{ "Event": { "published": true, "date": "2026-02-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-03", "timestamp": 1770163381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "894a747a-75e5-4db0-95ca-42f414b55855", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682d53f2-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101764, "uuid": "6c81912f-0271-4181-b572-1e1fce47a78a", "comment": "Malware payload (Coper)", "value": "d39e5735253c98a8db6af9c9eaaa168e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101764, "uuid": "cea48b13-437b-41c2-a6fb-2d5e1c389d9a", "comment": "Malware payload (Coper)", "value": "0007aff422a0c7ae9928eae16237ddd1a29e90180c44ede869ecb55c6182879d", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101764, "uuid": "972ad24d-1581-4602-809e-b8f821fbd4c0", "comment": "Malware payload (Coper)", "value": "afacc18f4ceeb89f33fc7c7ae75a96909dc63a87", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101764, "uuid": "4d2f66fc-0f09-4aaf-b1a0-a75b74d3dd82", "comment": "Malware payload (Coper)", "value": "3e0364eef23561b6ff4361b91967b7e1a8ebc179119aae64a89ef475e09ff636ba6c8d0438ec2eb4d167533edcdb30b0", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101764, "uuid": "d6701223-29b4-437c-b72a-3c94d1e1f46c", "value": "T15E451282B7C8CB02E4EE2B344CAB42D5A1757E50CF0192577A45771E0E723E59F22FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101764, "uuid": "7c313382-6010-4d6a-b861-4fc7bc4672eb", "value": "24576:V0eBRnmOtYwdClLDzVF0O5kMdAZiUEAU+haH3/hEw87qCqvrc7r+HV6m:V080ODdgDz30OCOAZixZ+oX2t7q/w+Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101764, "uuid": "3dc29651-f90f-4525-925a-dd3912a4f6cf", "value": 1172695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101764, "uuid": "fc9e5764-9146-4b01-bd1c-080ad431cd06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101764, "uuid": "abe815a5-db38-4a63-9413-bfe31fd0ad5f", "value": "71f93ff_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfd2c52-012c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770142572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142572, "uuid": "db1189c2-b33b-4b17-8255-181bc37fd1d6", "comment": "Malware payload (Mirai)", "value": "ed7ce1d197029903990b8a130febe2fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142572, "uuid": "faf2c45b-0c73-46c8-ae38-6fab309b0d22", "comment": "Malware payload (Mirai)", "value": "0029fe67bf75b12aa1497f5302e59294502f57f59dd47d0c7d8e9a376794adf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142572, "uuid": "fdac2a93-26ae-4f52-adf9-74664681ad25", "comment": "Malware payload (Mirai)", "value": "eb7cadbfdeda33ef74d548e958630d4d1c208b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142572, "uuid": "d829d77a-3961-487c-b992-9bdec7044cb2", "comment": "Malware payload (Mirai)", "value": "ad3fc49b440a369286875137d3334cf3419609b5d4f0a30961ef250251b53362ff6e73f4feee1ec445e1deac11c748bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142572, "uuid": "3a4d90e2-9839-4f53-986b-0e621ea40a14", "value": "T163533A8AE68BD5F0CD4A09B0157FFB3DC636A8303274CEA7D7C4B957A9E3642A05116C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142572, "uuid": "fb432da4-9377-4a6c-94d5-9d6c6c3cecbc", "value": "768:PBwi1YBbMR0QfmKURPsyPwNXxIKBsCt/+wQugsSHwG/d/tSyMgfFkIb1PcLtupzD:IWyQf4PCXxKuytS+fduLMpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770142572, "uuid": "bf4e904e-a8c0-42f1-9ea7-902feedcead7", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770142572, "uuid": "012ad9ba-5153-43e2-9f88-eb9444f502fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142572, "uuid": "d8254f2e-b399-462c-88c3-afb838714e08", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3ea4ca-0121-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770137927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137927, "uuid": "511f30bf-57ca-4fac-aaa6-8843c8cf0a3b", "comment": "Malware payload (LummaStealer)", "value": "4d247e067f2ea1fb1793d5b2eb3fbdc9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137927, "uuid": "a3beca95-843f-42f8-843c-407baf187439", "comment": "Malware payload (LummaStealer)", "value": "00654e2183b5d32d6676fe6971c82eb511e4ae785c352e2fc03af5ec30f72e6c", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137927, "uuid": "ce06afd5-a3c2-4bdb-a669-480428cf58c9", "comment": "Malware payload (LummaStealer)", "value": "ca9663c4b9aa6ef80b28852175b23db2c64ddffc", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137927, "uuid": "5e6ca807-ae71-45c8-b29c-b897019486f8", "comment": "Malware payload (LummaStealer)", "value": "80592063c357acc1f28b5a39ec9cae3227335dba713d0701232cff4b48eb943f3c7a31956bc665deb320b379e4ea91b7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137927, "uuid": "177b520e-585b-4be6-965a-05e40fd562c5", "value": "T193264B92BA84D665D5CBF239E871A1D56230B84C033136D3AB651EB64C6B7C8133FB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137927, "uuid": "f3a11896-ac19-47df-a230-9ecedbdd6951", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137927, "uuid": "157696a3-5470-47eb-96d4-aff3ef73916a", "value": "98304:iki4kfRlc2qtjBVof6QJJBJgFOJcieyU+Bxp:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137927, "uuid": "6c7e36b2-6ff9-46ea-ba32-fdc02b0e9f61", "value": 4532736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137927, "uuid": "9a481469-4fa8-4c81-8b15-5499063b969c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137927, "uuid": "f879a050-b42a-4d8e-9b4f-c011584559c5", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49665128-0137-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770147239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147239, "uuid": "4d01b6f7-be2b-40f4-9d48-c479a710a528", "comment": "Malware payload", "value": "ab86a5d1fdda36ae38879b1ea666b509", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147239, "uuid": "93a584b2-57c5-4d75-9acc-4bac21c795c0", "comment": "Malware payload", "value": "00f0e5e198c9a237c922438de16b87d52e6feeb3e915aa1ce8e642d2c7bd1d07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147239, "uuid": "698dbb06-e253-4d95-b5c5-d2b7ec435d7f", "comment": "Malware payload", "value": "9401303f197ea7e8e0e150880a82e6b4216ebb1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147239, "uuid": "bd69a02d-78f7-4c7c-af2d-6e0ed280ece3", "comment": "Malware payload", "value": "483030be682806f7e2c641b0ee2d09e726ca0c612cf43a4c6ea587b7c043da597137fb00ab34e0b01765dc450f8c9cea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147239, "uuid": "f1f09616-9db0-4837-ba79-fb98eaf31c4d", "value": "T1BBD3BF61F645AC9BD91442B15431C6B00750ACE003F7A2CBB4AEF3BC4AA7A907DEE771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147239, "uuid": "043582ac-1d0b-44c8-82c4-8bd4b830aa51", "value": "3072:Xhy9aU5REfZzsm2yMmv3pNGAi+WffSHJ3njq:xApcfZ4MvbGAmSHJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147239, "uuid": "8b5379e8-d614-40c1-a3b3-32fe7683a862", "value": 140111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147239, "uuid": "dbafb040-8502-43a1-8e18-34523c838773", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147239, "uuid": "63c2afa3-1ee0-4b2a-9f09-d2457c1df020", "value": "SecuriteInfo.com.ELF.Mirai-DBL.19271276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769982b8-00b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770093198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093198, "uuid": "1a5a0611-efbc-4486-9407-0ff6bc5b8cc9", "comment": "Malware payload (Vidar)", "value": "a0aaa027e802368ae5db8d353e1dd2b4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093198, "uuid": "01ee1f80-8e74-49eb-a616-926843fcf478", "comment": "Malware payload (Vidar)", "value": "01ccd0ad82b280d580a96fd3251363ebf3a5c3ed7305be2d397bcb8c7a110a69", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093198, "uuid": "64256fde-1c70-45b0-9b87-93f0c6b9a07f", "comment": "Malware payload (Vidar)", "value": "ae7ff00bd0c0e225fc5ed0c3cc2dc2eec49b0b49", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093198, "uuid": "6ff93f65-3902-4d3a-8dc3-9d9aee7d1c34", "comment": "Malware payload (Vidar)", "value": "07429d8946a4c971535d46c74093bf5c11e1744fc9ffcd10d44c35a00de2e93d71b34daa16cd4cd1f9a82652061dfe07", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093198, "uuid": "3f24e3fc-c3c6-48a6-96b4-8339d4ad950f", "value": "T15886297F729592A8C26D853FC0A3CF40F5F372761B33C6E7129107A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093198, "uuid": "423d8d52-48dc-4d17-9226-9b0656cc0c85", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093198, "uuid": "88712d75-d43b-4321-966e-f686c2fab390", "value": "49152:bNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgzQ49dpeMhveKd9Gl:bz7Vp7/Q49dqGswvSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770093198, "uuid": "0ff0c546-f552-4eb5-9163-4b653f43e0e9", "value": 8489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770093198, "uuid": "57c2457d-75d6-4ce3-bd2f-234e4e697408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093198, "uuid": "e96db29a-4497-4708-8dc7-ae88a6aa3057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a23fb0a-00cb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770100881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100881, "uuid": "3f6f2a06-c6c7-40dd-9e4b-2292f11b003b", "comment": "Malware payload (Mirai)", "value": "f494ad04a694682bd4ced6990d96c562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100881, "uuid": "c5404a7e-0a95-4a33-8325-d6bb558fd262", "comment": "Malware payload (Mirai)", "value": "026f9fe11902c66ec2500310ee75c00963a6c95db067b04784a4d23081231fb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100881, "uuid": "909364bb-31dc-4b23-a671-edd4e1f4045c", "comment": "Malware payload (Mirai)", "value": "47fb79af295ca36aae6e6753525e683b710cad0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100881, "uuid": "aa3c6842-e3fb-4f3b-b1b4-792e89791b62", "comment": "Malware payload (Mirai)", "value": "3550ada2138ab049cff58a323b49c588e4b2b69a84181f744f33104bd7ca9f09dd38c9c5eba8399cf9301e2561916db8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100881, "uuid": "0133074d-ccd6-42d0-ac7d-183ce71411d7", "value": "T1E0242A46AA418F13C0D627BAF69F024A3333A764D3EB730699186FB43B8675E0E27515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100881, "uuid": "9eaa8aa0-0eda-4be5-89e7-3b31c0390766", "value": "6144:/q3/sUmWaEcalRnfDcBC7axDwR3c3oznM/Rv6n/:/q0CsalRnfDcBIa0bzM/tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770100881, "uuid": "191a5023-f868-4ae7-8d22-b54b9dd62665", "value": 228291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770100881, "uuid": "acc5f3b5-8303-42ae-a62c-756e5a2dd2ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100881, "uuid": "d63f1b18-0a05-4bee-8058-a40e0b45b8b1", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58a89aa-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136790, "uuid": "6983ef82-83be-4cc4-9301-9425611eb0f6", "comment": "Malware payload (Mirai)", "value": "5c48f6205ce03f49f1f30c737a66e596", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136790, "uuid": "9831a0e2-a71c-4d43-b98c-1cdaa6602e1c", "comment": "Malware payload (Mirai)", "value": "03628e5e86666b838d3f804e1faa60fcdc681f8e12e217fafe1c76839c023933", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136790, "uuid": "a3d904f3-be20-4c0e-a09b-92506e58d7e7", "comment": "Malware