "value": "3072:VcVkb380Xfc43ZwnK14fObW8Z2jdWz1R7UKZ:VBQ00yZ1NW8cjWKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452323, "uuid": "ffe26783-fe1c-4421-bbc0-d61893d154fd", "value": 184896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452323, "uuid": "8b15e5fb-8e27-4de6-969a-131331700ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452323, "uuid": "aec1b69d-1575-4070-af37-c48a1d68cc02", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3849fca-3a19-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776401721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401721, "uuid": "40cc5967-ce6b-41d3-9e67-d69c460f60d5", "comment": "Malware payload (PureHVNC)", "value": "245888def5f01acf2c97f336e8f9a979", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401721, "uuid": "79ea271a-8ec3-4823-b497-3f2994faa2d8", "comment": "Malware payload (PureHVNC)", "value": "caf5a5db7e61fbc92ac5854b25078c5d91104a8d2dd0179a3264ead8a305ea7a", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401721, "uuid": "a9ba60e2-56e3-40b3-a474-eb96e5a60d27", "comment": "Malware payload (PureHVNC)", "value": "f5b32c4b52dadf663617c2cb7688dd4643c4b478", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401721, "uuid": "217da4be-a1a4-4f28-af85-bacc88786ef2", "comment": "Malware payload (PureHVNC)", "value": "07e3d672ee0e0c340cb781def9711fa9ab65173278ec50952e2197f2148e742136b77b31f5ee3e6e27325b5b07a5ec25", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401721, "uuid": "f37484f4-37d2-444d-9040-e76c9ab4659a", "value": "T1E8542038AEEA001AB173EF64AEE47497E96FB773370E585C1081038A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401721, "uuid": "2ba122d0-8291-40ec-98c5-2dbf7f8aa60c", "value": "6144:41QQKPftr12um+iRFTxuPjFWQcFBK/SlYhez9AD/5zwH4X7sLjZiwCGEtPgNu:41QQKPFrvm+iDTxM55cFc/2YhI9Au3jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401721, "uuid": "a215ed20-ed0e-487b-89bb-2ec2e013aab3", "value": 297882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401721, "uuid": "4d6be869-793c-41ec-9a59-dddf17ba7b6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401721, "uuid": "cdc92e6d-4c5c-4fff-af78-97ebbcd5c760", "value": "TT COPY 5041122904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fb7fcc-3a15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776400006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400006, "uuid": "c7370bf1-be45-44ec-abf8-47e5f05f4919", "comment": "Malware payload", "value": "ffef35541e153ae809ac00d7501a13e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400006, "uuid": "feda1e96-39aa-411d-828b-0894675ec772", "comment": "Malware payload", "value": "cbf7bf4810bc0be2a2486bad24835e1d653315c16a98b4cf0b778b91d9eacbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400006, "uuid": "cf4746e9-4de2-4b14-9abf-202a40655be3", "comment": "Malware payload", "value": "17d08948ab0b254ecce70002e8cc138e404eb2fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400006, "uuid": "25b4c529-26c0-46b4-a0ba-6aed199db094", "comment": "Malware payload", "value": "b111b6ae770f884a8971244313294fbfe1dadd7a77d62825de9f06b576bc447df75da54252a45edc73e8bbd140273d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400006, "uuid": "660a23f7-ce3f-4aef-9c5c-83838a5349ee", "value": "T1F3E45C03B7A58EA5D3484737C1D6040453E68D8267ABEA0F319937A63D733EAED03A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400006, "uuid": "e4f9ef5d-3b71-418d-8547-a36811590df1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400006, "uuid": "6ab890b6-f02c-4bd8-a572-a0ca75e774c2", "value": "12288:Sw7kfOL9qXTcyhVSf/aQdy9jFWWoFgNNT9IwoFK8mv2fEAmD4:nj9qDcy6Y9hWWoGFI7Flmv2fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400006, "uuid": "54b5afdb-c2de-43a0-93ff-e952496a2e77", "value": 673432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400006, "uuid": "0d1ec621-7ec0-472f-b658-2b59fe69d02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400006, "uuid": "3bbe99ea-6b84-4330-92e4-194aee0ed704", "value": "100011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c82802-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776434365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434365, "uuid": "bb00db7f-c26b-4ed0-8df5-6f108fca2acb", "comment": "Malware payload (a310Logger)", "value": "6d82ab03656b6026d3d4121fcb917e93", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434365, "uuid": "b97f02b7-3fc4-4e85-a1c9-b6ab28b21a5e", "comment": "Malware payload (a310Logger)", "value": "cbfc0a4bf47097323a80d459a4b511e0cadeba5b131c1349c9345056d6030791", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434365, "uuid": "4eeb95b4-af38-4e6c-95bc-9b9f7665a315", "comment": "Malware payload (a310Logger)", "value": "3d51e4716590edbdd1537a62de02a39197549044", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434365, "uuid": "4f47624a-00f0-4c6f-a33c-4946e0bb13f4", "comment": "Malware payload (a310Logger)", "value": "f2ea1ecb2900aabb27ec2854957a38ddbee500f575930bc4a3dbc73d21cf97d363075b8b80ebe69d67f12e6482ad5a21", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434365, "uuid": "20b55941-0de9-4e40-9040-a8e781c3ee4f", "value": "T174C5021189C43FB5CFDC5B1980FE160EA3F00A8A5456B58AEB33BE4ABFE7604511B58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434365, "uuid": "8339bf7c-e248-4866-9243-501540ff42ff", "value": "24576:I7Jn5d7s0FHOhQLDRh9hBFTqWA1b/vS6y9gLnDmE2icXoqns2yVXqPlGupKEWarK:uh9VqzQmHFqnmoZJXTKu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434365, "uuid": "f5a99fd9-70cd-4d20-a543-40ee8356f877", "value": 2559826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434365, "uuid": "dd9de0c2-5068-46fc-94c0-40771ee44590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434365, "uuid": "6ebeac40-65a8-4042-86dc-da89b92e1459", "value": "Swift Email Bildirimi0008909890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5000c5-3a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776424743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424743, "uuid": "ee75d047-63bf-4ffc-88a0-fc88d52b6ecc", "comment": "Malware payload (Mirai)", "value": "bade16a8e1834aa0056bea03e94f1527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424743, "uuid": "2cf07288-4887-4851-a6e2-46a1ae121c28", "comment": "Malware payload (Mirai)", "value": "cdb7c52b80531663b1065f7b4a27606d0f06f58d97464f9f15d766ede8ed942c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424743, "uuid": "13e11f4c-7004-40e6-afe2-e570cefb4007", "comment": "Malware payload (Mirai)", "value": "ad203b587f057fde22fb51e53511329b3569ee8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424743, "uuid": "130506da-5dcf-4978-b4ca-4ba51b246abb", "comment": "Malware payload (Mirai)", "value": "676b15bb67e0b2f9d12fa3ed86bbc14161db5413978d33cb53a1978c6e4cdda7280c967b548382d485402d01c78d0f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424743, "uuid": "c758b508-679c-4890-9a63-2646e3a93d5a", "value": "T1AD03F1B0072C3AA1C1B28C77B8794B616A5E4377F6F4307637AAC5846E1419F57F8B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424743, "uuid": "1531d073-8eba-4690-8f36-247f6c753029", "value": "768:UvZPUk7Aw6uBnYAuOPwBCV180GEiO6IiTSSOvkRzL3umfYs3Uoz55:UhPP7Aw6SYSPWCRGNL58krNzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424743, "uuid": "406e1133-fb63-4f61-a2c4-4ca0a7da1ea2", "value": 40092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424743, "uuid": "a45d13f3-4302-4baf-906f-09259b7e67d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424743, "uuid": "89f52034-c252-49a0-aaf0-a8ffc50a6297", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b8dc48-3a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776450657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450657, "uuid": "9028cba8-79f9-4ea9-9c58-e9b07a3bb9d9", "comment": "Malware payload (QuasarRAT)", "value": "e9aab20d874cdfb22be36996e60a3770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python-ui", "colour": "#D373DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450657, "uuid": "0013f0e9-e31c-4443-a26c-b1396f237893", "comment": "Malware payload (QuasarRAT)", "value": "ce59916ff52c012f87342f2ec7937f85e7f13fc72d37f077c2e0ea6d4ce01a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python-ui", "colour": "#D373DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450657, "uuid": "9ce679eb-352d-4c13-bcc4-0f7a0f3e8dd5", "comment": "Malware payload (QuasarRAT)", "value": "1f63ff410c46203a0c369901f7f79f0d6f5d3570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python-ui", "colour": "#D373DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776450657, "uuid": "530a6dfc-8f58-4321-93e5-442adc4a5982", "comment": "Malware payload (QuasarRAT)", "value": "41e3bdf01ba6b7a7695f9fcf0829874323cb6cb4e9c52c9b84d15ae1c8f3cd63e02a663d4d75a5d3303bee211fa59b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python-ui", "colour": "#D373DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450657, "uuid": "c3db0f3b-7ee8-467e-919b-469e937de3f7", "value": "T1FBF56B143BF85E27E1BBE277A5B0041267F0FC1AB363EB0B6581677A1C53B5098427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450657, "uuid": "44f1577e-58e0-43f4-a833-459fbc5fe50b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450657, "uuid": "1dc48ed9-86b7-4fa0-a9dd-30f1d9b66a06", "value": "49152:mvNJ1+2g7axHTYPVlO0Szgcp5bW9hRJ63bR3LoGdYTHHB72eh2NTH:mvfY2g7axHTYPVlO0SEcp5bW9hRJ6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776450657, "uuid": "5258d2ed-9777-42ff-8a23-9a3edd8a7eee", "value": 3365888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776450657, "uuid": "35c54462-52d0-4842-be01-b7f1fb6048dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776450657, "uuid": "960fdb24-ac8c-4e4d-93fc-fadc1cfbc5ee", "value": "SearchIndexer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920498b0-3a84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776447648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447648, "uuid": "948bfd69-5d16-4a7d-8622-13cc8173aa51", "comment": "Malware payload (Mirai)", "value": "1ce6beb1020abc256be2c58352d98648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447648, "uuid": "e52e8279-8ca8-4f38-8f40-ea90329b036f", "comment": "Malware payload (Mirai)", "value": "ceb108d4d8497ed2f0c8b1a2a65d746aa4a4ac6525ae32997d99ff195f6149bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447648, "uuid": "85ad99bf-1562-48d0-9cba-fbe4dc58ee6a", "comment": "Malware payload (Mirai)", "value": "f6e122a1995a65412ead8861785a7daa23fce397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776447648, "uuid": "4af66e21-f78a-4802-927d-805a478c482b", "comment": "Malware payload (Mirai)", "value": "e8da5e757095913b22444808ae9f287eeb19651f3cb652eb87234a23cd24d2e163160e2733196c230a97a32dad331924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447648, "uuid": "f0c6acb8-84a5-44ec-89d3-2033c51b460f", "value": "T1EC730234AE73FC53FE1884FE866B108A9EE12E8CD1E9B911560610E990CD173760D7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447648, "uuid": "0b1e3a92-d98e-493e-9f35-8506d939fcc5", "value": "1536:MPrt6flR7Gzq39eKt3Jh0CxHwJ6VYF6aK0ti5z5Rl2aoAwBiLg:MPrtElRS2tftzHHE6WFBK0w5/l2aooLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776447648, "uuid": "394a49b7-d708-46ea-8805-d4d510b329ec", "value": 73580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776447648, "uuid": "60c777e6-c748-46bb-abaf-60248b29d9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776447648, "uuid": "a9f9eb61-1740-4320-b0cc-6d9134ccdf68", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb64e67-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456202, "uuid": "9aaa7a59-21bb-42b9-b397-c1f77f58981f", "comment": "Malware payload", "value": "7ef54134d30720953e730c1ec755eb43", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456202, "uuid": "284cb971-9539-477b-96a4-883ae03589a0", "comment": "Malware payload", "value": "cec6fc6496687b177b14d6699d82a18840b528bff5543dfb6e23c0849f3c8de2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456202, "uuid": "7d05022b-80ad-4e8e-8a1d-e0905c625067", "comment": "Malware payload", "value": "2511e64963555df726085ea87b7e793edf949a5f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456202, "uuid": "77691688-7289-4c59-9cfa-fe07002391fc", "comment": "Malware payload", "value": "947401ea4274ef7c42183df478e74eae094ff5edb72ea937c7ab85d2f338ffde3c4829596359c23451da4b22e47a705e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456202, "uuid": "d18e7512-598c-4c67-a727-65fe99cb1022", "value": "T12F26F103FF45CA97D8AA83F66F630DA92A134F18C742AAD30411767E6E771D10DD6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456202, "uuid": "7be60605-803b-4e92-a1f8-b5675cff96ca", "value": "98304:nKkswpxrbSnkQYNAAUMeKnmxmzbzBETw0tALKQBifgh5:nK8GkFsAJzSbmbAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456202, "uuid": "b84a55a9-0197-469f-a713-75dfee47b4e0", "value": 4742610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456202, "uuid": "a22705d7-6eda-4477-9aee-24ed16c77c2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456202, "uuid": "4505c5a3-3c2e-4b44-b423-5a5e370e3a3f", "value": "Telegram.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3e52f6-3a8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776451187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451187, "uuid": "0e77ee5f-e233-4687-9cfc-50653d98a289", "comment": "Malware payload", "value": "698b00c2e0db8158acf77df07d2482bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451187, "uuid": "78b6f3b4-0135-4e9a-92d0-e6fb45a934cd", "comment": "Malware payload", "value": "cfd5885b3f2a9e0ea42fd36035e41f6e8c7f1550975575cca640d14d680e5229", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451187, "uuid": "447d7d68-2430-4e38-b442-1e733fac6333", "comment": "Malware payload", "value": "597136caedc159eb3d7239c3dd3899a5c043097f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451187, "uuid": "a0bb1168-4d31-42ef-959b-51ff7068c70e", "comment": "Malware payload", "value": "991a1eb7554382cbbbb1b023b77afb0ef4bf07f038af4c37373c9231c60d39698366655af26de723ac710deb8792e2da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451187, "uuid": "5a879b7b-9d54-4730-bfd2-baa154e7eb38", "value": "T12225F51B5CBD84F8C4EAE5788973B207BDA23000473877E72EE146511F9ABF4A4B9B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451187, "uuid": "9828163e-f67a-466c-920f-cebf960dcb17", "value": "24576:NbASLmonVCXrpXNaH2HpFa+TRQPhu0kel3Tev:NbAOVCNXNaWHt4kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451187, "uuid": "d5ad264d-da5e-40db-ab1e-b0d9c06d5d5e", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451187, "uuid": "5725553c-eec1-4ccc-8537-a116d955e902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451187, "uuid": "38756af1-fbe0-4d09-a38b-4bc745c7f775", "value": "file.