payload (Mirai)", "value": "809c75db483de94651010db2f49e66a6e9576d42", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136790, "uuid": "3c35980f-1010-448b-8faa-d64af2c2b1ec", "comment": "Malware payload (Mirai)", "value": "4995edaad0a54719da09b0a120ac9f3b722fe78c550fd08623941bdcb09aa016cfbfbe89b971f00197bbb493fd59eb69", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136790, "uuid": "9e17f31a-9a1d-42eb-94d8-3006bced93bf", "value": "T1805191C432259BF4BFB15992B6F5440574CAE0D1AAC74FC9E2FC64FE014CF096C916A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136790, "uuid": "dc089225-6a73-4429-bf01-727de8e663e7", "value": "48:vzyuUoz3UUoz58UozHwUozBwUozdudzEUozoCUozR8UozKuUozLMUozH+Uoz7x7c:vzyutz3Utz58tzHwtzBwtzM9EtzoCtz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136790, "uuid": "3289f252-675e-4ade-bb8a-fdb39d9b5a2a", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136790, "uuid": "1f21f917-0634-44f0-92e7-de6f079ef684", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136790, "uuid": "e38d4e4e-1078-4db8-b95c-15f974140efa", "value": "zyxel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe24292-0110-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770130553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130553, "uuid": "99efe909-353d-494b-9d06-eaddf210c291", "comment": "Malware payload (PureLogsStealer)", "value": "f90dc743671d202fbfbb5d51e49e1e37", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130553, "uuid": "0937d77c-204e-4e4d-9211-980871dadaa9", "comment": "Malware payload (PureLogsStealer)", "value": "03d85c4472b08db3da18423284a72e6a315172d72dd1c6ba872fc0e78b4b6135", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130553, "uuid": "b4fc1e51-8201-4a8f-ae11-baea5abe6c7f", "comment": "Malware payload (PureLogsStealer)", "value": "a8d6dd317835506b4a1ec0cff04fd42e92ce32a2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130553, "uuid": "00bf3ab8-d678-481a-85d7-284831dd5e73", "comment": "Malware payload (PureLogsStealer)", "value": "f0ac65148598b145a0aade366670c8c2d4c32bf107dfefb7babc46183c2ef69bcd9d3b7df0109e78b88fd014336d7fb4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130553, "uuid": "7b9cfbf6-2ca5-4e22-b415-0efa9da86b32", "value": "T1EBF63304780F46EEE71146BD83B938F4FAA6BA249E7A477069FCA11737B543248BD344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130553, "uuid": "cfbcc6e3-34a9-44c8-a9e4-16072155b258", "value": "393216:oY1vqk2zWeSWSr1OtdKZWajTrIiifhIJeMC+JAAMs:Dqk2zrpSrUk6IJeM7aAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130553, "uuid": "244f115a-354a-45d2-9ea1-30bccf4da790", "value": 15448064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130553, "uuid": "2e69da28-b835-4cc9-be6b-c82ae22a1b21", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130553, "uuid": "4f8e5936-2da6-4f92-adf8-8280c2ba9737", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dc6267-00b2-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770090348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090348, "uuid": "3635d2b0-be64-43d2-a284-379a019ade93", "comment": "Malware payload (PhantomStealer)", "value": "5c534ece45f3999364dcb6a4d0f4df33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090348, "uuid": "d5ec052b-a15e-4459-b872-b484edf0358d", "comment": "Malware payload (PhantomStealer)", "value": "04c53eb6c67558ecfb59da6f38498776405570a4f1a99f61934a53173a40a36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090348, "uuid": "1b7a3cb3-be55-478e-89b5-7e7d0969fc69", "comment": "Malware payload (PhantomStealer)", "value": "dd7f08cf28ec363324112ce9647549622ec18961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090348, "uuid": "97bb451c-7699-497a-a981-8b16339a4516", "comment": "Malware payload (PhantomStealer)", "value": "2458bc70fa17a5c554dacce3cbbb5809971205fcabc2a59cceb4ec6f2a69fa03ab290dae136c33be006969493bb31dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090348, "uuid": "744a3d23-1294-4a3c-b9f8-675e025005fa", "value": "T1E994F1023782E54BCDEC0AB445AF92EF4E76AE7769868A53F2C0F75E7C752C57918200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090348, "uuid": "05bb7c8f-45ee-453d-a1c1-022690a881d2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090348, "uuid": "27e5554a-4d9b-4620-bf90-b5f3efcd38e0", "value": "6144:fQ606xV8H+lc7SGd7UP6Vk8YT1D2rxj85F75hvMMutRZYj2sEWIYlw7ZwjTtxrl2:UecGGRUok8lkkMKZ1spIYe7ZgTTl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770090348, "uuid": "64d0ba64-1b9d-46e8-944c-8b48e901bc50", "value": 436101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770090348, "uuid": "b03ab3d4-41b6-4167-bbe4-2264c80b2c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090348, "uuid": "34900e55-d7c6-4c35-8182-72dfe1be853f", "value": "Andenbehandl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174e8aab-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128686, "uuid": "eaf38b4b-34c0-42a2-a683-4da67358b01a", "comment": "Malware payload", "value": "1e93aa53d3a51120b702ba2b17b0745b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128686, "uuid": "70586db0-8071-42d4-b6f9-c0857203e432", "comment": "Malware payload", "value": "04cf839bff11a9a7dbc73062fa35588a69c8dc2fa768e1083dd5a39d193c1285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128686, "uuid": "60a4c994-a148-4267-b8ea-d45ad362115e", "comment": "Malware payload", "value": "398aee5f0f1cd4a321f4d03f605664ef668f541a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128686, "uuid": "9b143cb0-fa8e-409c-9b99-73ee59742a66", "comment": "Malware payload", "value": "d84e4a04301bb179f1d319444c246bc0745c5ad226a87377adb49fe43f0f9ad6ecdf607bf383eca31cadb6a1cb3ec718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128686, "uuid": "1943cb28-5fa1-4ec6-b518-2690829528e6", "value": "T1E37623EA354C33ACD01A87789433BD49B2B6511E46F994AE72CE37D077CF424898AB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128686, "uuid": "3a1b6a16-60aa-4d96-a863-718415570359", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128686, "uuid": "aaf37a1b-21ea-43e6-b90c-6deafc10a3e6", "value": "98304:b9yx0UQ4+31yiat0CxT64/ZZofYj687/Zko5PuN0/bVTiictyq4TpetZ3vex:UnQ9lyimN6y6fYj6omc2WZeCezi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128686, "uuid": "eb5b0569-e81b-489a-bc0d-6088301923c9", "value": 7780352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128686, "uuid": "ffc328bb-bb9d-4638-beea-44adab1a81ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128686, "uuid": "cb69720b-b0e5-4819-8b25-802bb8067983", "value": "SecuriteInfo.com.Win64.Evo-gen.19544471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d868fb59-0100-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770123856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123856, "uuid": "e00e1ed7-006d-40ad-a863-1f2b7be8283b", "comment": "Malware payload", "value": "eeaff0a4aa941b94435092263ea3d525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123856, "uuid": "27e1e4d8-900a-44dc-9be7-349fde370c0d", "comment": "Malware payload", "value": "055bdf30252b8b644c9c97caa5182f51acd7844be4fd4174361b5557a25c64a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123856, "uuid": "ebca34a1-64c1-443a-9d51-5947e163ab3b", "comment": "Malware payload", "value": "350f00759b4d4f45d1a3d76d7947161d2dc1af15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123856, "uuid": "de79e7d1-b6ea-42d8-9ea8-d293f67cfba7", "comment": "Malware payload", "value": "464b543181c806b02560d028d1534baf94dcbc200c70a122812f11de6b3b5cb07e9636790ef8c20414408a0782af4323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123856, "uuid": "c1e72c6c-9d7b-4c61-a58a-05f9d22f0e06", "value": "T1B5161B16E255208D68B783A9B60B6F73F36885111B1C5273E4D6C31F167A8B8D33B3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123856, "uuid": "d0f4c0aa-c6c1-4822-a661-408cda0e8d19", "value": "f72498c9c20a375af46ca0d4836f14ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123856, "uuid": "86498635-00a0-40a5-bf6b-b7a279ba2e83", "value": "49152:YeMRiqXjYgiLPX3du6PSlqcYkiVq5bJjf9I2HOwSLyxMVqa/0Y0H3hvpW3IfUgHM:e0DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123856, "uuid": "e5afb27c-9497-4633-b151-7cdea8010007", "value": 4143616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123856, "uuid": "fff98106-9a33-4735-b399-efe6bd6aee24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123856, "uuid": "042d1cd9-c1c3-4135-8781-679335895b6c", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88fa5f1-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131158, "uuid": "51b17150-d4fb-4aea-a9cc-c4a82842001a", "comment": "Malware payload", "value": "397aab88f43cdd48fff6f6b5d267728d", "object_relation": "md5", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131158, "uuid": "c3608c93-7f09-42a5-a3e3-34d7cdf228b7", "comment": "Malware payload", "value": "05d47dc5ac8847603c556f6e27ff874f08c15340121b77ff75d37149b614b7f7", "object_relation": "sha256", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131158, "uuid": "05e952a8-83c3-45ca-aec7-5a5b4c35661d", "comment": "Malware payload", "value": "2f1dc95171702af0fa1ca923c2915f5677566fd1", "object_relation": "sha1", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131158, "uuid": "9b4b3b64-2f5e-48cf-91d7-d245ab1ffb2b", "comment": "Malware payload", "value": "20479a858fc214f5f649555d4811cbba9fc665a549fb334ecc555d43be09abc0c4300e9f49a1dda5064389f3aa17825c", "object_relation": "sha3-384", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131158, "uuid": "fb237b1d-2ebe-4de0-b4c8-43b6a17b0437", "value": "T101073331B65F1584F19B513CC630EC7FA8304D95EE6C58FEB9A310746AF97090A7EA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131158, "uuid": "284d62ff-6f98-4d75-bacd-6e16a1f4bccd", "value": "393216:jQhDMC3Y5K2beyxXg90VHNLywOXI3uf1zmN/fbi6nYW0G2YbQqWkR17pYcJq+r+F:wMC3Y5xbIct2wOXGgtml26nfbQqW0zRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131158, "uuid": "96e7bf0c-b5c2-4638-8a81-378e000d5ebd", "value": 17298621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131158, "uuid": "be0a54fb-ab20-413c-80fc-fe88a8be912a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131158, "uuid": "3c9354d0-fff1-4f8d-be2a-da472604755d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57158b42-00e6-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770112472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112472, "uuid": "918f42bc-a3bf-498d-9d9d-64a72c9be39d", "comment": "Malware payload (Joker)", "value": "0c194a291db001bf969ea7c6f06aebee", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112472, "uuid": "240855d9-ed90-496c-8ed1-71836657f5aa", "comment": "Malware payload (Joker)", "value": "05f7af069efeee52101eb2e46e3c70da78e810929f03a2c071be5965b8fd8b1b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112472, "uuid": "bf072cfb-06d4-469e-b86a-de43bc059a7f", "comment": "Malware payload (Joker)", "value": "c7886cabbefa13f10ac0c161f890d122886b7a90", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112472, "uuid": "4779a590-ba49-43c3-ba3c-b5bc82d0d561", "comment": "Malware payload (Joker)", "value": "87f71d6a3ec3f7f7387f9b8d17bf00b3839a9b84e941559e67edf425ecf6e31f6bad30232500b273e99a49a97e92cd3d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112472, "uuid": "e87240fe-59fb-4d38-90a6-420332f8f3e1", "value": "T1AA67F146F60CC82BD9EAF07C9D8B07D3B8166C555B10C28B2925B60DBFB37D49A527E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112472, "uuid": "52b3f0cb-98a3-4ab0-aba0-d1343bf73970", "value": "393216:LHzhU+GDlzkXzvHl01YjcBnRlqqwR1rQxCuKrW701QCFkCa0++M7:zzLOkd0amRoqk1cFv4CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770112472, "uuid": "7bb1d4d4-4224-4ed1-8283-1c0a56f968b9", "value": 31016901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770112472, "uuid": "c3e71400-d0c3-45e1-99aa-9f5f8efcd7bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112472, "uuid": "0430cd79-bd69-4049-8cc3-f8123e4f12df", "value": "com.text.chats.sms.messenger_2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2279898c-0103-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770124840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124840, "uuid": "9d09369e-d4d6-43f1-a30b-72e2d9b9053c", "comment": "Malware payload", "value": "23312cac7ca1e6923ee47d52a56358d8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124840, "uuid": "f7a92b32-cffb-4aac-8f99-267e1627b8c6", "comment": "Malware payload", "value": "075a7c79550c6bd85582440e0c63bc0b52b37e789da844a1e45bba07010e3c6e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124840, "uuid": "9897d4de-1aac-4486-aeb5-3a999df2f1c9", "comment": "Malware payload", "value": "cb66e7ee612bc2b2612592afdff82e8b357a693a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124840, "uuid": "aa2a3d8d-1512-4b56-8a76-2fb2f5841829", "comment": "Malware payload", "value": "ce2d14e0ce8fa4f59dbdfcf45631e637f70f2c9940da87fc8cde7a651a7522d5643cf49676a8c1f68add1a43c9265d20", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124840, "uuid": "7776ecae-384e-4bdb-8486-76658394e209", "value": "T155E633D492A88AE3FC6301794696C13CEE76B12F9BB8414F9778C9193D973921C3BB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124840, "uuid": "1359cd77-4cae-4a0b-9bcf-65596a716284", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124840, "uuid": "b92aae22-e05d-4d1d-9cdc-690af982b8c7", "value": "393216:tsFl7dCR1C99pm+2A8W+eGQRb93iOb+0WLwRfdcQM:uFlUR1OaW+e5RZ9Ek2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770124840, "uuid": "6c1c3343-77eb-4f5e-89a4-1824c5450f51", "value": 14290272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770124840, "uuid": "470a53f7-b58e-448e-adcf-04766443bd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124840, "uuid": "29b4f531-60b5-42df-bec6-ddf09769b6c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13efce17-00c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770099045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099045, "uuid": "77bf85c3-cfea-48a9-a696-26e0cc045bb6", "comment": "Malware payload (Mirai)", "value": "1ef2523e8d15662200372857b7aad871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099045, "uuid": "5602a5e3-8bcc-4a27-af50-733b4ba58fd5", "comment": "Malware payload (Mirai)", "value": "083e3d5369c9e231725bdf7fa23fb6c20de8289700a37f1eb6e33808b060bf76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099045, "uuid": "0814151e-4147-494a-920b-30639aa1fc3d", "comment": "Malware payload (Mirai)", "value": "7c30ad29cea8c4f586c71af8340862109276dd12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099045, "uuid": "9c0f8c24-9a15-45f6-b2ab-a1b0e615382f", "comment": "Malware payload (Mirai)", "value": "f9320fe095b4fbedd3f827a58d3d30c8e2d00c681d1b51984f4df31873e75d381531fa8c5e076f68b13cc5ed11c1481f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099045, "uuid": "c569f00e-4b71-402f-8461-61aa746322de", "value": "T191D33AC1FA8784F2C917493060ABF73FE73195794135CAADEF88AE35CA67A41810725E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099045, "uuid": "50a45a4b-d991-4228-b706-fd54c2c8d13b", "value": "3072:2i79pDAs0QwxIAyIzAaF8WR6Xgjz3qRsRewbZn/:7pEs0QwxIRKt7rgpwR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770099045, "uuid": "2e9f32d2-07b4-43c7-8675-99000b9891ce", "value": 140648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770099045, "uuid": "9aeb8576-a9bd-4448-81cc-c952f0a71ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099045, "uuid": "ed7613cf-9bd9-4a7b-ae9f-1827c49aa04a", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b835eae-00d2-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770103997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103997, "uuid": "69d4b033-f9a2-43d0-b1a3-f77400e71d6f", "comment": "Malware payload (Gh0stRAT)", "value": "14d06bf0997b8b2757e656c51d486974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103997, "uuid": "5038c0bf-a2ed-4c73-81df-4415b48c85e1", "comment": "Malware payload (Gh0stRAT)", "value": "08b99583611ee222b5989af12eedc07ea0b39bd7af1bf68f04a8cc4a14ab47bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103997, "uuid": "653cde1b-e907-42db-a4d8-d4bfcaececa2", "comment": "Malware payload (Gh0stRAT)", "value": "1f4ee4dafd789cfd264aeaebcc67c35ef37e9db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103997, "uuid": "e4172cdb-7924-43e0-ac07-3cd841018b19", "comment": "Malware payload (Gh0stRAT)", "value": "b2d27b5cff85a44e4588ba5c4ecc3da99e0c89b3083829516a7f028fd05cf526cd3e8728ceeaad6158b4545d36c8119a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103997, "uuid": "f868d64e-b2c6-4484-af5a-83b0e23519ea", "value": "T18427337FF25C643EC4AF5B320873925058BBBA62AA6A4C2B07F0454DDF655301E3BB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103997, "uuid": "c6f4d28a-797d-4eba-8de4-038f676823ba", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103997, "uuid": "c52ebcb5-9e5c-4686-8b5e-5760c6bd2f5f", "value": "393216:FI974mW+tQM1puMWj3BcmXvS8K6V4JNof7DpSgiQGXkw6c809AiXAu0Mydtw7u0l:Fdm4MaHjRcZP0D5iHkws09AiXAuqdqys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770103997, "uuid": "a986eb4f-e7a1-4bdf-a14f-1fc9cd361161", "value": 22207162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770103997, "uuid": "096b634f-085a-449e-8ecc-5a9b8aa9da7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103997, "uuid": "f33098d7-0e71-457a-aacb-1002f205e5a5", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u97f3\u5305-3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9def1d0e-010f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130201, "uuid": "c04b21f8-5458-4a13-b832-12bca5d5c73a", "comment": "Malware payload", "value": "52701bbaac314287fd003dc67621029b", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130201, "uuid": "c73f647c-d191-4f3c-befb-9f4719fcd4b2", "comment": "Malware payload", "value": "08d6facd404ef88ad8a619774937205570a994e2f13a2dc277f5f81e3a72365e", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130201, "uuid": "037be44c-80ae-49b0-a24a-ba6dd15efe3c", "comment": "Malware payload", "value": "0408c9f651c930283eb91754da8daddb2e1ac5e6", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130201, "uuid": "4d0788fb-edc8-495e-a0f4-304559da9272", "comment": "Malware payload", "value": "6d7b23fb5d490daf74d5e01042c9cb0e15b19f571f911b9a594036d936d72131a3fed15b27efc323ae51785a76641469", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130201, "uuid": "65a4e04f-2062-4795-b127-d783f77cf21f", "value": "T1254733A5D237844BE83FE270EF69752C54B062279BB0C137E91109717CB3B919AF861E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130201, "uuid": "13394550-6203-47a7-8c1a-248c0ed5a78a", "value": "786432:l2jduHCudBN4J6TqRQ3ZWewtAtxYf6j8o9MyH0IHn:lgg3r4ZO3cDtVfY8o9MyUIHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130201, "uuid": "9c2d5636-63b5-4ad2-a615-5bc8dba6f84b", "value": 26690984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130201, "uuid": "c1cc5109-2fd5-44d1-8537-9b4ffb8dc194", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130201, "uuid": "cfbe9e2b-effb-4d24-b53f-d28ad2cbd648", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98ba7b2-0130-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770144501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144501, "uuid": "28126832-8dde-42f1-ab01-d37118aa1ff4", "comment": "Malware payload", "value": "9304de5b72a6325db8a44535410899bd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144501, "uuid": "08dc5aaf-e758-41a2-86b5-46d909af3d7b", "comment": "Malware payload", "value": "09ab7b452ec3b3396bf87a60b287426ce3979a56b6938974ec94562b32ec6dd5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144501, "uuid": "56d32b54-9d00-40da-8917-5adefb8a9707", "comment": "Malware payload", "value": "13f585dcf689e82c75de95ff758b22f1cd04d398", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144501, "uuid": "2b4fb9d9-fccb-437f-b6c1-7d1779f22704", "comment": "Malware payload", "value": "7e176ab1dbf1f5ee8023574b4b1080d6bc82f633c4ec1cdf64c158b748c5d9a18f45a23d8a6a791a9a33d81a3ba87ad4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144501, "uuid": "25ccfb3a-55ba-4e37-89ed-8dbedaa42b75", "value": "T16456F11773E800D4E16AA23489BBCA3AE6B27C55077286EF16E44D4F3F33AD51939721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144501, "uuid": "e971d8e7-7f9b-40c1-9082-3f35a90377d9", "value": "bdafb39cfee2e23fe0c8ae87ef4f1ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144501, "uuid": "fff07715-53b8-4f50-a902-f7c9c0d489c4", "value": "98304:clmzSzko24jCfHsCzdA8nwHQL4sUP0vLD6KDXDArFzTogZ0KGz/Z44TgeYHtqxHL:cstzdr1L4sUsTFfARzTogZ0K0B4teYaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144501, "uuid": "d4e45b81-3f8d-45fc-b1b6-fe7581403c61", "value": 5886904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144501, "uuid": "7e6b6e0b-9b5a-481d-9ab0-56115de7c82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144501, "uuid": "d598a083-ea5a-4e96-b78c-0301264770d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0120648-0137-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770147384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147384, "uuid": "586eabea-f327-4d3d-8325-f1cd5db6a5aa", "comment": "Malware payload (RemcosRAT)", "value": "76717f500d0dfeeea577a9129e1cbf20", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147384, "uuid": "bcc9bf4a-a0e5-4fee-b2be-b11bb9d111f9", "comment": "Malware payload (RemcosRAT)", "value": "09ada7462809e3bda60c9a809d09b69bce7af2b28c2bf5a4c90cfb275cbd9aeb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147384, "uuid": "1d76e071-157e-4ad6-8884-bc12f4574345", "comment": "Malware payload (RemcosRAT)", "value": "4fda78ece23c45c99ebf80e0e9b9574c35342e65", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147384, "uuid": "b3c7fca3-d9b2-4f71-9ac7-611411fbd155", "comment": "Malware payload (RemcosRAT)", "value": "558b0bb72a1504a54d8a96f0a21791ffefcf90f50454ec302a487be08705e549c581de3715fc676c29505195825ef500", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147384, "uuid": "39db3593-7c69-4e7c-bc51-938f3f9709d0", "value": "T16906F015B2C7C932D16D0277E969FF1E1438AEB3073045E7BBF4395E49B08C1A27AA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147384, "uuid": "6d4a8dda-56a0-4f20-ba2a-58b99287c036", "value": "49152:feMjkMo27Epq0n8Toc4Ug8r6F5mCmR+l+TQMShkkcr4u12Xn0UerjuLuU3vC6RQG:fYn8ToBo6nqrnAe2yRSf82hPQpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147384, "uuid": "c3874ae0-9dd9-47f8-977c-42a3834f22ab", "value": 