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764bacc5-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452326, "uuid": "d8694871-3713-4d18-a94a-f699fe63f16d", "comment": "Malware payload (Mirai)", "value": "e6547fc57df2ae6e83fe6bae1bfe70f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452326, "uuid": "647f0613-e104-449a-b3b5-315944e4b035", "comment": "Malware payload (Mirai)", "value": "d05ca7a6ac5b850db3861c81ec166e8153eddb343c793a8811587bcf6690a988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452326, "uuid": "4165e201-2926-4088-a76d-d5d62d3a2d68", "comment": "Malware payload (Mirai)", "value": "23b2b2ea4ed8d1306d5b23c3dce13c5d2a83de00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452326, "uuid": "ee5f67a5-0f0e-4da7-9d5c-9a17a713c1be", "comment": "Malware payload (Mirai)", "value": "260fe4a84554b0327838eba22cdaf1d463b9a97fa83f5e37a1aacc75b03d7bbdb6cd3117e399eac18a78650304a9dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452326, "uuid": "5da067f3-1cef-4f2c-866a-162687beeeb2", "value": "T15CA34A82E6A2E0F0E68701B01157F3E68934E6345426CED6FFA93D71EC717829D97A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452326, "uuid": "9089482a-5e95-47a0-8a4e-c35b976636af", "value": "1536:hbcmH9gbivQ5MfsobJRF0yBHicocLcyCs6q/QVImw7G5nMCReZ21Urg:homH9uiI58FzJNvLcC/QVIxCgrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452326, "uuid": "62ed6a98-94e6-4763-8ac8-7f6d89f6e43d", "value": 107048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452326, "uuid": "e838201c-f4ec-440a-ade5-d82ad4f5c153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452326, "uuid": "db8e6df8-2ca2-42a9-97a6-91b3d27b998d", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb95a182-3a66-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776434860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434860, "uuid": "b1f76ae5-f92d-4396-8a42-072a051d95cc", "comment": "Malware payload (PhantomStealer)", "value": "119f4c63efe39c1afe386275fb94ceb3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434860, "uuid": "de8168f2-7d7d-42a6-873f-1465ef5e6c19", "comment": "Malware payload (PhantomStealer)", "value": "d077cd2e06743dda7821d3131b717216cc016959a052aad26d598373553adbad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434860, "uuid": "f5bc25d2-03ec-40dc-8469-6867c2d634bb", "comment": "Malware payload (PhantomStealer)", "value": "f3efbe87a6be315a08a17b202b1fef218c3cc989", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434860, "uuid": "dbcf2894-298f-4574-b666-6d75ee64a99d", "comment": "Malware payload (PhantomStealer)", "value": "f658941c574c090a7584d162d2676584e9919802cecd380d70f9f2b2f1c7dde3844481d336ece6c347ead2001ff27c1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434860, "uuid": "c2fdf772-1305-4c03-baeb-0853b6037801", "value": "T1132602118AC42FB9CFAC5A1C50FD160EA3F04A8E9416B58AFB33BD46AFE7644111B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434860, "uuid": "fd9c5812-1440-4599-af13-39ff51e55726", "value": "49152:qpS5gZLlQGDJ2HBu79CwFiFEq/JXAcuauTjQ/mO6197AoAphNz:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434860, "uuid": "b8096b93-8738-48a9-ae05-62321a1d3724", "value": 4742349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434860, "uuid": "327bf641-7260-4c20-bfed-747d497c4201", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434860, "uuid": "73fa7ec2-5ac3-4587-b541-f2ff799a25d3", "value": "sample order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5f51f1-3a4c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776423718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423718, "uuid": "cf0f8866-ed59-4dbe-b352-6f1e52321052", "comment": "Malware payload (Mirai)", "value": "13e44dff38f7d8bd535e4ea62518cea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423718, "uuid": "34e1ba13-a717-401a-b2f9-dfb72debabd0", "comment": "Malware payload (Mirai)", "value": "d09a6b1891db1c484ab8ba128563c64f0f63496f2a42015d078e2e9a73678d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423718, "uuid": "86a6b446-abc3-4503-8e24-cf4ee3637fcf", "comment": "Malware payload (Mirai)", "value": "e9c2fd6ced284469b1f07483ca6c56e344671894", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776423718, "uuid": "2e49a6c2-2955-4225-ba4f-c6ec7f8fd1eb", "comment": "Malware payload (Mirai)", "value": "977509dd971c4f4f19fe967168d8376cfa4284c1afe9c1e7c11f44be1bf9033a42a0808d775a0c0088d6a802b15a7a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423718, "uuid": "c391f56a-4606-489a-a60a-35d5876e0afb", "value": "T180440806BF610EFBD8AFCD3746B9070529CC681622A57B3A7674D918F50B64F0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423718, "uuid": "d1a7fe88-5a0c-4ebf-9812-3f2d02b4210f", "value": "3072:x8efWy3fXfTTe7amFIoFH6yM9uKCr36GmWahIaC0tRfN2ERMEWEP3:0y3ffe7atoFaBf2aZRwQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776423718, "uuid": "597aa5b9-c0a7-4e8f-85e2-d134eb83d783", "value": 272220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776423718, "uuid": "a0e697df-5da2-4061-b945-a7e8410d7f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776423718, "uuid": "11afb3ad-c6da-4215-890c-0062f23e8371", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e118ff86-3a94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776454653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454653, "uuid": "1708a8bb-d0df-478e-8f00-cf0d25e8bfe6", "comment": "Malware payload", "value": "49b9eaaf28e144f17da5e065bded09ac", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454653, "uuid": "8b447d6a-2bc8-4f6d-bc91-3da046afb48a", "comment": "Malware payload", "value": "d0e130dcab2cca6f0204aa2d7273737a06b1c9b3b6957d32521f59a629efa914", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454653, "uuid": "2b9c3271-a16d-4203-8c63-1063537d66d7", "comment": "Malware payload", "value": "6631582c9c9704c4dfd9056096a69e6ec693c8ef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454653, "uuid": "d33d92b8-7f99-4436-80c1-008d131c5765", "comment": "Malware payload", "value": "051cd42d313baa20494dc8e620a1a27747ca38bf1454aac49cea8c6d9ef163ed3c0155cbc7863f6e03ff975d14de0aad", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454653, "uuid": "635754b9-d2b6-4d2e-8f88-7912ce3c84c4", "value": "T183C633AE6ECB44DADAC114B05723ABE333F7AC914AC68C357AC13525B0B0FB6306E555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454653, "uuid": "1def4162-f02b-4d78-a9f6-cd162a865588", "value": "196608:Pt8jzMVCyHTH5mcoBiFPU15uJIpawHEJbNzOPeWfCzFYRAB308L1+B30:PtwQRzZJoBiFPUiJIpuJbNzCaB518", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776454653, "uuid": "eb17d161-da81-4d5b-9554-f532c4410fe6", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776454653, "uuid": "fae4a95a-dd8f-4e66-9cd0-c565f8f94f9f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454653, "uuid": "d2a9993d-c8b2-443a-83e3-770c9e6d55b8", "value": "SecuriteInfo.com.Win32.Evo-gen.25479575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d400bd1a-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776434444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434444, "uuid": "39e835ff-93b3-4006-9100-87eb40e3d728", "comment": "Malware payload (PureHVNC)", "value": "386e7b97d339fb774c91837cc2afbd70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434444, "uuid": "237b0495-3d6f-4e3f-8aad-9231ed0343ea", "comment": "Malware payload (PureHVNC)", "value": "d1fde14de80b228aee88a7da4d2c9834d8e9e6cb198025a1e5791c615b79a708", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434444, "uuid": "a76f83c9-df4c-4753-a074-96592087d1ea", "comment": "Malware payload (PureHVNC)", "value": "437f2a54a0a5439a3f8ff576f592e36b0e2b8769", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434444, "uuid": "3e35aedf-2a40-4f96-87b1-d77361da596c", "comment": "Malware payload (PureHVNC)", "value": "564141ba86e51a15398b8263c91e7b29bdceac66467197fde06f57736c6b656b5ce967e76268bdeb6e537790a2ecd7a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434444, "uuid": "959cf95e-8c61-42a3-8426-824dc1358899", "value": "T179343B3DCAD5011AA0B2D754FDB10413E9677F63323D8C4C22C6168A4AB394D79AE7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434444, "uuid": "9d17027f-351d-4f00-ab44-69fbe2c49fac", "value": "6144:98UAIvMTinA7PeZRqFKt2Jw1glzn35FzAy71wnipdgc:S4Ab0qMkJvlb352yN+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434444, "uuid": "6069282c-0a71-4296-bb39-121a262bfd5c", "value": 251756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434444, "uuid": "8f96fc4d-3dac-4b06-9866-c6de626ace75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434444, "uuid": "900529c6-bf95-4b06-97d5-15def7c25b0f", "value": "Purchase Order - PO25-2869.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e966c88-3a1f-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776404048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404048, "uuid": "1245898d-8d2a-42b9-a2b2-aa657e7bb4e2", "comment": "Malware payload (PureHVNC)", "value": "f0413e6eb1a6eeb2ec06ef1e5df0fe5e", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404048, "uuid": "90fb3914-8698-460e-b95e-bfcc6a298f3e", "comment": "Malware payload (PureHVNC)", "value": "d406a70612ca122f952de2ee366a03c7138ee93a5eabdaa55e85b8c922d688f0", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404048, "uuid": "69708a19-9369-4c25-93d9-e65e9e0c2c47", "comment": "Malware payload (PureHVNC)", "value": "974b774f2aff309468370cdf26ad5f11666b4c27", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776404048, "uuid": "a7d3896d-599b-4fe5-84ff-66a0e22b05d9", "comment": "Malware payload (PureHVNC)", "value": "67986735d579e3b28a1cbc05d9fc3a2c01985c4a15ad8f4c0d7c479638d194ef390e96cd7e07330c69ef2d8019e746f0", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404048, "uuid": "c100d47b-e164-4d1c-8ae7-26167d029553", "value": "T198544038ADEA001AB1B3EF54AEE47587E96FB773370E585C1081038A4723945EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404048, "uuid": "b3086eeb-2969-4a1f-b41b-5ce03b53bec8", "value": "6144:PLR0U/VJreBV3o89hIwfWq9h5PqzEKa/2QWF/2bacdRtux6V:P10c/eLhIGND5PqzEKG2JFSaubugV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776404048, "uuid": "c2d14c49-f71f-442b-b573-98b41b29b2f3", "value": 299828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776404048, "uuid": "456c313d-e781-4209-b133-e3a4c171d67e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776404048, "uuid": "be9eca3c-e58c-4699-9ff8-d0ccc2f4df9e", "value": "d406a70612ca122f952de2ee366a03c7138ee93a5eabdaa55e85b8c922d688f0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a707b5-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776458395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458395, "uuid": "8fa17513-a544-4939-9d00-2adbcebd99b7", "comment": "Malware payload", "value": "7708a9c69ec846e42f4a05b1a469cfba", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458395, "uuid": "317e5003-ee5b-4905-9b90-b1bba3b02791", "comment": "Malware payload", "value": "d5132e01a34dcf20192df0db598ceb35216166140621bc1ba2dd5e441e27296f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458395, "uuid": "7867dc49-2611-475f-80dc-56964b474365", "comment": "Malware payload", "value": "0225d41b5b0cd39a1a5a0841205f4a074089b848", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458395, "uuid": "8d907ded-0842-4786-b329-5b972bdd572e", "comment": "Malware payload", "value": "ad3ef0b95505edc2212bcd3d50abdc133de0121671235864362082a6204cdb49818f608ac65aedaaa6b09ae71fc67be9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458395, "uuid": "04876a68-2d99-49f0-9c4f-f7a4d0bd3747", "value": "T12DF53EB54B4B3EAE14EB1B1151125802F94FBBBE187D122103ED397EBB91E4CCA25D72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458395, "uuid": "ca237a51-84aa-4fa9-8834-64ffde894f16", "value": "384:hh2MnBQkLV56VAznSY2djpKTcr1idsZEVns1nREtAT5h2ABbwhTguV0YCdnUBx7X:h/nnLS6b4DbRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458395, "uuid": "c7eb0bf7-5201-4c8c-a309-ae1e04f386d0", "value": 3591347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458395, "uuid": "04359988-607b-42fd-87bd-7adaee8b0a8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458395, "uuid": "de1e3d10-d15c-4423-b60b-04135a6b7ccb", "value": "GolfBooking_Request_April2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea80d7b-3a39-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776415403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415403, "uuid": "b2254f66-73f5-41ad-8de3-6e37a38c30d1", "comment": "Malware payload (RustyStealer)", "value": "74eb0e497bb134a190e99fcd3aed001e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415403, "uuid": "84e94963-2417-4897-aeb2-c17f8334c45c", "comment": "Malware payload (RustyStealer)", "value": "d643e568c5f34f2fd4f0b7d75ec1ff618fa3d4858da9a3ead7976b7cd56cc9fc", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415403, "uuid": "e21e1007-6ddb-46d4-8ae6-fb27bf6274c6", "comment": "Malware payload (RustyStealer)", "value": "cdd005875ae7c3460516a1e1ecf5a6d60eabcd9f", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776415403, "uuid": "f29edb66-3f93-46fc-af81-29b0a227b6df", "comment": "Malware payload (RustyStealer)", "value": "177d1d322e76f001908b5f6014ca5c52b9b9c3d7a54d81402888838d3c145fd1be579b12d10d7e90eb1a71b733cce70d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415403, "uuid": "308546cc-89c8-45b1-9e10-29d8251d3a4b", "value": "T1DB857C03F69881ECC46EC47887669636EA72B88D4630B2EF27D41B553F26F90AF1D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415403, "uuid": "d33f52ab-53b7-4da1-822b-5aef80ff8de8", "value": "1cc8077bb1aa2410679b2bfbfe5a8639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415403, "uuid": "9c5d74f0-99fc-42d5-bd6f-3c5da7c3fed6", "value": "24576:D83mvzRiYaVCbqzXx1yqnaeOnThfj1IeffqCbqrdwBGUZRQs:smvzRiYsCGX7yqnf8Rj+efVBGk6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776415403, "uuid": "1b78c0a9-67c0-4094-b513-7aa4fa747b13", "value": 1762816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776415403, "uuid": "46f94094-cfbd-44a2-be60-1951ef6378ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776415403, "uuid": "3ee4ffd5-ea5f-4c16-ae96-4ac4f6c11ba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e365236-3a9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776457735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776457735, "uuid": "fd1c5ff3-e7d8-4252-b3d3-8685c380f4d1", "comment": "Malware payload", "value": "cfb31d21246fca98e50a354d4290d5a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776457735, "uuid": "dd72c798-c3a3-48de-a019-05630968a1cd", "comment": "Malware payload", "value": "d7791aea7c7bf8ef51d723f151e90b6a413adb4445e69724fc2e320bd66dbd75", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776457735, "uuid": "a9eacf0f-16c2-451d-b9e3-dc87049d2974", "comment": "Malware payload", "value": "4c9b224349b4a8ade4ebe4d1fcd7011555cc0b28", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776457735, "uuid": "cc46d103-f9db-4a10-a7f7-79fc4e2565c4", "comment": "Malware payload", "value": "c6147e0861a8e096b5eeb46af341e85dd8516b6e4b1e191f2a0f20366b382310c486675bf2a0717dcc4592c8b8123309", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776457735, "uuid": "e9c7c06b-9a5e-4e82-ba02-8837ac79c638", "value": "T101953A00EEC744F2E9471B3259BB22AF2735A8050F36EAC7DA407A7DF9B62D51932345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776457735, "uuid": "8eb92458-1b70-4934-bfd8-9ecde8d032e7", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776457735, "uuid": "84292d4c-5603-4d3b-85fd-5e146e7f8e2a", "value": "24576:OETF4Vj4wItXticFueKdHwhvxbxLhHXvLWlv3EIzz+StYR1KVPmcrtKru51D:OETs6g5elvsv3EPStYR1Mdrt351D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776457735, "uuid": "9463fd02-0327-4287-98e5-62f2007bf8c6", "value": 1883352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776457735, "uuid": "b7171e01-cb3c-47a4-bc37-3a337432b94f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776457735, "uuid": "6641c419-4236-4e11-8e7a-d873d2b5acd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a3e8a4-3a88-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776449320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449320, "uuid": "723a0106-07ce-4b1a-95a4-5bdb1a7a853f", "comment": "Malware payload (Mirai)", "value": "51162c1542b89c82a864b22195b79faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449320, "uuid": "6aeeb4b4-96f6-401e-9e99-efd327cfccff", "comment": "Malware payload (Mirai)", "value": "d9402129575ba3ccd6b87747937ad5d7a5e8358e7d94af3451ccb376609211f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449320, "uuid": "229c6103-7239-4419-9137-6aede4a6bfbd", "comment": "Malware payload (Mirai)", "value": "e5dce69a042b70bd66002964b098ec5834e6c023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776449320, "uuid": "f729d502-0c91-4609-988f-72d480c74856", "comment": "Malware payload (Mirai)", "value": "a6e25e31b995525f8b43f0168b5cf52a634b50ec680926358ce760be41d223c767ebe9f2a27ef074bb8058047c0db701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449320, "uuid": "401d24d0-9510-43a4-91b5-e7fa8a9ea941", "value": "T1CC440806AB610EFBDCAFCE3746E9070525CC641722A86B3A7674C918F54F64B1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449320, "uuid": "6ac952eb-dda6-4e79-835f-89d39a21f2cd", "value": "3072:ICewM1dtZ6jZ6DGxerFU9WSf8FgNEgr2c2vyTGgI+/YqLrwd0G42hyOX6BA:2dt6xerhpFBcM+jL6F42hy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776449320, "uuid": "1a5c506d-e950-4b3c-95c3-6fee7c242b48", "value": 258532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776449320, "uuid": "0cf052e8-5963-4b8c-a750-b27fb1dfd0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776449320, "uuid": "baf82222-10be-4933-9bc9-fbf8ae719ae4", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da280c0-3a17-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776400745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400745, "uuid": "e207b418-fb96-4ab8-8a93-b2587142b9b1", "comment": "Malware payload (Gafgyt)", "value": "8bef774d668d67844c157958344d44c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400745, "uuid": "eb5bedfd-55e7-4079-93ec-88d4c2ff1bad", "comment": "Malware payload (Gafgyt)", "value": "db01986406ae2ca593b4247cdc144af1132e669d1853cd914f43e3eae8b1f8af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400745, "uuid": "867fea7a-7815-4c66-b7db-7ee908752f8f", "comment": "Malware payload (Gafgyt)", "value": "61f1ab5b2b537353105eb3fb5ce891701fcde844", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776400745, "uuid": "37e603aa-ee08-4bda-95f1-8f90bf5725d2", "comment": "Malware payload (Gafgyt)", "value": "d9887945846a58b2b46c4032a3b0df63c6d35acde90d120497a50e84259acc4df8f848ef511c113fe0460d78608bd92e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400745, "uuid": "dc150451-bf7c-4ab7-b9d3-80c150cef5eb", "value": "T1B3C30A05F945476BC2E337BAE68A038C37355F6897DB33116A38BDB42BF1B981D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400745, "uuid": "07a3a9a8-d3ea-4759-8e1e-457f0f10ad63", "value": "3072:3TMpd5a3NFlmdLGah348N+P+myVUQuiXfQd6W:3Tv3nALGah3rmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776400745, "uuid": "e18eb738-e614-45e5-b946-afb1233c9917", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776400745, "uuid": "84c96842-0ba1-4507-9b19-f2fd155b2cc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776400745, "uuid": "e506c569-c795-4cba-ba6f-96134cfcda59", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beaa714-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776435129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435129, "uuid": "595cbcf2-b498-4f9a-a1b8-dac5d53534d0", "comment": "Malware payload (PureHVNC)", "value": "265e74aa1b81d0474bd062a9eb694554", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435129, "uuid": "474c24ec-672d-40dc-88fe-e941ab1774a6", "comment": "Malware payload (PureHVNC)", "value": "db095614140b50170b85a8d1ba61ae4b35bd69299eeed4a4ddddf5333d18a489", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435129, "uuid": "8f3e1ec1-7cc6-4535-a3da-c64a01fd5bc9", "comment": "Malware payload (PureHVNC)", "value": "cd58d7978f7999922f5f4ebfe1e3d0c6e763d8f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435129, "uuid": "489ca7b3-0358-47ff-ba70-90f45050b725", "comment": "Malware payload (PureHVNC)", "value": "fe610a5429f4c7c227cee8294a09a90cb6c988b34d5a2f877ddf42df16691ec234a25df0f4b15c8bb959513695cbef69", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435129, "uuid": "b8781c92-0d82-4d33-bd98-975648945712", "value": "T199641F38AEFA0019B1B3EF54AEE43497E96FBB63370E585D1081038A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435129, "uuid": "c7d96ac7-5bac-4b47-99a2-5cee1aac005f", "value": "6144:hpkuauxb9g257sx/0r0dwxrJOUd56lRjxv2gjixHPgq73iVsfqT1q:hpku1bWJx/0AMrcUd5qVxt8PV7zqT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435129, "uuid": "c6f59602-5733-4702-b5d6-b5a208fb5635", "value": 315896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435129, "uuid": "6c9d43c4-9294-4437-9964-718253a4ae87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435129, "uuid": "45fb3c0a-42cc-4e9a-a293-64701fd0e570", "value": "Decompress.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d913fd2d-3a1e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776403959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403959, "uuid": "7d5c0dae-644b-434f-b3ed-a3ff6a6a4e07", "comment": "Malware payload (PureHVNC)", "value": "62dbfa25cb76943051c592ab1b42b1ce", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403959, "uuid": "8daf54a8-6c0e-47d1-821c-4a4cd45f335a", "comment": "Malware payload (PureHVNC)", "value": "dbd3e24c322d27e013c3c5f1fdcdd50ab73100c6e6a9dde581e13d086af230ae", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403959, "uuid": "1f82bfac-25a1-4b14-a7a2-74de597d23d9", "comment": "Malware payload (PureHVNC)", "value": "f8bd04ee64aca6cf6f22500752426ea243523e17", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776403959, "uuid": "fc9c320c-950d-4321-a3ae-bb2135b201e9", "comment": "Malware payload (PureHVNC)", "value": "2c6b9db0578c776dc7b121721d7c29c4d641a6e5ce73763803b3a3ce994c75f49621731ec8e3638eced16dad6e93585c", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403959, "uuid": "3f60d783-f23c-4d83-b476-4b68d9257c53", "value": "T11CD3022F97C09111D6BE0BF4F67B150442B5712E0578575B2FF2A2E34E22FAC4A8ED22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403959, "uuid": "e666976c-2056-4f6f-96a6-8cc0a6f79274", "value": "3072:DaMvq8IOwaZhIeDlbwQ5dpgL0WVf01vIanD8RvOB/2jy:DdqBOwiIq5pgL0WVfevPARvOV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776403959, "uuid": "1b5ee890-df77-46d4-8414-adbc68271f02", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776403959, "uuid": "f762eae4-600b-4a1d-bf56-2b5d08bf02e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776403959, "uuid": "65f637f3-98d1-4883-8f07-d33ed09e8d4d", "value": "dbd3e24c322d27e013c3c5f1fdcdd50ab73100c6e6a9dde581e13d086af230ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6614b554-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776435119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435119, "uuid": "18af8f1e-dbc6-4b54-a64c-1fefd716f45e", "comment": "Malware payload (AgentTesla)", "value": "edb2ae5703f06f978ba7ef1c300ff911", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435119, "uuid": "80b30157-6f35-425e-aae3-491b32006d83", "comment": "Malware payload (AgentTesla)", "value": "dc8cf522fa3842592edb8404348ca0df07dd8f3dcbdf35722e497f8d9fcfc556", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435119, "uuid": "3b6abacb-84ab-4c5b-875e-84ebd1f2369e", "comment": "Malware payload (AgentTesla)", "value": "212027e86fc03a5cebe5c0780ac06e4240089d07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435119, "uuid": "296bb759-61f5-4448-8890-ccf3ccff243a", "comment": "Malware payload (AgentTesla)", "value": "fcc69be486b704975ed51b6dd098ead8fc212473641a27972b609a39660b1ac9b6dce66c17a6d739c6a41a37337a2d77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435119, "uuid": "c6777cc3-aab8-4865-a125-d368ca0b188f", "value": "T17C55020189C43F78CFAC561940BF160FA3F1498E545A6A8EF773BD4ABFEBA04521B158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435119, "uuid": "5b95cdc4-8192-4182-b44a-98ba0eda2aa2", "value": "24576:ST2DW0B9M7XJAbXuKp/EBrFt53n6BzqgKCNwpck:STXTC725gmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435119, "uuid": "ae4378d6-e42f-4874-9b34-6ccbd3796585", "value": 1395387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435119, "uuid": "d93a1732-a8aa-452e-91e3-6dc71dc61670", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435119, "uuid": "a37d1637-4900-4b61-abae-042a9192fd4f", "value": "Solicitud de cotizaci\u00f3n - RFQ adjunta.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a667cd20-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440381, "uuid": "58a97e99-42bc-48eb-a575-e3a6107a090c", "comment": "Malware payload (Mirai)", "value": "baf56d138828bcfd6fd8b52420c9169c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440381, "uuid": "a52b16ba-3b92-419b-bcfc-f1601968a825", "comment": "Malware payload (Mirai)", "value": "dcfb97240032fb05f7b35ba963d8ed2be49a766976383dc1d9e71d1ea1ed1b07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440381, "uuid": "dd17802c-1351-40dd-9dd7-23e62d9dc466", "comment": "Malware payload (Mirai)", "value": "a237f572c21c6a92840bc7a9513f1cd75cfe5bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440381, "uuid": "8f9af6f4-9e11-48d9-bd9b-596105696be1", "comment": "Malware payload (Mirai)", "value": "3775f4b129d50aba8f7a8e7c52f42c9b9cd64fc0ec657babd856c765a151d224eccee60f179ffccdd9da9f8b44efd692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440381, "uuid": "7657f0e8-14e2-412f-ace8-452bdb2d4b77", "value": "T14243F164D1660C19F2F5E77A29B90AD27AC097FD71ABC83B310867A647308BF10D56CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440381, "uuid": "0f70b574-641d-43f7-ad2c-656e176bfae4", "value": "1536:ULJgl5oH4BiC8sOti7Fi2ndiL2o2EK/x3x0xrSu4u+qgw06WXl:ULGMH4UC8s1tNBJUf4u+qgwXW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440381, "uuid": "473a0468-f8bb-4f93-89d1-3ba11a5ebc13", "value": 56064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440381, "uuid": "8b4e4fff-c6b0-49cc-bcce-56d05697a5ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440381, "uuid": "9ab67d85-a203-4a77-a30f-d19b41e9771b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f390d162-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392407, "uuid": "5c0d1da1-b77b-4f00-acfb-8ab85391eba3", "comment": "Malware payload (Mirai)", "value": "907b4174f3a6f1044e575c41459376ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392407, "uuid": "66e5d567-1b27-4501-8193-e2b73bfa66d8", "comment": "Malware payload (Mirai)", "value": "dec2cc98a4c5c8b61a8ee7f3018ebef94c05adc36e54db5421e9bdcc4d82747e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392407, "uuid": "c9603ea1-d7cd-4cb1-9bd8-066d58644c26", "comment": "Malware payload (Mirai)", "value": "3a00f9576913df7f56a417fc603293e1cb2c518b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392407, "uuid": "42753923-efa6-4fce-b151-2a93cb8222de", "comment": "Malware payload (Mirai)", "value": "db8ad52755136d700264874dd55c51455cb077729126f27549785a2bcb01976c0765f4214dc46981f25a0859927f0a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392407, "uuid": "61152e38-d4aa-43aa-87cd-e31ffc0da773", "value": "T14E633A81BD815A13C6D112BBFB6E41CE772613A8E3EE72079D266F21378781B0E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392407, "uuid": "c9fbfb47-159c-4a02-871d-0288672568c2", "value": "1536:T1dPhyFU0LMdnl+MQ12hM82O5HedO9N0lyZvfy:T1d8gG12uPk7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392407, "uuid": "41d5ace8-e06e-44bd-b3cb-04dc4d4838aa", "value": 73372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392407, "uuid": "02993b3a-d1df-4900-ab9a-9644cab7fe3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392407, "uuid": "c83ae798-0202-42d1-9afc-3eaf0a4be9ec", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e757319-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776440341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440341, "uuid": "30ee8bc4-204c-42ac-888d-540060608db4", "comment": "Malware payload", "value": "e1390a13b62ee218b3b66bbc709c0555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440341, "uuid": "f963fc8f-dd01-40d6-be6e-6d9f81d3558c", "comment": "Malware payload", "value": "e007a72eefbb37d4f8f200edbe3ae06ad9a2569a1de70c09196a16d91081480a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440341, "uuid": "33eec3de-c8ca-43ae-b407-3c8820e21965", "comment": "Malware payload", "value": "aec8eedbdcab473c7d4a27d422c184480f988396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440341, "uuid": "e79ed04f-e13f-4e22-be89-068cc76e4a56", "comment": "Malware payload", "value": "174bb5b6ffe5b90645d8211729af206ce7c063debe1f37d0bbc73680a758a7991a45c6e4ffd9aa5e4a5cfe5ea359f623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440341, "uuid": "6bb49d8b-6b94-436d-8246-bae054692fe0", "value": "T1E74301ABC26294A6CEDB8D3C40FE35311DC030D1735D9F8E13499AD9FE6B94BA51A038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440341, "uuid": "693d27a9-35ed-40c1-a229-a6daac77bad9", "value": "1536:ZzbmdcIvs+XYN+Z+eRGbG8F4AlWoVTxhvcb8mu:tuc8s+XYeRG54AooVTxNcVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440341, "uuid": "91e802b8-c65b-4ef5-a810-a0394eec1587", "value": 59420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440341, "uuid": "4925654d-86bd-488a-a22b-60d5fd49a51d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440341, "uuid": "4b8498f8-c5b2-47ec-a236-1168814cf2aa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc58c89-3a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432095, "uuid": "e6e5c8dc-8713-4f39-9ee8-cbd4632fbc75", "comment": "Malware