3814912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147384, "uuid": "0744d976-8f20-4dc4-ad9c-457316800118", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147384, "uuid": "40df08e8-9149-4207-bdcf-80bf7067cb5e", "value": "09ada7462809e3bda60c9a809d09b69bce7af2b28c2bf5a4c90cfb275cbd9aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bce2b4f-00af-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770088724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088724, "uuid": "e9241d0e-2e50-45a5-b52e-b19df4f936c4", "comment": "Malware payload", "value": "f82649cd2916cf2f28cf450a7c1ca51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088724, "uuid": "9d4262c1-25d4-4bef-9e99-179d5a7b590b", "comment": "Malware payload", "value": "0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088724, "uuid": "af84f01b-30d7-4339-ada8-37d5c2788f8b", "comment": "Malware payload", "value": "c68d09dd50e357fd3de17a70b7724f8949441d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088724, "uuid": "7af94652-9913-4b04-a37a-3de5d6cd022a", "comment": "Malware payload", "value": "46b061b9548cd4cd1c48393da910171873cb5a2ea57bb5cb657e6fe5478eecd6780093b6f33de61822eecdae677554ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088724, "uuid": "fed08396-6a92-460a-be16-ee61544ea372", "value": "T1A334E677AB30115DDD2C1974EDB344C518E6EEA0881542FF379F3E188A3D892B9A6E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088724, "uuid": "85ca80df-429b-47f7-8722-a8861ad26931", "value": "ae951b25780a6e9b29742dd0463964e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088724, "uuid": "6a9f0052-c9e2-451b-a42f-80ee599fd4fc", "value": "1536:vx4Dth2p/rw09RC6IU2H7LacuHi8AY3HKZCAYOW2ExJ142n5QQXI:vIQ9yp3ajHiiHKZCAYOW2Exrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088724, "uuid": "f405c818-cef9-4bf9-980a-6794bfdd8aa4", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088724, "uuid": "00d61b03-2fdd-40b0-8008-cb4969e32af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088724, "uuid": "e10bf601-b5df-4d95-bb2d-e12ba23dcd12", "value": "_0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2031ac07-00d5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770105079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105079, "uuid": "610c7ddf-da0d-4585-be22-4a641e8b0729", "comment": "Malware payload (Mirai)", "value": "fcfcd5b39288ceda4baa5e62c565d67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105079, "uuid": "ee876fc5-b364-4a2d-af32-084d623922eb", "comment": "Malware payload (Mirai)", "value": "0c88d4ebb544bcd168fd5efd2857d5c952d81c131e606ce7226f70246799ac6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105079, "uuid": "73fbd543-684d-4576-a2ca-4cdd57ea8c8f", "comment": "Malware payload (Mirai)", "value": "fc47f4f8234cc743810d069dbffef70363dc3e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105079, "uuid": "fc3011c0-ca14-40f1-874e-339a1751f7a8", "comment": "Malware payload (Mirai)", "value": "9c16fb265940cf6948c13a67c7a0f31803f0938e22eabfc1b902579b25102b6696bd4565f3fcad8b4fbeb1090bd03712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105079, "uuid": "0676a7fb-b1ff-4f55-8519-b7d4e95afdb7", "value": "T11DD3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE59E28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105079, "uuid": "f5139334-9b9b-47b4-8d2d-8db9cc7e551d", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Z0a:yulo2ubIVv3sXL5NZmO0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770105079, "uuid": "08dfff4d-784a-4972-8546-ed2eeeef108e", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770105079, "uuid": "cdc2b393-22a3-4335-b2b3-ad27c7737571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105079, "uuid": "5a60e65c-f34c-4bd7-b315-8bdb1286ea02", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ac39ab-0138-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770147763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147763, "uuid": "ff438148-f950-4457-9d7a-a599bccd10a8", "comment": "Malware payload (RemcosRAT)", "value": "2171c21e0abae089031089fc8911db1e", "object_relation": "md5", "Tag": [ { "name": "185-157-162-230", "colour": "#38B79C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147763, "uuid": "46f87ab0-c637-45b0-be8f-160f64a92813", "comment": "Malware payload (RemcosRAT)", "value": "0c990d0491b82bf715373a50a2cd66db219c309bf1937d3147b0246e217e722c", "object_relation": "sha256", "Tag": [ { "name": "185-157-162-230", "colour": "#38B79C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147763, "uuid": "39262b59-6e4a-491f-9ca7-7f5aa1b09c55", "comment": "Malware payload (RemcosRAT)", "value": "c167dc2d558076251cecc0d0838f7a738661343a", "object_relation": "sha1", "Tag": [ { "name": "185-157-162-230", "colour": "#38B79C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147763, "uuid": "d8e3874b-4fdb-47b6-83cf-82b41820c4ff", "comment": "Malware payload (RemcosRAT)", "value": "ebe3637f80b9b3e2a6f854cf16b149ab3ba66e46babd691d562e6696c4ba05f5e2a18b95860623a6cf96a1207f32b473", "object_relation": "sha3-384", "Tag": [ { "name": "185-157-162-230", "colour": "#38B79C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147763, "uuid": "5d648052-af28-4bad-aa01-1793c2b20e8e", "value": "T11175AD15B3C38622C55D027BF459FE1E5438FE63073491E7BAF5399F48B08C1A2BAA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147763, "uuid": "29e68d4b-80c6-451f-83d1-e4e7a93bc67c", "value": "24576:EWfx/N5WSuPgAc8rGxYwX5mCmR+GuDTIINMhZe6vr8hCmYe49Z:EWDn8r6F5mCmR+Gu4WMjecrU9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147763, "uuid": "13d509ee-89a0-4ab3-adbe-6e5e29067f5d", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147763, "uuid": "69a3b8e7-8fd3-4515-96f1-989f1b9bbf23", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147763, "uuid": "8f7e70d3-f260-4ddf-9484-1eb7852b4bfe", "value": "dev.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df38e41-0131-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144723, "uuid": "78ad61bc-0650-4489-9941-bd5b9c1f3f10", "comment": "Malware payload (Mirai)", "value": "226dcfe477b4019516b6ff3442881a88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144723, "uuid": "e6f7147b-551c-4e22-9c8b-13ea2325bf8a", "comment": "Malware payload (Mirai)", "value": "0cce20071a014da88feb55d7935d8525390f1bb31cc8259018f57ed1bb1292fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144723, "uuid": "a06b4b1e-9bef-40c0-8443-ecfcaaf92112", "comment": "Malware payload (Mirai)", "value": "decf038fef76755cd0ccfb282856d4e0ca4d801f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144723, "uuid": "4431c399-b026-4cea-9174-393bba461f8a", "comment": "Malware payload (Mirai)", "value": "a196174668ac055f39426305cd6c121a6cb91d60036980156419c2b08211147badc811ce41caae38af54828baf042b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144723, "uuid": "64043e71-2d64-4c95-80b7-32fc160b363d", "value": "T17F9304756442F2BCEAB85074F40329E6265206093FDCD5E3AD87513BFF74788A22DE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144723, "uuid": "cc5f5853-2cfb-4582-a147-bd09f689a339", "value": "1536:zKE9xDDpGRXEZNInWNoXmmKYVBIVCCfy0K9q51ZJ2E:lpGRXA3aWmxuR5voE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144723, "uuid": "8c241937-cab6-46ec-944f-467d196b0e09", "value": 91912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144723, "uuid": "918f107a-e388-404f-8d10-382819d79331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144723, "uuid": "95832b6a-4ea8-4bb2-81f1-b606fc375ad1", "value": "mao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048cca9a-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143258, "uuid": "0d5c20e0-a288-4a42-a9db-3dfbce6fecb3", "comment": "Malware payload", "value": "225c450f94972cd174a2ad4810d69645", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143258, "uuid": "fe941b39-6097-4ea4-8896-596f5f84cc5e", "comment": "Malware payload", "value": "0ccff399845037ad4e724b5f10c219580aeaa9a656db4523697e63e54d2e44b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143258, "uuid": "42e767dd-a817-4062-8bb6-cb7a259f0358", "comment": "Malware payload", "value": "485b5e87de48d4b1ae5b0cf1fddef1bb445c7a25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143258, "uuid": "b052fbca-5e1a-4199-bbb7-be49f3e78053", "comment": "Malware payload", "value": "690a403cd6acd5c3facfbb151f6a09f168746483a038762fc0b20c1a72c07b4dfbdd379eb613e578e6083b04138f2973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143258, "uuid": "e4d7947a-9828-4686-b858-e0519ae70d9f", "value": "T13E040210FF0D01A3D4934E355E7B0B72D72D05A158BAC6AC5A0AFB1D1EB397AA2837C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143258, "uuid": "edae68d4-3201-41b2-a900-3ef25a790969", "value": "3072:ozdurayQy5HEcMf3ojST1C8SntkWMxaJYAaJuB6Y8+0Co7zVT0Ty9bWK1h:ozdurafekcMw2T1indMxKjaz+uuTyRXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143258, "uuid": "3a65be21-8f77-40d5-bcdf-f1cad2053a10", "value": 186166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143258, "uuid": "d411aced-b7ec-4420-bdbc-0a2001d94902", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143258, "uuid": "2d0b0b06-f8cf-4d71-bfdc-564bfc636ad1", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61230d73-015c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770163170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163170, "uuid": "cf622aa2-3a11-4858-9408-65ec545533dd", "comment": "Malware payload", "value": "66e4cb00321301f58ec62ef7ba0df1fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163170, "uuid": "e4bdbcd9-b9ca-45bb-b551-660bdaf6c1c2", "comment": "Malware payload", "value": "0d88c5f393929db72e529e56d7b0bd7102a060d589d57437040492fc7690763e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163170, "uuid": "2e318500-e529-4b41-8239-d173302e0279", "comment": "Malware payload", "value": "1201d8e5919f1e7073d182ba30ee73ab8d658b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163170, "uuid": "8314736b-7301-472c-8215-d3e519e4e63d", "comment": "Malware payload", "value": "2bfa949937119992792f93b4851678288d202345c0ca1d2be83b4fc18f27453e8879ad8877bf461d28982bb2795ed568", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163170, "uuid": "724b8c6d-1599-4df8-97d1-2e5e3f285832", "value": "T1187302B0E700A2728BE459F28D90574D3A629FF67EA5CA61A1308FFCB45FA71745C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163170, "uuid": "73805f06-2a69-44eb-9b43-6b1e3250ba41", "value": "1536:Uw6mi4dNEHsyF1x1os+IR3INMf+Q0zH1g2HVn602OZo:UMKsyF3/jhIif+Hz/1n602B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163170, "uuid": "65956590-f704-40db-acb5-89465e6c2226", "value": 76620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163170, "uuid": "f8030ae3-33c8-4fd6-b197-63f22897a35f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163170, "uuid": "5848f401-899f-4d11-b486-3e6108a73d45", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cd765c-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770101733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101733, "uuid": "4da71346-fbb4-459c-85de-9622646d71b0", "comment": "Malware payload (XWorm)", "value": "f8bb1b839c6c867d2fa6a3be79160a82", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101733, "uuid": "ca4db3b8-676c-4496-982a-285cc47e4693", "comment": "Malware payload (XWorm)", "value": "0ddf564c0265cbd758d09ec937b19be19b436a18533995da7d0f9af5d0abfbf3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101733, "uuid": "9cefe92d-a8ae-45d7-b755-5365d888e68c", "comment": "Malware payload (XWorm)", "value": "a42390958000c4bf1caf5b48c33440366e021f65", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101733, "uuid": "eeb03b98-f12a-4efc-92c4-44b82367d09c", "comment": "Malware payload (XWorm)", "value": "5f3630ddf2f98390036a0ac67b4214bee0df3632ccd8547053051bbd43f7f15b5e2be8e5b54c421ac0c3f3352f2d80cb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101733, "uuid": "6ffd76bb-ccb6-4033-a202-e45542c9a1ed", "value": "T175F192B8E97AF494872F3310A4E2E4C2105BC913AF7B09B4D59D14D56BA1214FFBC02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101733, "uuid": "b50904e4-5c1e-4a4b-bc21-041807064abf", "value": "192:a78cCoj5V/6/NBf7KoUEcQflYQ+hFeyJMRYVFwAObTG8v:a8oj5+xeOHlY9F1MRAObi8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101733, "uuid": "9fc02bda-bf6a-41c1-a658-dd91d3630432", "value": 7584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101733, "uuid": "32465de0-b035-4462-a6be-4c6d40a0383f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101733, "uuid": "14acba23-f949-4756-af0c-c27ea9de9eae", "value": "awb_bl_shipping_customs_tax_clearance_instructions_03_02_2026_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9124677-010f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130246, "uuid": "b7753ad3-105f-476e-98a4-0371e324fb48", "comment": "Malware payload", "value": "21d935b1552dbeaaad7854fa873bf74d", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130246, "uuid": "996e28f3-31f7-4748-bd09-12ee9ad5f007", "comment": "Malware payload", "value": "0e49481d65f0e104ca6aa6f0aa6660793933d6700afb3097f7c84135ef05efe2", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130246, "uuid": "966d1a9f-f7b2-4a35-945c-0e2afcbeb80b", "comment": "Malware payload", "value": "363d099f55b816943cfad1393334bea2c36fec93", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130246, "uuid": "7a0e58b5-4b2d-4156-80d2-8e550a638ea9", "comment": "Malware payload", "value": "5098f7312e10307ccbcbebddc40118f898b63acb8b20a4f42756cdee26e0e2ccfefce9e6886d98165ed64d84acf22b03", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130246, "uuid": "b4358d32-094a-4ff7-9f81-56001dbd9506", "value": "T1A0B6AE31E5459035E7AE12BE5EFA4A6A48B9EF1C1B7181C362847CC87A30DC3257678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130246, "uuid": "dd182823-4c70-460b-be87-20e1193a0ef8", "value": "d925af022d801d3a21eb63c20ea317a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130246, "uuid": "a07845ca-2a83-4918-8a7b-6d9610ea18f7", "value": "98304:UJXzcJK2QpHdvm5jHupMZ/6ZauGHYt5zCpa49NxRjKuN8Lfb9/E6xRwAM/qmTbn3:UsQpFKZDCzCoGcJE6xeB/qaxWmcTiH1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130246, "uuid": "06efda09-4944-4985-931a-78d0f55f7a86", "value": 10554544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130246, "uuid": "8113113e-f751-4519-843b-c8dd77868979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130246, "uuid": "b0e66fb0-53fd-4f88-ad97-1bb481402a3e", "value": "python38.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a213177-0123-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770138650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138650, "uuid": "52ee31b9-04c8-4d6d-a6a2-65ee26b86902", "comment": "Malware payload", "value": "fdefe73b31278a06d313db1add9a8094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138650, "uuid": "157af742-c0d4-400b-8c6b-775993b9486b", "comment": "Malware payload", "value": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138650, "uuid": "9de5bc7b-2959-4889-81a7-b79f24296df0", "comment": "Malware payload", "value": "55eadb1f29c7a0cec30e1d81880176dfcbf77968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138650, "uuid": "32c07b80-2285-48d2-9af7-484ec408bb58", "comment": "Malware payload", "value": "af7ca5328af513ceb9923892b112952f7f81bb21ab4e29e5d1b9e6dcb5c95a9a8d3b57b03df320c411431a97e607e82e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138650, "uuid": "c2d75d19-88ed-4ec1-80a3-0549de0454eb", "value": "T1CDF58C57FCA108AAC4AA93318AA251927B71FC491F3123D72F64B3382F72BD46D79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138650, "uuid": "e20b0478-5943-4577-a961-0791ad5cd717", "value": "49152:5mml296Fsr2htUp7nFyAGkOoDDoK5/kMQZv7v6ELOuJ7hZJmB1yL7yZEfWlN:5/66WHzNvH5Cv7BLOuJ7hHm8QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770138650, "uuid": "7284bce5-41a3-4c17-8f99-c9eaf8d08276", "value": 3361829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770138650, "uuid": "4de811d3-5e8b-4f34-9b1f-e389e7723d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138650, "uuid": "4230a657-cede-4540-adc5-7364b83eff05", "value": "adb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe47503b-00dd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770108887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108887, "uuid": "98d30cc1-1bdf-4209-83be-37c96de05d27", "comment": "Malware payload (Mirai)", "value": "26e567fd79129c7bd2b7c604b4525f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108887, "uuid": "70fe2ba5-8d19-4347-a924-416e4e78b94f", "comment": "Malware payload (Mirai)", "value": "0ecf63fc759032cf8413a97690ed035cec7631b3fc1d557baf7da2a8e84974da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108887, "uuid": "ed0741e4-460d-4f4a-8e64-f9e5bbf1d7a5", "comment": "Malware payload (Mirai)", "value": "a57bed9a7f36fccb33cae501c0d088627d126bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108887, "uuid": "e2790f4b-d28f-4da9-90b5-de98b29a0d4d", "comment": "Malware payload (Mirai)", "value": "de47796b606cb0dd57321871c3a920f0af31ed655b39317d590c9fcd91f7f9238533e18c3d0e48f313c1af9714e89272", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108887, "uuid": "0d9acf12-6273-4e07-ae40-8b627adf4a9b", "value": "T154C3F185FB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108887, "uuid": "2a8ee766-f314-4f15-8678-301c8c7aeb4d", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnM:eMQRtXU9kLCP8ifbxTnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770108887, "uuid": "c6300692-5c14-4172-a220-401a4508eb5f", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770108887, "uuid": "3749d533-119f-49a1-b708-553de497cc65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108887, "uuid": "ff1bfc0d-34e7-44ef-9f41-c96a0d17ca7c", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d42073-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139020, "uuid": "161c1bac-8234-4d16-ab44-9f4f34e4e112", "comment": "Malware payload (Mirai)", "value": "526861aeb262a1d36899e0c9602ba307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139020, "uuid": "b48137c0-a877-4925-8d9b-faed10bdb905", "comment": "Malware payload (Mirai)", "value": "101029d8c8630696543418466391e2a1167b7c40c11ac604d918e1174d7a07b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139020, "uuid": "78a2efe0-bc68-4242-9c18-a3635002e74e", "comment": "Malware payload (Mirai)", "value": "ade4b726af055eca396123127ff342f80e39a3df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139020, "uuid": "660208db-d006-4793-ad41-fb3aac0b3fdf", "comment": "Malware payload (Mirai)", "value": "2a91743f25d6fb1f311ef728c3b4011fa6efb10ebc65beb8575012d60b53aae53b7c0ee72b0b449ce5b6de141b11ed7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139020, "uuid": "44b9ddfa-51e5-4b46-ae33-bd39d438d511", "value": "T100438409BF604EF7EC6FCD3745A91B4534CC951A21A93BB66834D428F61B54F0AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139020, "uuid": "590aa608-8678-46a8-b9fc-423a5580f870", "value": "768:xzYpOR50a/cunYU72rHTnel1esYenfe6G7DvFZfdkXicOIqqpOR:xzYpOkU6/2ZY+fhG7DdZfdHq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139020, "uuid": "3ced4d3f-e850-40c6-aee8-248188afc1b1", "value": 55428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139020, "uuid": "f10baa7a-6f67-4c73-85bf-fb248089cd6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139020, "uuid": "2f831d91-c741-4c7d-96b2-7f8f31721ce4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890ac0d7-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770120717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120717, "uuid": "4e9147b5-b59f-4fe2-88e5-5b3c97aade23", "comment": "Malware payload (Vidar)", "value": "116ad6a26ff74f127a2f71c6625ea521", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120717, "uuid": "f7575c07-2bf3-4d19-874c-882368c2d1e3", "comment": "Malware payload (Vidar)", "value": "1053fbad095f13868d13cc7eba2a75bd9cb82449dca9132703fa0f153069f9ba", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120717, "uuid": "a9bdafcf-a2b8-47e8-91bb-340d0628b917", "comment": "Malware payload (Vidar)", "value": "a9d66db6d1998637d31c23f736d6b9d8dbdf4bed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120717, "uuid": "04382a78-582f-4050-8b32-ac132ec89209", "comment": "Malware payload (Vidar)", "value": "c33ee54883a6897166e1fad89424d2341505f3bf7d67618fa68810fc044e93f08b2f5f014606a24f6fe13442e25ee6ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120717, "uuid": "0c291055-cade-4a2b-a140-d93384ad3925", "value": "T1F486297F729592A8C26D853FC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120717, "uuid": "71a48563-047b-4738-84f0-968379068f6f", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120717, "uuid": "026a7b9c-caaf-4e05-9235-259577ccd027", "value": "49152:PNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg4Q49dpFMG8kCVn9s:Pz7Vp78Q49dV5CCBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120717, "uuid": "72483693-ec72-48d7-9a5c-3de20de4b8cd", "value": 8494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120717, "uuid": "6d6edfbc-38f2-48ca-85d3-7f97ca8f3281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120717, "uuid": "531d3bf9-fcff-4358-ad56-11dfba201e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4faf98-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101744, "uuid": "99ec7afb-1a43-4a17-a867-4de2669a123e", "comment": "Malware payload (Coper)", "value": "d2af9e50ce0a5247366b40d394d52da1", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101744, "uuid": "246d7ef7-f841-4b83-8931-545f2783ec5b", "comment": "Malware payload (Coper)", "value": "1077e767d28e8b97be3ebc98ceab110c14335260b47a3a0fdfcb77b6a2ccf080", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101744, "uuid": "dc39d12a-661e-48b7-892a-186e51d9189f", "comment": "Malware payload (Coper)", "value": "827eae96973affe208d1b08413d39e673f8d3e52", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101744, "uuid": "f93f9309-63a9-4e38-9cdb-3de57892b0dd", "comment": "Malware payload (Coper)", "value": "944b71e446c5757c95906123b59d8c83997a88ae5342736d36df9f1a45feb4d3ba7fc90696d5b6dbde1b1004af2adb98", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101744, "uuid": "1976b94b-af1d-444d-b128-5e13f4415739", "value": "T1C3451242F7C9CA23D4BA57384AA7C3E952347D40DF00466B6946B31D0D736D2CEA3B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101744, "uuid": "b188c259-f1d3-450e-bed3-0e93f4efc8b1", "value": "24576:WBsMgncanrgBot6EqCPlEA4nxTvZAvFIbh7JMudzA0Xn:WBX16rgo0CSJnxhAANPzA0Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101744, "uuid": "f5f8041f-c23c-43f2-85e4-49f909a6e9b3", "value": 