payload", "value": "189692ff3d9468b79daad440219b1d85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432095, "uuid": "5d79511d-48cc-40ef-822a-694fc3fce070", "comment": "Malware payload", "value": "e14c5d3ce51b5fc77592b391152acf16b03d302efb774145d6165a6fb8db67d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432095, "uuid": "b3ce2568-0c0f-4348-bab0-5cb425b13ae8", "comment": "Malware payload", "value": "02fca21df7bdce43666d4f020cf7d2286409db38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432095, "uuid": "0c1ba86b-3521-46e4-9c86-c85bac2b71e6", "comment": "Malware payload", "value": "bbf90f04265d042350a1d8f54a242d8201081028b6848d7680e1974370edf88551cd72ee17d3b24047ab49a31bb577b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432095, "uuid": "aa30a307-6d44-47ce-bd9e-76787aad28f4", "value": "T14565F61B9DBD88EC80EAE9B88532B217BD657000473577E72FE206611F46BF0A4B9F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432095, "uuid": "af079c99-49eb-47ce-abdc-0088888c34d9", "value": "24576:cn4B0TxJprw8VUWglk0AvTDsXIhNMjvH9dgTadvU40060l0dUyormQeh:cnUwJVw8V8VfXhjvdyTJ4FK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432095, "uuid": "fbe325a6-be35-4abf-a8c7-d4ebd7c9dfa5", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432095, "uuid": "629ab269-01c6-4dbe-96f9-9f350b7b144b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432095, "uuid": "45e9ecb4-c32c-4ff4-bb61-63dac30f2843", "value": "e14c5d3ce51b5fc77592b391152acf16b03d302efb774145d6165a6fb8db67d8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666ee89-3a0d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776396492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396492, "uuid": "51c7ca19-2be1-443d-ad79-0de1e3c1fdb4", "comment": "Malware payload (NetSupport)", "value": "3f005808531ff78cf64bcbdd1df2d7e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396492, "uuid": "b2e76216-a9b0-4704-9b33-d35e00c47860", "comment": "Malware payload (NetSupport)", "value": "e180dffd1505ad006b101857c827365bafe0912d4c7788cc51305687df447bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396492, "uuid": "2af87281-5853-41ae-afc3-8835eff483e9", "comment": "Malware payload (NetSupport)", "value": "b80365ee18a3569f476ad6dd63809bebdb06b82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776396492, "uuid": "d8e24eda-6f7a-46f7-92a6-07cc2b0b108b", "comment": "Malware payload (NetSupport)", "value": "e30285c23bb6a23593f3288dfb9646a19111dcaa1b42cdbd6a2e03e939f69bbec100721aa5a25b60b9eefed15afdcc26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396492, "uuid": "5e5aaa48-ad44-41ba-bbed-8253f597b33d", "value": "T144064B0BECBD4CB9C099A5348433A157BE7178405B2163D72AE1B7682F73BF0A879B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396492, "uuid": "3bea6b03-f6af-4147-af4e-40d22e5b77fc", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396492, "uuid": "2a4eb90b-e4db-4cd1-8c48-da913be6a641", "value": "49152:WA7CQ+PQ+UoKtp9F+IVLsqJvLtzN0zZ640vjb9c2t8+H97:WVIpHTtUIB8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776396492, "uuid": "70b97261-736b-4965-b932-f892824ce22f", "value": 3952624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776396492, "uuid": "1707ba8b-8c41-4609-9b97-ba3831a06268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776396492, "uuid": "3c68f056-3e2b-4f5f-85b0-9a6ab89d60ef", "value": "SecuriteInfo.com.Win64.MalwareX-gen.56715554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdd839c-3a61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776432498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432498, "uuid": "e6932996-acbe-460a-950d-1a0b67ecd946", "comment": "Malware payload", "value": "f9b9e97b5cd77571554837db003d9eaf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432498, "uuid": "99884c75-a175-4bc1-86ae-dfc2ba141d23", "comment": "Malware payload", "value": "e1bd4e617c733841d4de90011985c2356dd4ccedbdc646b4edca25b4fd2f2593", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432498, "uuid": "1f176228-e3c8-4fe3-bd6c-d95ffef179dc", "comment": "Malware payload", "value": "db9bb65a44ab4b4f293a69ac7fd20d4fea3183a7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776432498, "uuid": "78019613-ca4b-4bee-bb31-40b88b169f95", "comment": "Malware payload", "value": "dccb3112f17ad92a4e819471fe31a270838cd2f6e55d61038305a07443753c27a12ad53fb07ae18ff9d4e511f31a39dc", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432498, "uuid": "09c9f703-5b8b-4d52-b733-cb411976e575", "value": "T1E221FC2479729E0A7933440AADDD68ADF107007601F72238F82CC32B9F2B04B813AB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432498, "uuid": "c19472d5-f1fc-46ca-b85f-61c1d7b8b0bd", "value": "24:DQCtosVRE+EwfVEcWice79Ea0ObKGIhSy4MexDNsmIyN:DQCtosVREQfVEGl79EP2bOebDIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776432498, "uuid": "07e1bf38-131f-4fdb-85ca-0ac1817e9c10", "value": 1320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776432498, "uuid": "97a4751c-9eb4-44a9-88b6-9ceb1f370247", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776432498, "uuid": "20cf54dd-ae06-4b5a-a8a3-28312dddfd25", "value": "fm_20260413_124307_litewebcam.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f0089f-3ab8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776469899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469899, "uuid": "028ff561-2a24-4aec-a6a2-f3ee5998081e", "comment": "Malware payload", "value": "95172d15d33e8f5c9f1f754e75a9b704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469899, "uuid": "03b93070-d87e-46ad-9d89-746411b298c6", "comment": "Malware payload", "value": "e273d507de113dee244440e6e5bf5a2e0cb285727d789221d7332a0394e00c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469899, "uuid": "442dfbcb-ef59-475d-aee7-53976c7cae0f", "comment": "Malware payload", "value": "97bf0af6042d8d51bb463aa2e83f30a8a06f62b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776469899, "uuid": "69fbe100-ac9c-42d4-8942-1b8e8c4808d5", "comment": "Malware payload", "value": "4debcad0982ba9d59d7c4cb5a4e802e93b20512c33e206399915c0dec7e71c04986d723f8bc671c206703fd36ccba83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469899, "uuid": "a7365aa4-d212-4cb8-aa48-e83df5065929", "value": "T1D5D49E2776528F21D3882737D5CB4A0093A49941B5A7F72F758403E229073EADF4A7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469899, "uuid": "ad3baccd-ff9f-48f9-aa8f-7ab5f1524136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469899, "uuid": "247e02b3-69cc-4730-9935-a23375f7ea69", "value": "12288:d+uAGLFq8Meqkl2dpqZTWr2fe8waeF2/:d+CZMetoaqetf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776469899, "uuid": "9ccbc7e1-17f3-40da-b71b-eaccbd415d0d", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776469899, "uuid": "3170e6eb-186c-43c9-a3b1-2e98cb42f65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776469899, "uuid": "08623d49-c7f1-4966-a514-2025d007bb35", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.42325199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f711eee6-3a03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776392412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392412, "uuid": "42853169-f60e-40b4-8a2f-9215bf343bcd", "comment": "Malware payload (Mirai)", "value": "2bfc80b696680a8e4b80c8c2aa75fc86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392412, "uuid": "2adc7137-da75-41e6-97f0-149809f0eb87", "comment": "Malware payload (Mirai)", "value": "e39d80a36646fe1f18a75528be52c7917185859f0c743c3cb3fb7009834770f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392412, "uuid": "dea394f4-600f-4810-bdc4-df4f9b6eb7f4", "comment": "Malware payload (Mirai)", "value": "3e332f006d01ac10ddc7bdd80b419b9e79c9bf78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776392412, "uuid": "96e4f32c-1204-4ccb-a271-60dead48517a", "comment": "Malware payload (Mirai)", "value": "eb36f52a3d892578b5da912e2dc537c396d7b6ba69ae90fb5b75eaf2216eea4840ede4af5c4f9f76e8f91f3f243a835e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392412, "uuid": "bba4d085-c9ee-4c03-a627-6465739f5227", "value": "T19B730995B8818B22C9D512BEFA1E118D3323177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392412, "uuid": "8500104d-ee41-4966-a31c-d8f73a2da5dd", "value": "1536:bAnYSDACyTQ8bM80RoaPEIhDQQMQiZ33oTXlC87sL5oYMH:uMCHYx0RoaPY3oTXlC8gLyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776392412, "uuid": "f6118bac-c9eb-4ba9-a1d0-9bde0445a2c6", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776392412, "uuid": "c0c6765a-648c-4d06-85ca-83e1ac9ecdad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776392412, "uuid": "356ffb13-3cb5-4dab-a579-fa2505843bb0", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bab93b-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776434469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434469, "uuid": "897583a2-b553-48ed-8469-06da340e7d12", "comment": "Malware payload (PureHVNC)", "value": "6c21e62992893fbb0cb2f048c3c16e66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434469, "uuid": "b60bc4db-a5a3-4834-88bd-547b36857103", "comment": "Malware payload (PureHVNC)", "value": "e46670e5539dcbb79892bdd666ec63a3992d4c8aa6a33236c7d205b059d6bd93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434469, "uuid": "1cc4454b-05d9-4c16-979d-21e43d339bfc", "comment": "Malware payload (PureHVNC)", "value": "253b410dd771bc6ea2f090fcfbfb19956eca410b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434469, "uuid": "d51d668f-06f4-4bfa-a413-5aed78d26e57", "comment": "Malware payload (PureHVNC)", "value": "ea2d31d284c89ff6c7988eeda5a8519c038f32e7144358c03dbb736db5efea572b4ad99df8440a665d0424e33ef66aee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434469, "uuid": "98fc9e8f-00f1-4c43-9e20-6d174a04e1e1", "value": "T19E641238EAEA001AB173EF54AEE43497E96FBB63370E985D10C1034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434469, "uuid": "024a9805-f159-4331-b9c1-6ddab3f6bf0a", "value": "6144:g/x7VzGFSYPyU0Oi5wklW8mDtsZT3WdysBE28lNHgMwdpPC4:C7VzGFSYPyH5wklWrDtuT3iysb8lNHgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434469, "uuid": "260c79ce-002f-4e99-8893-21470f4184c1", "value": 311666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434469, "uuid": "863b7aee-e48a-4729-8a6b-c378d6f5430c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434469, "uuid": "7d05c7b1-57e0-403f-b402-2e537b4d383c", "value": "DOCSIGN28372.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24451ee-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776446816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446816, "uuid": "15632ee7-6cf8-4774-a506-5d079c07d676", "comment": "Malware payload (RemcosRAT)", "value": "a8a8dd042f60d8c27e7bd5b5d3a750ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446816, "uuid": "eca5b5ef-409e-4722-a483-d092a6e8187b", "comment": "Malware payload (RemcosRAT)", "value": "e49412097e84021f9079b43e61f6d46b8a1737d8bda33d43398d1f366a4d7839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446816, "uuid": "3e0fb8ea-d731-4b77-83ba-64ddc894d324", "comment": "Malware payload (RemcosRAT)", "value": "ddcc45ea5d9298f140a3fe2cf60e050feb68b684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446816, "uuid": "2db7c964-f5fe-4bbb-ad1b-3cc84925f4ee", "comment": "Malware payload (RemcosRAT)", "value": "4739941e664c7da2912be300697e8a31c16495404fdbcdbb01e70994806d2c288d5eee5e6860ba87ae90aa8a8e83c7bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446816, "uuid": "ab28b2d4-b6f7-46ba-b159-6a8e4ffea4a1", "value": "T182B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446816, "uuid": "7dcab94c-f35e-4a59-8aae-87571da80100", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446816, "uuid": "4df87a74-4aff-412f-bd3e-3483489a5ed0", "value": "6144:TXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBceJ:DENlHV9FGeDWv3jADnyYiCNrsPZ0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446816, "uuid": "3c71ec81-aef0-4966-b739-ea934c88a777", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446816, "uuid": "79a271eb-1980-40b6-8353-e39df3e952fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446816, "uuid": "9b9f58e9-2349-434e-8006-1a441306ed20", "value": "e49412097e84021f9079b43e61f6d46b8a1737d8bda33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce4675b-3a3d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776417011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776417011, "uuid": "7d108fed-3d1d-43f1-8168-e8de05058647", "comment": "Malware payload (CoinMiner)", "value": "f218e2841793ae166566ccf4a1716394", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776417011, "uuid": "1ab6f9b0-fbff-499c-8da3-838f019d1d62", "comment": "Malware payload (CoinMiner)", "value": "e51dd9532c2377685acb3a01c5e194e3fec41419d7a646db56c495d87d805753", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776417011, "uuid": "8659b00a-ac87-44d1-938c-6d65465fd800", "comment": "Malware payload (CoinMiner)", "value": "0d6c2849ab4ca66f1dbbeae7237410ebfb34a55c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776417011, "uuid": "3e890ffa-e8fd-4a49-a2f1-781fc5f50bb3", "comment": "Malware payload (CoinMiner)", "value": "af5356198fea0383c2c3c027a3111a75c5402c5e25adb8d73430058f4af8ddaffe6b3aabbd3ad07164728e7ea1295481", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776417011, "uuid": "6b82c74e-6edc-48c0-a9d6-43e2029588a7", "value": "T1EB4301895903317BA78B05B137A935EE254736F5351CD39228C9E53C7A8046086CFAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776417011, "uuid": "bdd5f889-4cb8-49ab-9683-9d2cab5c1298", "value": "1536:u9zfzfMTbooyFMGDMV+1DCP/kUqmmEm7TroGj:u9zLfCfyFM1V4CP/kUqmmDNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776417011, "uuid": "34c1b690-afbb-44f0-adf9-b80eb423495c", "value": 55951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776417011, "uuid": "6c2e4d38-73fd-4ad3-bb99-fee355450f49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776417011, "uuid": "903a5343-8730-462a-b680-55a5f0e38ff3", "value": "PdfReader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09f0048-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455833, "uuid": "c3880f2a-6d71-4800-8d09-3c22a5cd8247", "comment": "Malware payload", "value": "a6367f71de9723c739596d9bae440617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455833, "uuid": "798b5cfd-9c12-4ff7-bd7d-937f6730a540", "comment": "Malware payload", "value": "e567c769acb9fd5e05fc449226c361842661ee40e7f9f3d9e81d1deaf9a8c1a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455833, "uuid": "9278f660-e29d-4049-80ac-da369399b5f1", "comment": "Malware payload", "value": "b7e95451e08e49caab474c0846b0dc4b73597eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455833, "uuid": "8031c2f1-6e37-4013-945a-e983843c0d59", "comment": "Malware