1176803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101744, "uuid": "458bb246-faf0-41e2-aee4-428d3e7f2cde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101744, "uuid": "92c8980d-6437-4fc9-a3f8-388a2cdd8abf", "value": "1ce3004_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc05efe-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128642, "uuid": "d9a1475b-c987-4024-b173-797503600cdd", "comment": "Malware payload", "value": "f1cb1f593bf5a7156ba7e182f32897ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128642, "uuid": "ce3f7c3a-c959-4a04-b835-636c936d99b1", "comment": "Malware payload", "value": "1091791d3b3f42d135b0010cb24b8aa0afd48d07f1f91a7afc16213fbad74531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128642, "uuid": "8a8211c9-0c2b-4433-8306-9570ca47ac78", "comment": "Malware payload", "value": "5cc9903f8e4cc8d3564cbe5e1cce82f74f06423e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128642, "uuid": "224ccdd8-557a-4b4b-b603-622824d28dcc", "comment": "Malware payload", "value": "6e64cc0cde02681ff80ce137a313202331e4a4a4df7853d69dc276b7c7cc7fe5abe0b5f3fb4835c92df014a4e257a2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128642, "uuid": "d33e005a-e04b-4269-90ed-204c5fc377e8", "value": "T10A76226E720C33D8C01EC7345437FD48A1FA952E9AE9959AB2DB63C0779E810D90BB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128642, "uuid": "b158d200-93bc-4e83-98ff-a12772ba7449", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128642, "uuid": "4a62a38a-644b-4036-bb63-bd40f54bcc12", "value": "196608:GoHDaghYipElkBzdJQqOKwf2X35acbKVJaYmfS4DGpiw5P:rX6lk93QTKwf2X35acbKVY24DGpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128642, "uuid": "736c87d5-768d-4f08-bc69-f80ddf866e4c", "value": 7760384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128642, "uuid": "fb416305-4a20-4de3-a1f1-341393a52656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128642, "uuid": "583c5e6e-b834-48a6-8088-12ca47016465", "value": "SecuriteInfo.com.Win64.Evo-gen.31237219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2526be8e-0134-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770145889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145889, "uuid": "aef6d6d5-b410-4896-9bcf-461d1ff372ba", "comment": "Malware payload", "value": "55b6a68958ce593e8d3fc7420e234886", "object_relation": "md5", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145889, "uuid": "72b63a31-55ba-475c-8f4c-5fd879ec04ba", "comment": "Malware payload", "value": "10c6b812fd573728d2d8ef6d3b523fdc3393912f2e14d48965d9abf5212f89c9", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145889, "uuid": "dea3a7e3-9007-405b-a33f-ea25b73b1c04", "comment": "Malware payload", "value": "1eac64699086b8f146626d0291c41dcdf376316f", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145889, "uuid": "565e6d7a-5591-46cd-bf53-011af848a0b2", "comment": "Malware payload", "value": "12c10d88fc951a5571b72e7acbcd766ea6336214613186d20ceb700c69cddec663f705a232612c03ab9e75f83c3b475c", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145889, "uuid": "855af6b2-ae3d-4d0d-abd3-35187c83eaeb", "value": "T1EAC633323BD00342D26FBA3A5E2BD0B5D6231C4AB7EE1E952576F1D92C3562712423E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145889, "uuid": "c4db1a4e-e9b8-4a1e-94f9-0128fc279c0a", "value": "196608:iQeJKrv8vgWATQgs9xGrxB0bWt9rZ874T4LeyIil++FqlzMM:iQ1rkoWEixGlaG/1yxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145889, "uuid": "3e036d29-67df-437b-bebd-72d954ffffe8", "value": 12017664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145889, "uuid": "5fadfbb8-8dfd-4485-96ef-5a8ab3a776d9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145889, "uuid": "8730e110-407a-4fb2-9809-c591621f11f1", "value": "WZOVINHP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2be378-010c-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770129070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129070, "uuid": "e67c2e13-33e7-449a-a50c-cf8e370c790b", "comment": "Malware payload (Smoke Loader)", "value": "d40756e973f6eb0e94aec6844289be7d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129070, "uuid": "343b73ec-ab4a-4e68-aa1b-a30b55b0dce1", "comment": "Malware payload (Smoke Loader)", "value": "10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129070, "uuid": "08b091cd-faeb-4fd8-8787-608131e5a0e5", "comment": "Malware payload (Smoke Loader)", "value": "88757825cae400b38859489f08853fd6a0828086", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129070, "uuid": "f9fcc8ac-01f7-4aec-b4d5-76a9acfa451d", "comment": "Malware payload (Smoke Loader)", "value": "b2beb96f4422e77c26c911c71576f66ce05f4e0aa02b9b68b34b784f41779367c81b7482e21f0a113b0b528d78d3259d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129070, "uuid": "58ddb917-494b-4a7b-b086-4425a21c4543", "value": "T1D526D0933F9E61FBFE4A21BD8014B26B969CFF7E46A50020E4D8584B5C470D23E1E95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129070, "uuid": "8138f4b4-12dd-4bed-9763-f5d7ecdecd66", "value": "ae25b895c4627a172cd21c19ce29dcaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129070, "uuid": "f1b021df-abd0-4953-8353-44ec24ee4e64", "value": "98304:N8NDqaezr4Tqe7SaeO1ACFwkaZ9YuScU0dJPOhyhg:nzu7SDHOnKfEhog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770129070, "uuid": "837d7c32-243a-447b-b31a-8558e86597bc", "value": 4822616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770129070, "uuid": "74b946f2-e009-40ea-83a1-48999ff7cf85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129070, "uuid": "2504b065-465f-4331-b52c-6ecc6ebd45ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818137d0-00aa-11f1-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1770086774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086774, "uuid": "f488b6e5-91f0-4b53-8bc4-4ef164efeaac", "comment": "Malware payload (MeshAgent)", "value": "206cf4271bdbc0dc4f78f6b317ed0df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086774, "uuid": "bccb2497-b67e-4ac0-8522-6db56e4aa2e1", "comment": "Malware payload (MeshAgent)", "value": "113b43743498db3c8e12b6ba34b7d12069fb8763968178b7e79f256916bb0317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086774, "uuid": "6fc22798-c450-44d2-99a0-acd7dae1aee3", "comment": "Malware payload (MeshAgent)", "value": "7d5101fe6fc3f8b7364ea6a3249ea101f72adef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086774, "uuid": "f1c26ff0-9315-46ce-80b2-546813813df0", "comment": "Malware payload (MeshAgent)", "value": "88e097b20907e2838e5baee101650359e00f7cb2dbfd6bb9a5a227f31f3b3d3d5aa449d4d40beef3b6290a3bb1942ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086774, "uuid": "ce9d7e71-7ff5-4860-90a1-5790bfd2b702", "value": "T123F58DD2A3A600E8E9B7F23C85568517E7F2B81753709BCF15A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086774, "uuid": "b18893bf-2848-4d4e-9f57-ca55e9b40521", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086774, "uuid": "8eff267a-c295-413e-86e7-a56aec981496", "value": "49152:odZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bd:MHvfGfZvZj1/N/z/owJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770086774, "uuid": "2dcbcb5e-9b5b-4448-8cbf-fd95220ac868", "value": 3482296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770086774, "uuid": "f84f71c5-231f-47c5-9ca0-823654ef88fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086774, "uuid": "bd948aa5-1eec-48e6-b86f-1f3c24161429", "value": "meshagent64-GA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430784a9-0124-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770139068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139068, "uuid": "33b6a2a7-e2b3-48d6-913e-a66c802c82e2", "comment": "Malware payload", "value": "c3145d468b897cf545bdc709ae4102b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139068, "uuid": "96f8923e-f93b-4ffd-848d-f1a2b8e6db20", "comment": "Malware payload", "value": "11dc7d01c571400ea915deec25794dc773d2456a6e7487685d998fbdad5662c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139068, "uuid": "5f086c8e-92bb-4425-9ed7-4f9888dd48e9", "comment": "Malware payload", "value": "f15c973c863c45ebdf23d55ca9d53dc257ac3518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139068, "uuid": "737f0307-a611-4690-96f5-4b94757e3700", "comment": "Malware payload", "value": "a7335ac5c9a9f9798ce1f1251b30e3974e515689c490fa5cc3c097c20865468f043c9412fbdfd6ca2b5e1b1634a1364d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139068, "uuid": "9d6268bf-d057-4acb-a22a-f6c588e65908", "value": "T1CC03F685B8858A06C6D0237BFE0E83DE3B2673DCE2DE7303DD152F51379A92A096B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139068, "uuid": "01b00d6a-0a49-418a-802a-dd213bd810cf", "value": "768:Y29DHoNLgoaYEH7a9q5nWg1dQ7Q527QnbepWdQjwpKoz5QY3lWfh5i:BwgYEHQkdWQ5kWQ0pKotD1y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139068, "uuid": "68621f68-7e5f-4dcb-a980-b71e6f971dbf", "value": 39760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139068, "uuid": "eaa709bc-4ea4-4adc-b5fd-2a455fd0b70f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139068, "uuid": "6f94ffd1-a401-4c4a-b6b5-eabaf4460af7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f5d08d-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101736, "uuid": "1ab7f8b7-31d8-499b-8833-1f8135fcc526", "comment": "Malware payload (Coper)", "value": "a933cf37dc0ad5b39ccdb22cb2058679", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101736, "uuid": "d2937b29-657c-4f02-8847-00b20392e259", "comment": "Malware payload (Coper)", "value": "121e82504dfbada0fd5cec2bd6bec7a518f8afce65b43ded20498f3f5cb5c05c", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101736, "uuid": "e92fc452-31de-4eb2-b4e2-064998a4d6a3", "comment": "Malware payload (Coper)", "value": "5d8b18f42cb0f0a5fa9aaec2f87272f380b41b53", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101736, "uuid": "8dd51a2e-8c1e-4d44-8389-da866dcc8871", "comment": "Malware payload (Coper)", "value": "24d6da25b4809d5d553c3cfc26e42dee448971ec6418851f3e72c9a8275fca282cdf58e2a4a12d3bb46f06734675ce1e", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101736, "uuid": "07528a3f-6f2a-41a5-9a22-f362e675a026", "value": "T1DF452202B2A8D517E4BE5B344D06C2E5AB35BE14CF41A3A72A42771D0CB17C2DE63E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101736, "uuid": "63f44cb5-4f7e-4979-8775-2a65245dae4d", "value": "24576:yBnVCUr33Pz7YqLh1j3EtT7kyONGWGHUhH8G6MtVopi+Rja:y/Zr33PzF3/XhHrtAtja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101736, "uuid": "0e751080-8f4b-40e3-b20c-eb3464b93251", "value": 1172719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101736, "uuid": "353d0366-d1aa-40bf-9a36-906722468bea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101736, "uuid": "b07480aa-2c57-49c4-813e-f57d37fb38d5", "value": "00bf7f1_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51535892-00b0-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770089270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089270, "uuid": "b77103b0-e822-444f-8e3c-cd498d5943cc", "comment": "Malware payload (Vidar)", "value": "106ea30c71584c75bd2d98cd6892f577", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089270, "uuid": "42b9288d-9627-4e58-bd58-6419d7ee8e73", "comment": "Malware payload (Vidar)", "value": "125f8a5aa70326e6d78ba786626880292bfecd94248e7f85241e1b746299b9a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089270, "uuid": "a97b9e2c-f59c-4914-99b7-1e56fba9324e", "comment": "Malware payload (Vidar)", "value": "a31aff9650c95f4618b27006994fcbc8af16ab69", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089270, "uuid": "4137b0ac-93e6-4a34-b9ce-1e66dc5ba280", "comment": "Malware payload (Vidar)", "value": "1225a957c025afd86bee2fb1118ee94ebba8d08cb50f9f128debeb576ccc9b569b0c65974b20f22b2a9e68707a618b51", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089270, "uuid": "ada7d76c-2841-454e-be81-e4a68fe3ceb9", "value": "T147862A7F729892A8C25DC53FC0A7CF40E4F372761B33C6E7129107A98A469D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089270, "uuid": "871c852f-a59b-4f94-9844-57a59bcc44b5", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089270, "uuid": "9cd061af-3a46-4aa1-a23b-b2fcb91bdf9d", "value": "49152:mNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg/Q49dpwM9PiLQnQN:mz7Vp77Q49d5IZCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770089270, "uuid": "07d597b3-adb3-44c8-9d90-360a4531153d", "value": 8568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770089270, "uuid": "24e82ee2-ddb0-425a-ade3-cb04af14a000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089270, "uuid": "0945d65c-44ff-4306-afe8-2bdd8f66b99a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5302cc0-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770101866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101866, "uuid": "87d5787a-86fa-4620-853a-3b63b4d59711", "comment": "Malware payload (PhantomStealer)", "value": "cca89d58eba735987d3d64a0d0efa737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101866, "uuid": "06f05d3e-be1f-438c-a008-a49faf512ee7", "comment": "Malware payload (PhantomStealer)", "value": "14c4f2a8842fd8f1a9df003ef926ecb551481c36b46f770dee563d12bcbc2baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101866, "uuid": "43950c28-d770-4555-b26f-1642308f6e22", "comment": "Malware payload (PhantomStealer)", "value": "e07474fa578ba290d3871dacfabcdef35180c7dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101866, "uuid": "918eb29f-0f18-4e44-bf48-c19b30d9c69d", "comment": "Malware payload (PhantomStealer)", "value": "c4dc8066cb0f42958a5b1ac752dd8d10b532cc9691cfaa4f06def61dfaa330eff63155e32fe084f63ccd3922ff8dc44e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101866, "uuid": "bea1b59b-8b94-43d0-8ca3-eea99e99d8be", "value": "T120A4A316EA60752AF89745317D79A257341D3D372A80EC0BB7889F8A3671A87B0F431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101866, "uuid": "419e133a-d3a8-4428-9172-d76930248ec3", "value": "905165adc716d4d9f00e44ad2c1f1a90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101866, "uuid": "12adddbc-b276-4ab2-b38c-1d824d8db0a7", "value": "12288:3cyCEVI8qekLmEQZ28GDJqO5vwZGUV+ndv9s0ifsohZfU:bI8qe0qOEMtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101866, "uuid": "ace2033a-2374-4071-aa4f-6ba050ce446a", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101866, "uuid": "9f91302e-ec3e-45c7-b683-5b659009db88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101866, "uuid": "23ac9d04-83b8-4c02-af9b-47c8a7e6c014", "value": "friability.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b865222-00d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770106950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106950, "uuid": "254ef257-9e3b-47ff-beca-6586ae7baec5", "comment": "Malware payload (Socks5Systemz)", "value": "728dbac863ad3360901e75782f5044a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106950, "uuid": "8617f89f-0fef-4185-821f-7f44a03d8671", "comment": "Malware payload (Socks5Systemz)", "value": "151313dfd483dd1b8395b29ba54dce50c2406c349c018ce722243b8083cebaca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106950, "uuid": "38cced73-ba6b-4d1c-b7a9-85515cbacbe9", "comment": "Malware payload (Socks5Systemz)", "value": "8e40a9ae5f00614183f16063c2bbcf1760e08807", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106950, "uuid": "8b535111-c956-46e3-a803-6c9f70e46a2c", "comment": "Malware payload (Socks5Systemz)", "value": "5047f4724bed8d95c890c48798c7489134bd2970b81eb76f897b5549f8b84d95a74012434ffa21a85c694671a7c04a8e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106950, "uuid": "c3d6097c-61d6-437e-92ca-74093a7f8558", "value": "T1420633108061887EE085E67A9F66A6E6F97734CF0475020F36BCAE2C6F276D964133D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106950, "uuid": "6430224a-9c09-4c11-9799-3efbb5756bbf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106950, "uuid": "58781f68-5379-4eaf-9dc1-95c8df024731", "value": "98304:M7HBHaIHTy+SHPAurJZ6dIyEm/cpPmCYXmlV:Mh/TXSocSSm/cuXmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106950, "uuid": "21f08223-1520-4a48-b4ba-bd88679b885b", "value": 3760121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106950, "uuid": "3d0bde16-0e31-4595-8e48-639c5339829a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106950, "uuid": "29927d94-ece7-4264-bd45-1f4b18c49c30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b008c7-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128662, "uuid": "fd20597d-a24f-419b-b228-d04064c10988", "comment": "Malware payload", "value": "76c32d70bf23178e76ac791cb752acbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128662, "uuid": "5203dc11-a688-452b-b50f-0a1a5fbbda84", "comment": "Malware payload", "value": "152315d5aa12cbcf3287d372641756edfe718c75014cd17320438329b0104137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128662, "uuid": "a70c7395-bb8f-4695-8a23-d7daa0caf0f3", "comment": "Malware payload", "value": "19544fccdc0acaa0a2fe92aa5f18d66b9a8428ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128662, "uuid": "9a7aad37-ba0f-4b86-84e4-e9bebdcd98d5", "comment": "Malware payload", "value": "237aa9ce9e0b466e8031947da456e9269a45e5ec834aa8ba4657fbb4c1a9b7c5d487631f5a7c04fb43d931cbc98aca6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128662, "uuid": "9dbc966d-421f-494e-95d4-0d9fd4728838", "value": "T10976239B250C33ACC41EC3789433FC5572FA561D0EEA56A972DBFAD4339A810D987B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128662, "uuid": "493dd6c9-41d7-4d5e-986b-1b833d34b8f8", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128662, "uuid": "480b0a76-ea71-49a5-aa5b-d8fbd4964abc", "value": "196608:RYO261AX0KFyazX1t/qEkZ7R6MB0bK+7U5w3VoJ0Sjbe1:Rh264Fy4ZUQUZjbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128662, "uuid": "db74b88e-13dc-4353-8686-51c397592f0d", "value": 7768576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128662, "uuid": "14ef3d31-e960-4523-86cf-9aa97f792d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128662, "uuid": "d1ac1726-34b1-42d5-9e1f-8803fc0cd791", "value": "SecuriteInfo.com.Win64.Evo-gen.86451715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d483d59-00df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770109530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109530, "uuid": "6519f50d-946d-4086-8d1a-c8235050dff4", "comment": "Malware payload (Mirai)", "value": "c2ebd68aa7d566172eda9a6ef70a0642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109530, "uuid": "45328b27-14ef-4827-89a8-491254075baa", "comment": "Malware payload (Mirai)", "value": "15655395472f4b993d9f64d73ad384ef6c9b339fe3481f2b7ba437f5c5f6acd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109530, "uuid": "e0556fde-b5ab-4432-a322-88dae44a3915", "comment": "Malware payload (Mirai)", "value": "7dec90fb5ed036dd4644cf62ef4c5dbd4e6341d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109530, "uuid": "fbdd6b5a-5937-4ea0-93b3-d10e0382ba3d", "comment": "Malware payload (Mirai)", "value": "0bf11b6e2913caa1310f1ad3f16d616fa41b5e2d676829be4dc760bec72762be4e8696d63f5e438a61d5bddcce0b7b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109530, "uuid": "b0995505-71d4-431f-821b-d518e0403661", "value": "T1E963017873EB8434E0DDA931264F22303371DB96A42F53DA3D89B5E9F6565980C23F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109530, "uuid": "63582e26-2f88-4a7e-9dc0-89c61988a7b8", "value": "1536:0ltrI7mDmde7Lletk8cghgLFPjihgulh6DoIGmrPg:0l+YmdkLMk8c5PdulIGmrPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109530, "uuid": "0074c8a3-f192-4301-9d65-6b344e499ab6", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109530, "uuid": "908c5758-5532-4812-94cd-329f5eab5ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109530, "uuid": "1cf7086c-8e50-4c8c-878a-d06a21ba5d4f", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abedd909-0140-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151269, "uuid": "2f388d34-b9e2-48a6-8696-760d75ed3258", "comment": "Malware payload", "value": "43d1d91a38ea1fac5818bc914c7ee194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151269, "uuid": "1449616d-2943-4866-a76f-ffc8052a5cfd", "comment": "Malware payload", "value": "15ca6ef1cde23f604788d40a2e9e406f2cd841181b2b7516488cccbcaa7610a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151269, "uuid": "768df91b-8172-411d-9e18-6ba2662c989e", "comment": "Malware payload", "value": "a289d87c989f7161e759dbe63e4bd407a1bff35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151269, "uuid": "0683bbe6-5383-43f7-9a8f-66de20bc73b5", "comment": "Malware payload", "value": "8b3c5ac8c1a2a4153f4a624fe11305ded6821b74d368ab7001a379d33b5556afb39d9404beed5219927a48a2f0fa81fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151269, "uuid": "74e7b510-995d-449a-b8d0-df9507ae4f49", "value": "T1D5E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151269, "uuid": "572c804e-58d8-4cf3-8894-c1e19e02237f", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151269, "uuid": "a7d38d67-d2ec-4cd1-9374-52e125c716a9", "value": "393216:ryF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1j:6rRxvoC/7a0jUxX7h1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151269, "uuid": "e1b853f6-71d2-4d8c-a46d-468ce593bd83", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151269, "uuid": "f98b5be9-06c9-42ae-83dd-99b0eb2f716d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151269, "uuid": "dc95ff3d-9977-4d0e-a2b7-77143274d291", "value": "FicheiroOr\u00e7amento.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ed4a58-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136792, "uuid": "52b70724-185a-495c-b7ad-bde754e55e19", "comment": "Malware payload (Mirai)", "value": "528e8ba38fc34dd65f3e2d8655f37a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136792, "uuid": "752ef17b-fb90-45c3-bd6a-7642a1c6b4f4", "comment": "Malware payload (Mirai)", "value": "15e6aeaf5318f5dfc5a8967fae7ba080762d73082f16f7666bafffc08ba90f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136792, "uuid": "af29ef94-b0ab-4477-9f9c-acd3dc5444fe", "comment": "Malware payload (Mirai)", "value": "dc8cc1c3cfc10ff407cf2471725c7df762dd6cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136792, "uuid": "f53427c1-a379-4c40-ab98-6f8dbd244a82", "comment": "Malware payload (Mirai)", "value": "34e8e4defa88aad3f85c8e9df767de605be26d5f8951358325cdf0c9418f5a02bc7e59229f3a1359876a3696ed47256c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136792, "uuid": "3f8bfa4c-c854-42d4-a06f-b40af3e89ba5", "value": "T191735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136792, "uuid": "f97a4515-5146-4e34-bbf5-03c9fafd379a", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8B:YwfdNu4cmZvFqI3w7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136792, "uuid": "ca49aeb8-ea39-4796-998e-c965308dd9be", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136792, "uuid": "94f66390-b9ea-4101-9ece-14de53378fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136792, "uuid": "c48bb350-e15f-4b71-a6dd-e082131e80a7", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b038722-00e8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770113365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770113365, "uuid": "25bce17b-284c-4680-9d10-b19cba861457", "comment": "Malware payload", "value": "166c6d56666f459ea9784b550631c6a0", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770113365, "uuid": "e607566b-7731-4b6c-b970-3c532a009a60", "comment": "Malware payload", "value": "1942b8e87183ad52259060638ea36052cfbecdeae45c01879c0f4d22c044dca6", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770113365, "uuid": "330c6638-9bfa-49eb-ab86-0408c133ae25", "comment": "Malware payload", "value": "00555d6d65ba015a6365c1245cabd6d90cf784aa", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770113365, "uuid": "ef8a6ecc-891e-4521-8c00-a160d4bcd9a2", "comment": "Malware payload", "value": "e184a1b9a9b088d5173e75a17036db178ab8a9393021ca47d13aac038b0831155773ba545743692d4af1271d3bee85d4", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770113365, "uuid": "e50d3e4d-d2bd-4e9b-b9df-e91b78fad9da", "value": "T1BC283320B96A99A5EA2FA37FE0A8DF5A40707DD03337D5EB63783F9589B058111B1D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770113365, "uuid": "9c73a9b7-ccaf-4751-b82d-2199d3b84b3b", "value": "1572864:FyGuijRz386a8wiQoxTGBXQ2xohdsQsQS0pHlxuRXFGrm/qhLInHMuKGf2b7YUkT:TP9zsZNiQoAB3u1HlYGrdIHjKi2Xha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770113365, "uuid": "eb1b4fad-b3ff-4bc7-b2f0-c40b0ee9f73e", "value": 99096064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770113365, "uuid": "92aa7eb2-e22f-4cd3-98ff-f59f0081cfd6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770113365, "uuid": "ff3242b6-0681-4098-b880-05304d080f8f", "value": "chromasj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ca166c-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140169, "uuid": "e4762362-d330-47ea-b5af-2114625ef86b", "comment": "Malware payload (ConnectWise)", "value": "0c30ffc586068f85872517b4fa9b5003", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140169, "uuid": "0480bdcb-aac6-47df-828e-b493811fa8be", "comment": "Malware payload (ConnectWise)", "value": "198811e87e0a54b6bae3bfff028ae94fa4c81574ce9f54b9f2150414578cd825", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140169, "uuid": "c6788235-33a2-4210-bca2-ebd94492e457", "comment": "Malware payload (ConnectWise)", "value": "a6898477dd486d985ccd66e9ff05e129c706db2d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140169, "uuid": "95a9c32b-12b2-459c-85d8-79dcd014ca74", "comment": "Malware payload (ConnectWise)", "value": "a43cae454cf25c9e1db1494eada0de06d627df4a0d10cd804b0b1da9c60b11a8b1c5abe12cbe6515b78675945ecaded3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140169, "uuid": "e86b6167-b5ad-4881-8435-4e5e1ee7f3e7", "value": "T130611169EC05EA355132C2037337790FFB6254AA191161247E1ED446CF347BEBB6C58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140169, "uuid": "7e62e78d-b74a-4830-abbb-3d2022617a44", "value": "24:yXKc35FgKZhs3MOzBHlMLoy3VcU4dy56Y3OMlpAr/tkSVRUFOBXkBMl/nuuqCt4x:EKxRcOloo2DCi/pAr/tXrGR8WeyaGxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140169, "uuid": "e8c6226e-a101-4fda-8294-dc38bdd131f0", "value": 3470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140169, "uuid": "2f0068bc-1820-41e8-af3d-e5be5b4ecb97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140169, "uuid": "90ad9ed6-ef76-49cd-abc8-62575427ae9b", "value": "invoice-3675780.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343f1565-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120574, "uuid": "4f5fda99-5533-45a8-9355-e5710dd17ba1", "comment": "Malware payload (Mirai)", "value": "dcc9ddd330bcebfae58d2da3c6ffb757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120574, "uuid": "cffd5c5c-ba5d-4dad-a7b6-5ef6cf577514", "comment": "Malware payload (Mirai)", "value": "19ec1515e9e41398425f0d08bab481eb2247046820da8d0bc9a7ad5e8c9cb5aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120574, "uuid": "1f85e122-b820-4a2f-b5af-2788b9f1453b", "comment": "Malware payload (Mirai)", "value": "d5fd098cfce9b46bc7340a9a6da2fb79d715f207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120574, "uuid": "2fc22be6-a275-4042-844a-ce5c35c856ee", "comment": "Malware payload (Mirai)", "value": "a8b4906286579c84ddc48e56fb9a4f22c05177760d824ee10f06bdc2cfda6b5fefee29321944e7f4d6115a747c21ed3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120574, "uuid": "01644edf-22f6-41b0-bbd7-f1e00a56d2a4", "value": "T143635B12E87D1E17C0E4A47E12B78B6AB3F5264E18A48BAD7E710F8EFF105D4B506274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120574, "uuid": "bdac1129-8c9c-437b-800a-f470d6857577", "value": "1536:8ppNNR6n0CnnTbEU6ct6/ITGRpvZaAacYmCiF:oz60in7epvMmYmCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120574, "uuid": "782ed3d5-d96d-4435-ad6d-f8571c6c154e", "value": 71624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120574, "uuid": "6cf83361-6f21-4668-b138-a908fd83c1ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120574, "uuid": "d4df2b0e-7bcd-4577-a691-423e5cdda382", "value": "mao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6d43f5-00dd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770108782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108782, "uuid": "2da6adbb-9558-4f42-baf2-e9ad90223daa", "comment": "Malware payload (Mirai)", "value": "52e8f52ea25042070b739c3ab055339f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108782, "uuid": "c50866f0-dde0-480a-abfa-3d637d5c5736", "comment": "Malware payload (Mirai)", "value": "1ad9cfe15013414660701e28b5ca5c44df8d0355c80e5b5f53bf2525f93ac46d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108782, "uuid": "edacf6e0-6e85-442a-bc4a-260799881960", "comment": "Malware payload (Mirai)", "value": "f0dd0753bf15364b1120e7caafa86fdfd4284c65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108782, "uuid": "7d157b12-596b-4d24-9738-54c4d7613719", "comment": "Malware payload (Mirai)", "value": "8de7a38c2709e3663674e94185bf14ce2d81a71144aa67a27fe75993de6401e1c6f0a586d182f464bdd6487e27e5d330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108782, "uuid": "84bb4170-6219-4828-8420-b9d5e626100a", "value": "T1BD5302271A64C02ED475CA370E1CCC61C77A4158AB248657E66AF6AF3E81E05F490F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108782, "uuid": "55bfff4a-7653-4435-a155-640ba4ff3e1c", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshPoAQf:cSn9jaBybw6E4yUu707bhPjQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770108782, "uuid": "f225b9fe-04a8-4952-843e-635504008f56", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770108782, "uuid": "c2ab4512-02ce-447a-9491-0a9a3075a64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108782, "uuid": "09a124d3-0900-4e5e-b8dc-d45dbefb3c6a", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fec10d-0137-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770147340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147340, "uuid": "8dd45b43-520e-45a8-af58-0e0d793a92af", "comment": "Malware payload (CoinMiner)", "value": "dfce7816559907bd6706b01a1fb26f57", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147340, "uuid": "c7edc14d-65fe-412d-9e51-9af598569df6", "comment": "Malware payload (CoinMiner)", "value": "1b213a2c0c92828d10d1f5879b97b8a2927ee9fae2d0d9bc170ff6ded7087e24", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147340, "uuid": "6ad49bb4-133c-4670-9a53-2be3e1bf6016", "comment": "Malware payload (CoinMiner)", "value": "5b16272f28b077cbf598017cbfb00ad2ee3032c8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147340, "uuid": "db223437-85e0-4a98-b382-e86347697f3e", "comment": "Malware payload (CoinMiner)", "value": "277ca6c1c07d64f637a7088c59afad44f9f30f9230744f60f9ed1ea7f5fbdd1e4d1c9a8886fd2f8ca48ae3083c15ed38", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147340, "uuid": "5533ec5f-9100-4316-838f-c8bc8e7313d3", "value": "T1E8B533BED72446DBF35B363298329748976099D71F513B0B13B306B0861C8B54EB87EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147340, "uuid": "cf7c1e43-9132-4009-a9d8-51369a345169", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147340, "uuid": "c5a8d664-c723-4411-bb12-2ae98a508158", "value": "24576:2C8zDfbtO+dL6Q1c+cCNjn+vh4yvhiZm3w4M0OWfVzYnud+1q6t040xByvlmlteg:DGtO+dLNIV24hcmDanM+AK0uv8irF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147340, "uuid": "fac0e40c-08e1-499c-abe7-ce49af08e9b6", "value": 2283008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147340, "uuid": "a8f7d278-b171-45b4-8fb1-4b703d175470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147340, "uuid": "33b77bfe-0d3f-419d-8396-b9a784c0101f", "value": "Mines Predictor V1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32c0065-0125-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770139685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139685, "uuid": "05ecfd76-f552-4323-b9c7-f9b807191904", "comment": "Malware payload (SheetRAT)", "value": "2813cc3461891ae24fcab28e4a76beae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139685, "uuid": "d6b2ba6f-a324-4e55-b921-9b0a8dcbc4f8", "comment": "Malware payload (SheetRAT)", "value": "1b70ce05a56b7324de4685d2d3b10030f94bf9986089567a8085bf22295652d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139685, "uuid": "98995c4e-b80b-4ec2-9db8-81566c4232f4", "comment": "Malware payload (SheetRAT)", "value": "cb6c4f0cd4d4f2958c725b926c33fa8059be3322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139685, "uuid": "013be66f-8cb8-42ec-87ba-2ebfb8eb6226", "comment": "Malware payload (SheetRAT)", "value": "c7ec3a44fcf53f211ada6d57f04abcac53f762af4ccd5ffb356dc33daa5398380cbd96b20ed120a5157f076958db0889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139685, "uuid": "a195c57c-4354-4c29-aa6b-70bd3aeebbdb", "value": "T114A42A257FA98E00D544247ECA7E3609C712E0F26502A347370AF7A25D459EEDE2D3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139685, "uuid": "489e4104-1a5f-4a5e-b9cd-6489c2d03206", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139685, "uuid": "75d93b46-0062-4f80-9651-9e36d671fe81", "value": "6144:YxZ+qUzvOH7Lw5A2DimsLzlOHm9AYFmlAobM4/dfauL/1JWNvhbWXpW00znn56u:gUqUaH76DeLpMYAfd8wX00w0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139685, "uuid": "455725c7-d48f-40fe-a86f-b554eeca3297", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139685, "uuid": "1596eb4a-9e81-498b-9061-5060d19487b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139685, "uuid": "1c4957f4-ad25-42d9-b768-092a8741fef6", "value": "1b70ce05a56b7324de4685d2d3b10030f94bf9986089567a8085bf22295652d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631700c4-0133-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145564, "uuid": "1d706664-