payload", "value": "9a3358f25fcc934a3bc73226d166844375c937f7ea7f77f92b0294b43910ac1ce35b3dad035bb976ca08f4167a62f62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455833, "uuid": "1820df12-2b80-43c4-9645-495f000804aa", "value": "T1E7433D0AB892CA56D6C96279BB1FD28D331513E8D1EF33039C159BB47BC781A0E7A5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455833, "uuid": "f0b8a12f-1c4d-40ae-bd48-470707136529", "value": "1536:sKvpsAePJnveY3GVcfxzEjEmT1GusDsed/Ap:sKvpsAeP73GVUojEmTouDe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455833, "uuid": "45e1fddb-366b-4989-920a-14bb7d3ebf77", "value": 56184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455833, "uuid": "eac37796-a5fe-4562-8ca7-29e43d1bd9de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455833, "uuid": "57e7635a-9dc8-4726-abb6-18caecab8483", "value": "triangle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac32e16-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452360, "uuid": "c1513632-32a8-4bf6-9823-14d5e9e65ee1", "comment": "Malware payload (Mirai)", "value": "e90a26b9a49f62d8bc03feaa5204e875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452360, "uuid": "01bb225d-7d8c-4bdf-945c-ffef16ed11e5", "comment": "Malware payload (Mirai)", "value": "e6724f9377a372cf4900f037807bfe31ca0e142942a71a0d268855ba192b664d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452360, "uuid": "5d17a91d-56f2-412a-bbb4-9e10e6913151", "comment": "Malware payload (Mirai)", "value": "caa373743ade1e2a13f052a36ace0462624bb881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452360, "uuid": "d07bb66e-e71d-45ab-9df5-c89b70d6158b", "comment": "Malware payload (Mirai)", "value": "e6c85759c7096e9367ff38e601a63501d459b2c5834167631784b812d3822a873e84ef3419cd34178f53aad8b11d7c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452360, "uuid": "510ea69d-fb26-4c3a-8dff-a205f597e7ae", "value": "T13FF3392F358192F0F6411B706BCBD3976C690BBF5199909F6B416329B6E0B7BA03C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452360, "uuid": "80240d13-75bf-4ef0-a739-f0e4647bab27", "value": "3072:lbhovG/AeYe8294Pqmpdb0hBKuy6MZO9NHSLr1HN/EIOZh55Q9UX/:dO83uuhW8bHa5t/CZh5KOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452360, "uuid": "8d57572f-9126-4e5a-9371-0ba85522e4aa", "value": 164384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452360, "uuid": "2ce1b597-f8cc-4b33-9f19-e345991dd31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452360, "uuid": "bd9d30e2-e687-4f9b-9d05-887078c834a9", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f12c8e-3a4f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776424754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424754, "uuid": "2f52dec8-e186-4782-b73c-5568d4e922d5", "comment": "Malware payload (Mirai)", "value": "8e058ed375acb50fb82ae372eb0622d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424754, "uuid": "a0b514e4-f3f9-43c9-a5d8-74af37186ce6", "comment": "Malware payload (Mirai)", "value": "e78c1b31cb63d4a4e46a71105c4314555ff8673fc4a0f14a81a5c05b325a07c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424754, "uuid": "6b5d75b5-795f-41b1-869f-7ffe70cf6f88", "comment": "Malware payload (Mirai)", "value": "6d11d2141b25e39cc7786eca053437ada902d669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776424754, "uuid": "dc4ec7ab-251f-4721-8163-9286fb541115", "comment": "Malware payload (Mirai)", "value": "a5a099494f2dfd7c22abcb606073fac9df3cc14cfda55b7679ffa845db70b17cbcd19f1e00c70d65cc6d38a1bdf1dee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424754, "uuid": "db2a3b13-34c8-4fe7-a96b-374250634132", "value": "T1F8049D72C4397ED4C2A08070B5B1EA791B63B46181570FFF6AEAC2794087E48F50A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424754, "uuid": "9b6bd290-1a8c-4940-bbc2-ddf2f8b789c4", "value": "3072:MMycoxRPsLPeSbKeQFNxnyN+XeVQrxDzRXJlWtaGCJ4B:icoqekeE+XeVQdjQtWJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776424754, "uuid": "79e2ec7c-8821-40ef-a283-a50294e68a9c", "value": 185764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776424754, "uuid": "9221f187-1a9a-42b4-9711-b5f88d99183b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776424754, "uuid": "ffe48382-4d4e-47e2-8d39-1d1ad993a986", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955cad84-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435628, "uuid": "b0a13d5c-29f7-4a5f-ac6b-0cfe8e538194", "comment": "Malware payload (XWorm)", "value": "2352683111d1db4b06125ebac2d3a5a5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435628, "uuid": "4b1f169b-62ad-4522-90f7-a18ee8bba8f6", "comment": "Malware payload (XWorm)", "value": "e83ff7dde76d256ded8c567dd545578d5da14790bfaee974cd981f6ab3a7a88f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435628, "uuid": "7253d13c-4ab9-47ce-8ed4-9cfad9a01d80", "comment": "Malware payload (XWorm)", "value": "861caae6d727eb8cc513bc1daf92ecc6ef2aa311", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435628, "uuid": "8534bc44-2dc7-4ced-880c-f1e861c929ba", "comment": "Malware payload (XWorm)", "value": "4161f325524905eca318f766b817463c45348f35371ebbf05bed50f46793aa6a303d7aebd9714899454b92bc82262f6f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435628, "uuid": "bb6bb7c6-4a91-4f1e-a525-db7690332fec", "value": "T1C8C574E6C67456683B1DA08349A43D2E3FDA8D87A2F4415A8D73FEF03813AA4D7E5701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435628, "uuid": "050ba478-8135-4dea-bf03-52adc23b7bb5", "value": "3072:ZCVMS8tOAR5VU3iPRJQZBNow9pQbRk2YYYlUvCI0XusZrnKAvpYYYrKqihPcVYaQ:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435628, "uuid": "95c06e4a-06f8-4a2a-8ca1-90abddcac085", "value": 2602217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435628, "uuid": "c38bae94-d70e-42de-b016-e9028ae7890f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435628, "uuid": "d9e4c1e1-0963-460f-b9c5-04af4200a969", "value": "PO 26000278_Xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6c5aef-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776434381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434381, "uuid": "e2e2c620-e908-4454-bebd-4444c48f910c", "comment": "Malware payload (AgentTesla)", "value": "24814c248a5c921c17f3804d106870e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434381, "uuid": "71078332-4e13-4cad-8daa-c96e0da56fa7", "comment": "Malware payload (AgentTesla)", "value": "e9344245c5768fd87b34cc93e9ba978c6fc5d02a8a8444048f877dcf9df44e51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434381, "uuid": "46e7bc94-cda7-4ff7-9874-b19c8006a5c1", "comment": "Malware payload (AgentTesla)", "value": "2571ec36975557a72377ea8c4135d4869bb7c8ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434381, "uuid": "5c7eec53-2046-4b81-ad39-382b9661bc98", "comment": "Malware payload (AgentTesla)", "value": "053a0c7f6d82ed8e32a3b5c001e7fc67344cc5108ea0a314eef17ee6d7a01aab3db5c888011de11db4edca6c3d5724b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434381, "uuid": "6fe56462-488b-4eeb-b59f-d5e1cbc9be7c", "value": "T139341A3DDAD4001AB1B7D214FDA50423E5677B23373D4C9C22C9128A4AB354E79ADBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434381, "uuid": "3850c71a-b049-48db-a245-8ee01e94ca1b", "value": "6144:M8Nr2X21IVEB1TK0wTBkLqn5X01wH/k+cS8cSfNjXLuft:XNCXxVgwTBkLq5k1wH/Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434381, "uuid": "dc3ca930-1bce-474d-81b7-e072d42184ef", "value": 248214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434381, "uuid": "b0b60c23-1177-4e07-88b8-18189aa2cccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434381, "uuid": "a0eed13f-9476-4221-8cc3-84bada22152a", "value": "Order Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82a8d16-3a50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776425459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425459, "uuid": "73c6b343-0dec-40ec-a806-0fcd65965c57", "comment": "Malware payload", "value": "b5ecdb127ba2dff1cf64d7abbd224818", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425459, "uuid": "1f53c243-ddab-40d6-94df-4e8a383cd562", "comment": "Malware payload", "value": "eabd970c01299dc18e66e65a921b4d9045afd362771baeb0fa89e43257c4e4dd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425459, "uuid": "f650f900-fedf-4d4c-9aa8-08ee80b9177f", "comment": "Malware payload", "value": "5ba94ef73291d69a0609016a15ec8fc751b2529b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425459, "uuid": "0aa0d207-8185-4677-a4b4-6539c82844de", "comment": "Malware payload", "value": "cbfdcbee8b61ac75d97f0c0b03a2f9239371ddf00ef7edce7239dbf5edfbceda87f381115740b3b97533d9df1be2dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425459, "uuid": "89ffa9c2-8776-459a-b94e-1f4e6b2636d3", "value": "T18C1533FAD6042C6DCA9A03319F4C6272F9A4CCA889D6535F51F8F537048FA2C399C56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425459, "uuid": "a6e90ed3-48e7-4bba-913b-f764090d489d", "value": "24576:jVQ0zHjsLviHqm094WMWH9WZNDWkbxl6SN:jV1jsmH309fMPvlRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776425459, "uuid": "8043d5d6-e8c8-43ab-ab6a-486cfdf9c749", "value": 900468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776425459, "uuid": "f84cf36d-39c5-4f0c-8888-61a5ab04616d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425459, "uuid": "95ac6d0d-1006-4924-a2e8-4421b4f02b4d", "value": "Prestige_Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead0923d-3a7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776445649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776445649, "uuid": "e03f057e-670e-4f07-97f1-e8f11dbd1915", "comment": "Malware payload", "value": "3008285ee45d94d6a2ec4f0d797498a1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776445649, "uuid": "66d48bf7-ceae-4e76-bc16-e6f564fe7e79", "comment": "Malware payload", "value": "ead5557f301fc1b5ca61fb35a241db98cda181316f2a5137f4eee1b3acdffe32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776445649, "uuid": "8c8870c4-872b-4bd5-ad05-b286936ba023", "comment": "Malware payload", "value": "b6aa14a8b1fb5d8090989dbd45aba8239b482a72", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776445649, "uuid": "872db655-a0a6-46f0-805e-c8f45366c51c", "comment": "Malware payload", "value": "fba6880c38b006a77994c9e9ab2c3e3b6866571061ad9735284656d8d486e7b619a1fee081b7509d43d63534922c3e71", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776445649, "uuid": "50202477-ed67-4584-ba1c-0511d95d6763", "value": "T1F4B533E6178305BCDD44C631D0FEA57EF2BF7E91ACF28A5336E4AE2148E28855236345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776445649, "uuid": "7a7bb8b0-ca88-4750-9f52-c0fd3ce49ce0", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776445649, "uuid": "287adb9a-9e03-4158-a465-2d53a723b3bf", "value": "49152:L1qsob0lhZmySSZbFrQdwzNDHSmBA4KkNe8HAX9cs9wez8WEvh:804y1Z0SnNe/9Erv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776445649, "uuid": "d100a688-15d5-4d56-9866-d37369e17777", "value": 2364928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776445649, "uuid": "9b83fee9-4644-4e93-a078-3d61c1ccdcb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776445649, "uuid": "421d6e1d-4849-426c-b313-1088d30861dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda35d0a-3aa4-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776461572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776461572, "uuid": "0dfd4dbb-aa8c-426a-9f9a-996562e99cc0", "comment": "Malware payload (AsyncRAT)", "value": "d95cb34bfe89fd4d25fd77ee2c8a47b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776461572, "uuid": "5aa19172-9753-47c0-8df1-25050c42e9c0", "comment": "Malware payload (AsyncRAT)", "value": "eb018acb6e5a762ad7dcff4227a3ed4c836a43d24c5876805f41e039e9f7a09b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776461572, "uuid": "d5daf42f-22ed-49d9-95b7-17f7e5511135", "comment": "Malware payload (AsyncRAT)", "value": "42bb936cb48de3e2b7033fe9c55940b99dea4fcd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776461572, "uuid": "e22ff91c-9821-43f9-bcc6-7b3e06b41181", "comment": "Malware payload (AsyncRAT)", "value": "d5ec0a9ecb53591d9e5ffc28b8ca1845535c3490c7af706a129f5a5b2d6a4bc830060dad04a610df16d99344e93ba5e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776461572, "uuid": "9fe481c0-9054-4af6-8b25-64c66279bfb6", "value": "T140232A003BE98266F1BE4F7899F2225646BAF2533603DA4E1CC411D75613FC6CA426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776461572, "uuid": "b5ab2d05-c064-44bb-86fa-787b17720475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776461572, "uuid": "55f51170-7637-4eb5-a4fe-3e291f90b34a", "value": "768:/aMCDLPSc9xvXwnGex80bu5XTW0zR1PdJIjbpg47Fecy/SxszyD81i/qmM5bFf+:/aMCDWYDiudKbm4hecvxgyei/rM5bFf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776461572, "uuid": "c45eeda4-0bcd-47da-86f0-e26a4c309eae", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776461572, "uuid": "226cfcda-b342-4bc3-9e9d-aa4bb3ba666a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776461572, "uuid": "734b9709-febc-4516-958c-a4602bb4f0d4", "value": "regsvr32123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd17e701-3a32-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776412502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412502, "uuid": "fd6a1d61-3f3d-4d71-8afd-b47a7491616d", "comment": "Malware payload (AgentTesla)", "value": "78c19c0cc7bb93949c1c5c53c19d50f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412502, "uuid": "9e78c695-a2e3-495d-8ade-1841271cff4c", "comment": "Malware payload (AgentTesla)", "value": "ed830693d6acceaed1b28c11e2a864e85dd1b53400d207efc16bb4b1d468671e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412502, "uuid": "3416ef5c-a421-4646-bdf1-324590d48220", "comment": "Malware payload (AgentTesla)", "value": "d005fe3bbc9790e1163517acdc58a8335452f455", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776412502, "uuid": "3f5fd7bc-a2e3-4a05-b018-ddecc8fb0a84", "comment": "Malware payload (AgentTesla)", "value": "40030305531f349f9649d96cd7cc27f713309fb984112d3c65947782b39f0fcbe603a6a683c742d57f09f0688fcc26ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412502, "uuid": "fbc849d5-d926-405b-8204-0ae74ffe07cc", "value": "T1C8C46516EA61A02FF45789B0797895967D283D321A80EC5BF7801F6934B09ABF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412502, "uuid": "3bc88939-0d2a-44bb-9dab-099afa98326f", "value": "4a2a0b7b16ba3fb5b057a17a327115db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412502, "uuid": "22853723-3888-4731-907c-55e1eec34c70", "value": "12288:aCJ2fjG3OhpWg/NHLZW/BiGWdPsGlngx9PlXLxfv+TMs9ULGFhLJMzU9i:a5fi3mt/nuAaj6uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776412502, "uuid": "359c3576-a21b-4541-8185-16ced4fd7172", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776412502, "uuid": "f531efce-9514-4b2b-8c4e-7c997f0afa09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776412502, "uuid": "44c8e8a7-49c4-4123-9bee-422ccd4cb803", "value": "Estado de cuenta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e4e52d-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776435447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435447, "uuid": "9db23a03-bc94-453d-9b86-52d2e89018a7", "comment": "Malware payload (RemcosRAT)", "value": "c9c66dc3674d5c3051a62294f3bf4b03", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435447, "uuid": "be88a5ee-40a0-4b42-9102-9e05f12e9a9c", "comment": "Malware payload (RemcosRAT)", "value": "ee525194191c7d358bb58e8ea1752353f18fc02dc9a7473abf983f6a7e7b788c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435447, "uuid": "321bc0b9-c11c-4caa-827b-9760473c6ffc", "comment": "Malware payload (RemcosRAT)", "value": "26e3a632feb39afb27fbdb47bf2b0353f5c238aa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435447, "uuid": "cab21ef5-e783-4892-b674-0dfe0c11c949", "comment": "Malware payload (RemcosRAT)", "value": "50c42462b929d2b86d9b22cf961ce4d7d550c2d314ff0248e87aa7b38a854a86d47d9868b385847c98666b617fda1e4d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435447, "uuid": "7a57f37d-1047-4e8f-832e-ff0abf8b3ad8", "value": "T148D595B7296621C8F0227793DAC21FF71BC5EA50567A9CCE0AA996041C1F3DF31A744E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435447, "uuid": "e2fde3ee-8038-4ce6-b3d7-ebc4455620f7", "value": "384:q3n9uHOrRRXMbmoOQKg000YYVV9hSdIzA0YCqlAaDHNHLTz1000jnzz/nYVV9hSC:WMFhTiHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435447, "uuid": "03c2e0a7-7dd4-4b6b-a161-d1cfd8a61439", "value": 2773787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435447, "uuid": "df033cbe-7b73-4378-9c58-f2f2c8fa84a7", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435447, "uuid": "78c5a191-68b3-4f21-b115-a30e55a53a1d", "value": "SKM_C224e26040812550_0003.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ef1a1f-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1776435761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435761, "uuid": "04db4dc2-0c16-40b6-bcff-ed2b35dacec4", "comment": "Malware payload (PhantomGate)", "value": "729cd041bd95360e123f86c3e3a2674b", "object_relation": "md5", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435761, "uuid": "78bf9e0f-07ba-44f6-84b7-248f7fa8df71", "comment": "Malware payload (PhantomGate)", "value": "ee948738e1269f7b3f0b8b1a5ccb1deb07e3cb111c9cf392cd52bb8479ef486c", "object_relation": "sha256", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435761, "uuid": "73751b31-46cf-442a-830a-9cc8296e74ff", "comment": "Malware payload (PhantomGate)", "value": "127a4082e1d91a9ad8b94ef15f8149d8f3f399c6", "object_relation": "sha1", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435761, "uuid": "2fc173ba-99a6-46cf-9053-377de017d071", "comment": "Malware payload (PhantomGate)", "value": "03e916cc957f4d74c5bc712ccd29dc5b024187a9e053ba19a91e261c8c260c47d657af759ad7f46b45b343845c9fb073", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435761, "uuid": "ab11e653-e196-4550-b44a-20b0804bc905", "value": "T12AD2833ECA845FF40BAE51E2298F3A51955A071376356A0EB9CED58C3B39254CBF10EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435761, "uuid": "0e72ef99-2ccb-4d33-ae63-c9006273d5b1", "value": "768:KyRju0mn6rYQZB+zj9UpId4S556nZFkOuuZqq:20mn4YGB+zj9UpIdl5knXkOuuMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435761, "uuid": "48081b1a-8058-43ad-af04-9d5d5535f79c", "value": 29035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435761, "uuid": "5626f1bb-fb8f-46e4-a9d0-14ff0aa9e964", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435761, "uuid": "dce46fc0-da7c-40c6-856a-927b85f99bdf", "value": "RFQ_Banco Group S.R.L ITALY_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dd9ff5-3a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776451632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451632, "uuid": "6b899854-5c67-4a20-b30e-319797e21a79", "comment": "Malware payload", "value": "b041784cdc887246deee85d7d13157f0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451632, "uuid": "cbcd83d8-d154-4175-bb95-099ecdc41eed", "comment": "Malware payload", "value": "efa95a6d46fb9e26839aed55daaf47e8098b31a1dae935e4ffbbfb87dce2a247", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451632, "uuid": "08a56d26-a46d-41d7-8283-d7dab32597d4", "comment": "Malware payload", "value": "197f9df3911da5f239604f6d201675f0dda7a3a9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776451632, "uuid": "f8ad1232-6a63-4b76-9734-1bfc12f4ab10", "comment": "Malware payload", "value": "9a68f2be1e86ed5d8783c137fbcfa0bde91301fb84262e421b21ddeb14463464813682e3dabedebbb2f03e9ebe00469d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451632, "uuid": "f0dd1ef4-6b84-4263-aa48-03681583b7ce", "value": "T12DC57B217586C136D56F03B02A2CC76B56797E603B7344D773ECAA2E1FB09C18A31B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451632, "uuid": "7710d255-1686-4603-a2b5-a579b2c7eaf9", "value": "49152:+LqYaZrf5jSTUialLJrMf+7UVZDEFeY4vLNgmUESIEjPMN2lv+oBjYP5MV3eVouC:jjSTBsq+N4veHjPMNanYP5MV39gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776451632, "uuid": "7b03cb52-c4f4-44bf-abed-6f4a3c9dccee", "value": 2577920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776451632, "uuid": "6e6cfd57-f8f2-4855-be35-96cc8a05fd73", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776451632, "uuid": "cc2b1820-f98f-4d98-99ae-b66ecdfd7815", "value": "versions.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851a5682-3aaf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776466095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466095, "uuid": "20650680-0f02-48f2-9edf-e356849f9c4f", "comment": "Malware payload (Mirai)", "value": "2ba30c470296a0cd072c89b4454b1906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466095, "uuid": "4ea9aa83-b1e6-4581-977c-72f3b49fe68d", "comment": "Malware payload (Mirai)", "value": "efd412ef81226cf52fe4393f8f84e3419f04e8ffee7283b1ab4387718af5b084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466095, "uuid": "43d1d1f7-37eb-44d9-998f-a05f6713368a", "comment": "Malware payload (Mirai)", "value": "0ad9c3ca893a683cc74653889507da7923a9b38e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776466095, "uuid": "50725336-ecc1-499a-b44e-ee31c9295c46", "comment": "Malware payload (Mirai)", "value": "6b64bd00f0ceee6b593774b37cb265ce5cab0ae00c21f16d934919fa85f912d232631fd382fe9d383b90cccd777c9acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466095, "uuid": "79f3b7e3-5f11-4d14-a932-0edbbfaaf83a", "value": "T12183C45A3E324FBEF73D82360B775E708694239A1AE0CA44D1BDF9065E2434E584FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466095, "uuid": "b294e96a-d8f3-4650-b3e6-2e3d09e54add", "value": "1536:EmplhpNBZmYTaidgLf91P+HX/QATHCVFYOYcrkn0i987pj6Ji/1:EmzAFY/crkn0/pjII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776466095, "uuid": "d1bb2cff-68c8-4717-8207-92141c331252", "value": 84316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776466095, "uuid": "30dae44f-e6e6-492b-9b21-e574b76004f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776466095, "uuid": "79d30538-308b-446f-ad88-dea38c31f4bc", "value": "diamond", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a816b80-3a18-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776401089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401089, "uuid": "8ad3f822-b15c-44e5-ba26-b32d3e1ab98d", "comment": "Malware payload (RemcosRAT)", "value": "b80cd64775d30b791d5eed8ba4d0c13b", "object_relation": "md5", "Tag": [ { "name": "Phising", "colour": "#F860C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401089, "uuid": "e549eb0c-e181-4575-9881-bdea896acdb3", "comment": "Malware payload (RemcosRAT)", "value": "f0ba3c05ef14646474b74b5c93d85edd2e2a9ff07df582bc09ac2c1d0115c7a2", "object_relation": "sha256", "Tag": [ { "name": "Phising", "colour": "#F860C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401089, "uuid": "0ef39ee5-2172-4e5b-a36a-06cbfb7250d7", "comment": "Malware payload (RemcosRAT)", "value": "6ac1a2539ac839910100fd8dc8a78b93bf2ae5d5", "object_relation": "sha1", "Tag": [ { "name": "Phising", "colour": "#F860C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776401089, "uuid": "86b453ba-8039-4a05-ae07-8f89d925cf21", "comment": "Malware payload (RemcosRAT)", "value": "58d431f3fad7c6501af67229fe00d823c7764398bcd71989bbce6ad2521e43eeaaf3d8c047852b5ceebda94bfaa29672", "object_relation": "sha3-384", "Tag": [ { "name": "Phising", "colour": "#F860C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401089, "uuid": "bc793ffe-dd16-4617-b9a0-027cb3fce680", "value": "T1568423D3B48882D4BCA330794D06177A51294C9F36F921E35DC12AC66B926ED2EDEC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401089, "uuid": "e4c46e50-34f4-4c7a-80d5-111c7d3a89c1", "value": "6144:glmWf44CEJrhJyM5uxWow1Tv2jQlDPngpxoyPhL80Ec93LFra13opZPwJUSIryRZ:gFACRqM5Gwde87k3tVEc9371e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776401089, "uuid": "cf973a94-6f60-4a2a-8a02-b25cd22c64b8", "value": 381853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776401089, "uuid": "18891d03-4cff-40b7-a5c1-c37a5ae05334", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776401089, "uuid": "f68cb085-f677-4500-8485-2f6885620ec9", "value": "Approved bonuses.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a112a815-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776435647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435647, "uuid": "e2a045da-041d-4c7e-a79f-aec55833b207", "comment": "Malware payload (XWorm)", "value": "ecf9e7debf670e7fa1a1c0035c7154c2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435647, "uuid": "815dea72-14b2-4f94-97b6-a3d1efadeb24", "comment": "Malware payload (XWorm)", "value": "f1dd534821654a887081e1b25dd91b5830847a552ccfeb3bcbbeb138d8dc86a2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435647, "uuid": "954e0ab4-fc3d-493b-8169-f740913d9d22", "comment": "Malware payload (XWorm)", "value": "a58b937361ee53029b2fb577c90bce63a001a834", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435647, "uuid": "27ade566-5f7c-4e26-91e4-20e9a4c78a9c", "comment": "Malware payload (XWorm)", "value": "a377269c85d93731f1d2814cec1f77c3f869ff2f54ef524e856e2b1a5a73443cc2256179b9c2558f99a2d07195475983", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435647, "uuid": "beed3e26-392f-4ea5-9142-1437de4caab9", "value": "T104C5128E6628601E7F759369083669123A41C03FE723BC12A6C57DDDAB60FECD53AD0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435647, "uuid": "12ee7234-407b-4d27-b89a-c4f59fd06036", "value": "192:2uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuJ:fvg++2l7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435647, "uuid": "c06c6503-2a29-4e83-9e09-bdcac7da4215", "value": 2638242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435647, "uuid": "babdf3da-73d4-4fed-92ca-c508c17e3aaa", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435647, "uuid": "62974f37-97f0-490e-af1b-66495fb24403", "value": "PAGO_T058C580OK_PLZX7FGIK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99626eb-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776458532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458532, "uuid": "014c080d-6280-4a15-95d3-e93b46ff4d3f", "comment": "Malware payload (Mirai)", "value": "4650eae7d080a296e71d1d6d6f6af733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458532, "uuid": "d3a70b7c-0219-44ad-9353-54cebb0580e9", "comment": "Malware payload (Mirai)", "value": "f29e7c0dd81dd28fe36aeb23f783e777c99d8080285795a32e2051ed0d3b4324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458532, "uuid": "001a4901-a53a-4af3-86fd-ffdad9fc3473", "comment": "Malware payload (Mirai)", "value": "610447cba377614d524d9db196b6dc5cca57a392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458532, "uuid": "7c40680f-6547-40b8-b18e-827972fb66fd", "comment": "Malware payload (Mirai)", "value": "35e88ded518a680aecc673ea06d63cb95606e1f88d7c95fc756e69d30b2d63551b2321ac438ecb81dc9d769273c2639a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458532, "uuid": "dc0d7f3d-811d-481c-ac9e-e53b297fa2fd", "value": "T1ACA33A43B7090F83D1936AF02A7B2BE05B9DFD9168B0D5846959FE8683315F22582FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458532, "uuid": "e61682b7-c27a-4491-88ab-54edc4113951", "value": "1536:NtjrL2WU+Dl2NGMKu6AdozTxDTVsu0pxumeTfJ4fTQtmMu7yWknYIDsAWxSyk:NtjrSWTMNGMKtAGtyfTQoMMI22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458532, "uuid": "e1fb1fb7-28a5-4e98-9f53-2d86364cf94d", "value": 105364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458532, "uuid": "4355aaaf-d05b-4c50-a31c-090875e026d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458532, "uuid": "6b23c409-1ead-4044-af17-e07072ed788e", "value": "zyre.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64173f6f-3a82-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1776446712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446712, "uuid": "8200b685-1b98-4b89-993e-2fb70c8d6ccf", "comment": "Malware payload (NanoCore)", "value": "7f82cecd1a04d8b7cde08f4f9d55633a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446712, "uuid": "1d68aa89-c89c-40f2-aae4-910239878403", "comment": "Malware payload (NanoCore)", "value": "f6ac3f6683fce33f2f376745b3f9dfe5e86d5d661c36c2ed8ae5a5f153f72c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446712, "uuid": "58f0ce5e-b9df-4a01-ae9a-1608a9a98dcd", "comment": "Malware payload (NanoCore)", "value": "8f2351dd88104471d05d10fb9001c29d58668149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776446712, "uuid": "f9809bcd-5bfa-479f-b8b5-1496f581488a", "comment": "Malware payload (NanoCore)", "value": "73d7d84c2a3c8cbed61fd9f828d72145c5cb79623081532f56a6dbc30090b5117c380636f0fc144cb7a04fcde6bf5e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446712, "uuid": "44157a99-7198-465b-a6ce-df9e3f2969f5", "value": "T12B14CF167BA8492FE2DE85BDA01256129379C2E3EDD3F3DE28D451B79B227E006071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446712, "uuid": "b016bb86-a6c9-4f39-940c-087843a05046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446712, "uuid": "7118f3ce-0887-4954-a984-d44e7d13850e", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIGRSnfr0CEE9R4szJbGxBzU9yj:sLV6Bta6dtJmakIM5Inz0mJ+zAapxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776446712, "uuid": "c835359f-2daf-4d72-98af-20c246beaef4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776446712, "uuid": "50fa1121-4db5-49ee-8ad0-9068cf52a8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776446712, "uuid": "4b96ab48-3823-434b-b0a3-bccc837ef980", "value": "goddadydowload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8c888a-3a95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776454783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454783, "uuid": "bf7b48fd-47f7-4804-b92a-580db6ccd945", "comment": "Malware payload", "value": "4e433b9bc88da2c8a45d240118d76867", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454783, "uuid": "385ca0d3-934a-4af2-8565-0290f64ca5dc", "comment": "Malware payload", "value": "f6b1f7b24b1a8e11ed93f906a5fa6dee63de357b9034317efcc14bb44b7c68a8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454783, "uuid": "4c374d59-6fac-45ef-9a4a-5a0963b2267c", "comment": "Malware payload", "value": "4ca70f77a3ea043408a1d141224225259448aa92", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776454783, "uuid": "9371f511-994d-45be-9941-119f825573a1", "comment": "Malware payload", "value": "6949c1db3ecf24db9f4f001ba13f9f8b96841c1e4f94cddbd2e7b6c70d35972075cff2c1ed2192ddf1b3f9ab9d1801a4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454783, "uuid": "692c9d43-3baa-4f57-8fb2-db2077a23e7c", "value": "T134812AA57A1B3AC2EFD258397834254A96E077A64FD60AC90E006E5078FE384E521F1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454783, "uuid": "0a669338-3318-4372-a714-e418c16b8c97", "value": "96:BLFLrYwONvA8hDfdQPK81lt9vUF3D9xUQmOJ:B5LrYwONvA8dFQCy7huRxGOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776454783, "uuid": "0cd790fe-2e0f-4a23-9174-0cd3c52e0958", "value": 3860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776454783, "uuid": "0ebbd308-3312-49b1-aff5-43edc545e26a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776454783, "uuid": "86925ea9-cf5c-48b1-a389-ed8fb4f0fdb8", "value": "photo-784797963.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89062285-3a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776452357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452357, "uuid": "cc0b9c62-e272-4355-9678-19848162a272", "comment": "Malware payload (Mirai)", "value": "b874b222b28384e310a2c7e9526b822e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452357, "uuid": "3b8a37dd-a383-4539-a666-64a709fb2ec0", "comment": "Malware payload (Mirai)", "value": "f807a28570e81c290993e9967469f7fc9601448eb14af415842933f179a99671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452357, "uuid": "0a2c2231-8fab-4ead-bc79-1b2401a967fd", "comment": "Malware payload (Mirai)", "value": "b69c28e0dabb7a1b2a175e4964611ef87bd59d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776452357, "uuid": "8035a2af-a4aa-4284-9e04-34b6ebd7c37d", "comment": "Malware payload (Mirai)", "value": "8bb56cfc2912ddcc2a5f81417b4743d75d8508f18ad36b3ec1304333fe1251044cf637f35ae6edf32d3f9991d862d89e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452357, "uuid": "71c28fe1-68a2-4963-9929-c3327286d61b", "value": "T17F144912FB0C0463CA935CF48E3F47FAA362199214F99111240D7F5E6A32D77A68BBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452357, "uuid": "293d3df9-d872-4b5d-a506-c6ccb478ee1f", "value": "3072:blZtt9RqxPnOv5WtIIdyjOxz6GlUIZEki3wUaM:3FA5Q4tR5NrUAElB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776452357, "uuid": "1c1707ca-0f65-4558-b9e0-605faa98fbbb", "value": 197220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776452357, "uuid": "51385cb5-0288-45ab-ab4e-051228cf7842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776452357, "uuid": "02f0856c-7feb-4dc7-bdee-f81d37689baa", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb961d6f-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435262, "uuid": "783207aa-3a19-4daf-95d2-4ead6db2a0a9", "comment": "Malware payload (PhantomStealer)", "value": "a015e8e5334b404f2b4c63988db60be8", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435262, "uuid": "4fce60de-4e0d-4f06-88ec-2eb766d481ba", "comment": "Malware payload (PhantomStealer)", "value": "f824ae08ceee86e79359861a3fda7039d7d09a790e4e15c53b89b7434089e09d", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435262, "uuid": "9c9b5ece-a789-4e60-a466-a786359081d0", "comment": "Malware payload (PhantomStealer)", "value": "4cd5391e53c2b5cb9adb05859ffadbafc16cfa5f", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435262, "uuid": "3a67d2f0-ca88-4767-951d-ccfab6960bd9", "comment": "Malware payload (PhantomStealer)", "value": "b852a32187b2e4c81d110e8b33ee50afba07f3e28e397980b7796fd054006af8a32a1d843d180c0064709aba52325588", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435262, "uuid": "0f9c45d3-c8b1-4b85-9bdf-33f7a2f3d415", "value": "T152D2723EC9845FF00BAE51B2298F7E619559071376352A0EB9CED49D3B39254CBE40EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435262, "uuid": "92cd054c-f7d8-41d0-869c-0aa9cc1ebad8", "value": "768:KeBVSyYeWDLTo0yNGj65lgGdtKJaf2kycWmaBjm:lbSyeDnohNGu5lgGdtaaf2kycWzB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435262, "uuid": "0a3afee9-bbec-49b7-a605-66aff768c86d", "value": 28451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435262, "uuid": "8853d3d8-864d-4fc5-9c9a-903083f65740", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435262, "uuid": "891d945c-28eb-4c14-b742-6683ad1992a8", "value": "Bigtem AS TEKLIF ONAYI.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4702d62-3a73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776440377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440377, "uuid": "02356a30-dead-4aa4-bf8d-e2ba9635691c", "comment": "Malware payload (Mirai)", "value": "9f41c68cf6184c5b698ebfa444e6a763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440377, "uuid": "06c3e2f3-0820-4fa6-bdf6-3fe49fa79f99", "comment": "Malware payload (Mirai)", "value": "f96cf5df19e0e98426e2d7584a789a36474f715895677dc0e417ed3f82e84253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440377, "uuid": "8df11927-bae3-4001-8a85-2abe3c3dbe26", "comment": "Malware payload (Mirai)", "value": "ca9a95c6f65efcb51adb869535e2261bcd62d3d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776440377, "uuid": "0e7feec1-9648-4b60-bf28-38fa87275ced", "comment": "Malware payload (Mirai)", "value": "7fd9b1ae7a3afbe2705c357c77a25fcc6f3f8fe532770a2e96d3b95d9aca7e6718aa4695869dd78a5114f11313c7277c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440377, "uuid": "cb840896-cdbb-4f5f-a062-510cffc0c370", "value": "T1EA145F72A94CCA87D826767D50A98F3BDD3E73EB2745CD017DD1203689E6ADB2807C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440377, "uuid": "2ff98176-c429-4e7e-ae0b-f5c6c9ed3a4f", "value": "1536:D1Qt/D6d9H8yciWZ/168S+hfPgXMMnhiGmmAoIswLw8yfItTHK+xK7jK5tup+zpH:+acYWZ/thAMoonDLw8yfItTHvx7DWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776440377, "uuid": "d8bb09b1-1826-4754-9d61-c590695e3c20", "value": 205168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776440377, "uuid": "deb3d361-5507-4456-8bb2-5029cda6e56f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776440377, "uuid": "7682d51b-00fc-4066-828b-1662e081fdb4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89dbefa-3a65-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776434425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434425, "uuid": "dba23774-8fea-42f7-bcef-0a7565d2d12b", "comment": "Malware payload (RemcosRAT)", "value": "0d551c2656d2953b6d3bfe4d5a169ae9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434425, "uuid": "7dc01ec7-20c0-4ae8-9ec0-dbf8901a3f39", "comment": "Malware payload (RemcosRAT)", "value": "f9d4d9d8ba78742c1dfcc2d3ff38b13cdc2cba40843564b5919100601f23bad1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434425, "uuid": "bfc0915d-9808-4f2b-832a-7d7c20a600dd", "comment": "Malware payload (RemcosRAT)", "value": "442e9b66c76518de2fe221e76bea79b0a684a04c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776434425, "uuid": "7ae8a984-d9d9-4aa3-8b0b-58d159a66ecd", "comment": "Malware payload (RemcosRAT)", "value": "8e8075802e107e1083a41277794e9460ef337da2641c6f9bdc20fcb3d34c2787bc42405d27db63978d3ef377f1a5995f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434425, "uuid": "70660c48-433d-484e-86fe-0701e0bc5435", "value": "T1C476A500C07D7724A8EFC75EC03BA5605A4E251B2A0D9E6E303B453C1EB5FA7457A9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434425, "uuid": "09522ea2-91f5-4608-b3db-c37ca41d5002", "value": "98304:h1Kv+xzMzbn3dw5XsvH6Ly2dxAcJCD3kIqiHK/DNwb0Ihqz6xCj6i/5VhkXC9yFl:h0v+xoH3daJoj3/7WJuQLRPkXC9a/o9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776434425, "uuid": "d56771f0-09f7-49b8-94e6-1623e0b3cd72", "value": 7320838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776434425, "uuid": "d6ff3c52-bbfa-43ee-aa21-c601683c5d80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776434425, "uuid": "598b56fd-bf5f-4860-bbb3-eab3fa166278", "value": "W1003531.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe81bac-3a52-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1776426250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426250, "uuid": "1d8e45b4-220a-4652-9951-ce2bd09c3438", "comment": "Malware payload (DiscordTokenStealer)", "value": "c256201be2f01e5ca937d1aad0480c96", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426250, "uuid": "e9be7898-083c-4e04-bdaf-baa18e38426d", "comment": "Malware payload (DiscordTokenStealer)", "value": "fa4bfb80d55d17bdbcdb46f5d029d6dbc542605a9eb62420cdc96d72ad7175ae", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426250, "uuid": "d76c18b2-0ce2-495d-b120-e6aa7539a943", "comment": "Malware payload (DiscordTokenStealer)", "value": "bd97ea213877acaea5b5c3e0c4ec9c48c2cc9d11", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426250, "uuid": "3990af4d-2735-4a7a-8881-db8de95ca2eb", "comment": "Malware payload (DiscordTokenStealer)", "value": "845c6e94a0f3d5183241bcdeea0de52cc375483e2c9c83721759ef6ec5c90b343eab308f34344bb33ae2cf706c7464bb", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426250, "uuid": "998c7199-938e-4f5e-8a5f-fabbba0e6779", "value": "T12CF4278336CB1CFADE93273854DB633A6735FEB08B6A8B6B4518D2311C135D1AD5AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426250, "uuid": "03cadc90-4e1b-46cc-8175-4d370133d4f3", "value": "73ed70e62cd9e1e14d4b1c4a4b7bc17a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426250, "uuid": "3dffb363-c363-4f92-bcfc-fc3bc19e5139", "value": "12288:yxukgXxZnbewmTnKD/YjHHCF6/sXSHdQFiO0jl9lQo+y:EwBZngTkrvQO0jl9lQo+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426250, "uuid": "78d0f9e6-8d63-419a-ba35-26bcf1dbd4f6", "value": 785471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426250, "uuid": "778b43b7-dfdc-4453-9b17-7f8766c9c972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426250, "uuid": "ebc5d35f-3c2b-441c-a55e-49a05e3805e8", "value": "immortal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d9b5ef-3a71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776439363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776439363, "uuid": "e85ee785-5995-45b0-81dc-c50a31ce54ef", "comment": "Malware payload", "value": "eff9db767e0a4c96058859db93fd0ff4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776439363, "uuid": "71685b35-34d3-4395-b91b-49755d411c8e", "comment": "Malware payload", "value": "fa7953b16c42e6d0056a0df4a4464480a5c2db24522b92b64fb545d7367e63ce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776439363, "uuid": "f81be7d7-126e-4a89-913b-eef13da079cf", "comment": "Malware payload", "value": "ac7f463046e3d462f35acd91b55c7e3b47ca631a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776439363, "uuid": "d3af019d-f685-4990-a72b-6f643ecae101", "comment": "Malware payload", "value": "56d1d2cbeca1a656f429aa3b8d22d7d674d377c69e5e02bab125f8ce8d27eb040a9aa83359369965b8177888c1c69ff5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776439363, "uuid": "2c27837b-9020-4b26-8466-cd6947f348c4", "value": "T15B137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776439363, "uuid": "1e27b074-0e37-454f-b635-74253e218351", "value": "768:bE+N9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bE+Oco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776439363, "uuid": "1af17912-6973-4262-847f-85b22397a900", "value": 45498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776439363, "uuid": "4decfc10-a644-47d2-a5bb-543ed1bdb667", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776439363, "uuid": "e13708f4-9580-4cca-9789-a53b153ce9f7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d470b1-3a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776458385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458385, "uuid": "8fbeb26f-36d9-484f-b788-872c291120fa", "comment": "Malware payload", "value": "b8b6e89fbaa0f686f642a431cb3d79aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458385, "uuid": "3f3d52ad-166e-406e-8f90-4b3830652e8b", "comment": "Malware payload", "value": "fa8b8c81b1c8727b78bd76a0a847582540df09fe77189c929dba1112317eed0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458385, "uuid": "4a41ab2c-2027-45fe-a4cc-d11a5baa2b0e", "comment": "Malware payload", "value": "6a24854b3a3842d79a9fa4550e589dae8e4e0a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776458385, "uuid": "aab94739-a8ce-40aa-95f6-ac209a4169dd", "comment": "Malware payload", "value": "3a9d14a4b6f625d081333c9dac4acbbb8bfd0d48bc0f5f66e46471a142f54512083df4698e53c83eb9370e01239763eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458385, "uuid": "b7f9c1a5-36db-4432-9d49-6b7d4c76a55c", "value": "T1AF08333FE5576726D12E913B28B7EA28683B5B3765424E23B2F4D0C99F95030283D787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458385, "uuid": "be1db263-ee45-4177-9090-59c3c433c559", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458385, "uuid": "1cf5c64c-e2fb-492b-926f-0b5206291691", "value": "1572864:m7Btv5hPZ8GiLvbw10wsqAU0bsDupCSnokWwECueEH:m7BtvqRjw10FUysCISnontCux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776458385, "uuid": "1c5566f9-e6b5-4272-86c2-8610a987f6e7", "value": 84293697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776458385, "uuid": "ad1bc4ac-0e32-4c7d-9c5e-687328394d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776458385, "uuid": "8e0482d8-a28c-4a95-b494-65594cdf2478", "value": "\u7cbe\u9009\u6536\u96c6\u6574\u7406-rR15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d048aca2-3a6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776436586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436586, "uuid": "2f4a3148-a934-4fb4-a99f-f0a91a321e57", "comment": "Malware payload", "value": "a83b39f647ef100c992ea19f7c5a9595", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436586, "uuid": "f2fa9aa7-c935-404c-845a-57c9ee8fe9ce", "comment": "Malware payload", "value": "faaa4d005314440dfd7ed5fa2f522e1a2642f08ec3bf0c1e2779a39bf4268349", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436586, "uuid": "96178766-68fc-4dc2-8079-672a24110be3", "comment": "Malware payload", "value": "e796ec32c392496ae9fb42be108784ea825485f3", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776436586, "uuid": "d3af687a-1dc7-4884-9017-0b6c54a9162d", "comment": "Malware payload", "value": "9ac2390f79138965dd36e2021bdfe96db15f3f14d40ae2126ec187351745311bb8c354039b8ffd84da84338414d835fc", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436586, "uuid": "e22a666c-2389-469d-ba79-90d5120e86bd", "value": "T1A2462332FF4148B6C14103F5792F6E362F3E7B17494899E779AC49837B1AE805A2F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436586, "uuid": "8921c513-05c5-4f96-ace2-9ecf4dd0ef5b", "value": "49152:6eOtozvwz4H9w+CRLHee+xnHiWIsdd3aUGhLOChYVFjdHZHCvAJ1egJYBrIfuim/:duim3YGGWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776436586, "uuid": "9b378f94-67b5-4fc4-986e-5a0b8527c039", "value": 5853184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776436586, "uuid": "d7920a85-49bc-417b-a99f-8ef3d8a1778f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776436586, "uuid": "c8d9dcee-0a2a-4de1-b0c7-5791fec383c3", "value": "0BRK22Z336890ESNQO_Arb748491G1F8Vougrn.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f24710d-3a67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435134, "uuid": "0bc14fff-0c19-4302-97b9-c26169f8c412", "comment": "Malware payload", "value": "3434d956f45adc6f0974733aa8ecfae1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435134, "uuid": "2d9c2599-0eef-468f-be40-c9ba6dd242d7", "comment": "Malware payload", "value": "fc5bdf6835859243ea18cce62e91f79ddc938eed2c4d67fe2360a30a2e869d28", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435134, "uuid": "f7d08b73-093a-4276-8a20-135a90f31973", "comment": "Malware payload", "value": "d025dd0595d9e1ad030d582c95520a4d713526ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435134, "uuid": "ac314901-3177-45e0-b381-0a467943f593", "comment": "Malware payload", "value": "1901a9b20c6005d4f950c0fbfd078c783f14d49b14a42c28ddbee0b3e87cc5dc9fafb6ea9bd67bf4b51f8c0d0d17626a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435134, "uuid": "7b1c5f54-53b4-4cc2-8210-b1e141519e5d", "value": "T1C4641F38ADEE401AB1B3EF54AEE43497E96FB7633B0E585C1081034A4723945EDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435134, "uuid": "e10453d0-78ec-4726-9e77-8c27f3bda61c", "value": "6144:lurugTAUWWLGHeJ7zj9DY0n360Os5p+fm1ENRGgiKW8FTonHuEduH+Q:lurMWLGHeJ7zj9DYGK0Os5Om1IziT8x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435134, "uuid": "dd64c349-4c5b-40a7-bbce-8766fba369b4", "value": 316518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435134, "uuid": "da488906-d1fb-45ce-af26-d127e5f2e2f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435134, "uuid": "526bbfa2-4125-44ed-bb26-fb24703359ac", "value": "profoma invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c79e414-3a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776426137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426137, "uuid": "58743b74-8b96-42c2-81f3-e981dea3a1d3", "comment": "Malware payload", "value": "1cbcf480226fdad66e7ff4916656dc04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426137, "uuid": "bb6fc3a5-7d59-48c0-9c03-c0926d1bc258", "comment": "Malware payload", "value": "fc760d6358637c983b085305d7925fbb9e9d27e593728ead81e89cd26a27156b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426137, "uuid": "845b2ad8-0c38-42cc-b269-0eb8c69ae59a", "comment": "Malware payload", "value": "2c0d437ba29d505c1d3d22136ab6fa51e56446f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776426137, "uuid": "e869280d-8b79-45d9-bb09-aff52ba8a933", "comment": "Malware payload", "value": "7915c82429d442afeb4105ce1f24ae4dab169b4b4ae82641cacd2a9415fde418fb0255dafd867375d5433a0026e693ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426137, "uuid": "9d13edd0-b33b-4613-b760-a07f312468b3", "value": "T126849F413B57DA47C6EC0AF4E001027A1BF05F26F5ABE3991EC570E96C637620B6E1A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426137, "uuid": "f72f907f-c947-4568-a7d6-de53c6a521b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426137, "uuid": "eefefb7b-476f-4a7e-b7f5-9db34eafa6cc", "value": "6144:46CrBLCJI1LSuADaB71tKe57RFY4zeha4zeh49tA0zlarOl2sjgU0iH:46CrBLCJI1LCDaLtKe57PnUVaOFgU0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776426137, "uuid": "551ba3f8-403b-4240-b6bc-166e43cfff99", "value": 372576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776426137, "uuid": "62e5e54b-0518-4b8c-9663-3aa0e72f84ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776426137, "uuid": "47b14ade-f8b6-4c58-8892-c0a79353c9b0", "value": "StartGoMyPhoto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf1c0d3-3a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776409604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409604, "uuid": "90a75423-53ef-4dec-bf10-fda2fe23eea2", "comment": "Malware payload (Gafgyt)", "value": "21546a1b5e243dfd95d72fa59b501726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409604, "uuid": "7d1a9047-41d5-4188-b5c4-0f4094bb07a3", "comment": "Malware payload (Gafgyt)", "value": "fd3c466180447feeb0794564da5083be45a6ffafcd0423067bfe83062b4f0a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409604, "uuid": "bb71158d-31b1-4765-a948-fa902f6f92d7", "comment": "Malware payload (Gafgyt)", "value": "31c4eb6b5f5fd9c97c8fe854b8685d4679d18166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776409604, "uuid": "ef7dbf82-52d9-4d98-a857-ed87f30a95b3", "comment": "Malware payload (Gafgyt)", "value": "dcf9f9cafea4486203d5384eb7f4124070e09caa200a059a3873dc39f1dad8c2b7e5491970791be5055310b6811f4b23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409604, "uuid": "e420f93b-a47a-4eed-ba65-3e7bc6f41fea", "value": "T114D33B05E8509727C6D227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409604, "uuid": "56773c2a-e6ab-468c-8b13-d1934897b32f", "value": "3072:8pfNtKdcp3eQwPGyxPtJa2mgQupNOXPxu545hLturOw2gicfmyhQCYMhEFg:oyxPtJa2mgQTuy5hLt0O0myhQCYMhEFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776409604, "uuid": "19341784-6762-483d-b806-3a081a440a18", "value": 142847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776409604, "uuid": "4acfe285-4c9f-4c02-9ff8-3450c1b45a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776409604, "uuid": "79b60c38-297c-4f40-9643-315d967479c9", "value": "arm61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b5c4ff-3a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776455836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455836, "uuid": "26c7301d-a389-458a-bf65-0253d24fae55", "comment": "Malware payload", "value": "7d2f1c3ac11cc77dc745ac172f4a5480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455836, "uuid": "bca74256-9ffb-4ca8-a879-fca1478e9986", "comment": "Malware payload", "value": "fd6c043a426459f61c6b8edee41c26b79a912708f187c9ea21f66af0fcb09039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455836, "uuid": "0812126f-fc35-4f2d-9d7a-c315cbe449b0", "comment": "Malware payload", "value": "e847ddf4e6b64aa75fee8156f43dec4f3d484d84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776455836, "uuid": "4780c284-63bf-41fa-9659-65124fbac074", "comment": "Malware payload", "value": "0ce638e9f32cec325f764074d020f323ed6e55fca942940313a17756d50384213b52f614f7f1253f1ab9c42910b36e6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455836, "uuid": "33e0d230-2657-406a-a858-0b8432d12382", "value": "T19BD33B07FB41CF53D4D227B9BA9B9249333397A5D3D7330649189BF83F8269A0E26905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455836, "uuid": "5ff5d5d7-bc0a-4597-93d2-9f126220252e", "value": "1536:pgneJa0WJwFG3tb+ELznWFdIaCgyLlavLWdlLTiWc2XYQRMAM3qcWksMzw/9ZVem:NJa0FgxVgdIaCgyLEEncMxO39WkM/9H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776455836, "uuid": "f7b2b424-bdde-46fe-afa7-657b1fb2040a", "value": 136835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776455836, "uuid": "b806a1df-cc85-4308-b4f5-9b32728c844f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776455836, "uuid": "79512799-248d-403f-a9c9-b51cfe41b320", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5280de-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776435671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435671, "uuid": "e09fb49d-28d0-407c-b87c-2646a0c345d6", "comment": "Malware payload", "value": "18bf467368ab5197320af4c776fcc1ff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435671, "uuid": "e15a3dd8-67a8-496f-bd7e-a7f6146638e8", "comment": "Malware payload", "value": "fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435671, "uuid": "571ff910-210e-4179-b246-6efc23424a2f", "comment": "Malware payload", "value": "3701b8dea3a2a852039834424fc214651bc97dac", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435671, "uuid": "eedb735a-cfe2-424a-ac08-725b55a68dcb", "comment": "Malware payload", "value": "f640e65d09a934a968df18fbfcd2f5f1e0dfa0f4e6de8bc065d2c50ba75dfb6f13db7ae4b6df5634bf675e36d3952ea7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435671, "uuid": "67d5aa4a-9a55-4acb-b4f0-ff7d73b3bf06", "value": "T103D6C052E7414A15C4AA32377DBA8E10F72C7E9D828B57431004BB74BC7B5FC7BA168A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435671, "uuid": "73cb6a26-2962-4217-a683-d1afa2aca2fb", "value": "196608:YUffxpDitBEd8wvHKuGYThR1jpxtw08Dvn8VdCJ:YUffx9iAiJRY1n9w0fVdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435671, "uuid": "9f49ceb0-9b94-4b82-b1af-06bc802eb3b5", "value": 12776162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435671, "uuid": "f1067bab-7b5e-4c17-802c-7e6d7354927e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435671, "uuid": "226ff76c-a73e-4304-9bf7-a3e1d96a782b", "value": "fe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1093df27-3a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776456021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456021, "uuid": "2415ec6e-6912-4d9a-afcf-11a2836693b2", "comment": "Malware payload", "value": "a8bf174db6286fcb18ed79a413e34112", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456021, "uuid": "0c2ff676-c901-424b-ab10-f2957f1582ea", "comment": "Malware payload", "value": "fe8a73497c0604f236298b7e78540a67319b0b9eb2b1a85453b66821a8aa8e70", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456021, "uuid": "9357e1c0-4ddd-49c5-bff4-90bc0ba1337e", "comment": "Malware payload", "value": "d5008454f7e6309aad852435977caedc548ac2c1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776456021, "uuid": "aa5586a3-ca16-4d2a-a757-1cbc7b4a8e76", "comment": "Malware payload", "value": "33b97b4f0df98cddea21b270733e4c4ab7cc59413d135aee636dec0dec60e308857e8e8a57f0d694f36a11a8f2bafd78", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456021, "uuid": "6acedbec-1f9d-42f0-bd29-123775bb55fd", "value": "T1AF77F013FA01DAD2D86D92F46E130FA53A671F18C6422AEB00157B9E3E7A2C34DD65CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456021, "uuid": "8e1693ff-2b46-4b99-9f7d-6920359cf0dd", "value": "49152:E9ObNCvpDxAdNrGiHdvDirH69nPpjd5/aoZ/bKasigqmmz1zdGGiQTOSMUQYqK0V:wOb8hDxAxDEaFPpREas9mz1zBNTz0tw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776456021, "uuid": "ad07adde-b0ad-4404-bcdc-ab5b5479509c", "value": 34507432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776456021, "uuid": "f7b40078-8772-4494-ac60-a993b1f250e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776456021, "uuid": "617fbe8f-fab4-4c19-ad71-3e2c6da36c7d", "value": "da.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbde1ec9-3a51-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776425814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425814, "uuid": "2fd7224d-5222-4740-8bcb-04c9a95940bd", "comment": "Malware payload (XWorm)", "value": "431dc20c2fcabd699d32a6c6f7b2dfee", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425814, "uuid": "fdcec023-6d03-4625-a637-70d2ab1df018", "comment": "Malware payload (XWorm)", "value": "fe93882d49c90278bd15c2b5f02a3d278e41b6c98604210cea167042cec509ea", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425814, "uuid": "095cfb68-940b-4270-b7b7-97aba32766df", "comment": "Malware payload (XWorm)", "value": "3de951b6cd9fbbef356a18b754743eaf3a57b332", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776425814, "uuid": "6f0f942d-629f-46b7-9a07-a60a32b8f67b", "comment": "Malware payload (XWorm)", "value": "b47f5543864a791b8e60fabad18ffb14d4d6a109816bbdf262f2df5a10ee5c78920added4cb90cbd8de663297bd76101", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425814, "uuid": "335c207e-e1b3-4562-9356-65843905f0ef", "value": "T13D063366E1E74B0361CDEBE3522EF9D1612509F8074BD968E38D29970DA081DF9CBF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425814, "uuid": "1054398c-22ab-4cb4-a53e-fd92e21cc2c0", "value": "49152:VQXwEgL5O6qrgYwKB5TCVtNqEAuoFzGdIMdLdK6mOV2RVHUAq2xGYnmJae8G8fle:VQU5urgYbUlK6mi2RVHmAl5uiI6Oau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776425814, "uuid": "8c848bd9-b0da-4537-9cbf-dcff796f4c6e", "value": 3817360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776425814, "uuid": "f9eb42da-a297-490c-86b5-76f68e964fc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776425814, "uuid": "7b35887b-843f-4412-9996-a304989e768e", "value": "2025 Harry Morrison Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f5d8a6-3a68-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776435632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435632, "uuid": "630ccf06-c283-4da4-8f37-beb8d630f990", "comment": "Malware payload (PhantomStealer)", "value": "fb271f9655a48f79e512daf0e1b4a1dd", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435632, "uuid": "e984b509-c48e-425b-8a62-1244eebee6a1", "comment": "Malware payload (PhantomStealer)", "value": "ff8a21126a2100e125da878f748023a6de6ea3cefb7533c1825c1c9e41e27982", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435632, "uuid": "3dc3233c-4144-4d06-b60e-23bf8f5ba91c", "comment": "Malware payload (PhantomStealer)", "value": "e6fcf95195b12d76c8a6370e821e6faf9098255d", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776435632, "uuid": "48b932c5-66a4-4fee-8c24-875238eb7359", "comment": "Malware payload (PhantomStealer)", "value": "35b0cfae461582367ed0098d2e1451345f646f921cc0e4cb25ba473608eb6a74b6999f5594952a4bb1365d6a11fc4460", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435632, "uuid": "3dc2bf04-bed8-4cb5-b17c-4a93629395b4", "value": "T1C792E7165A094FF909FD62A229CF6C51E9110B526B36781EB9CED89C3F3E714CBD10E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435632, "uuid": "f5c9db96-bf5a-4664-b4cb-a953dcb7d632", "value": "384:K7ch3LGK9oYnHWIa60ORjcsScMmgflud4bryj7gKiqq:K4FbaYva5ORtSSgfc4bry4Xqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776435632, "uuid": "849b2589-8602-4745-b8b8-d51ad1365a7c", "value": 21152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776435632, "uuid": "e0542f57-0b8b-44d1-b91a-18e039651d49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776435632, "uuid": "10aeec81-6214-4f0b-ab11-6df2b353b1fa", "value": "STATEMENT OF ACCOUNT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }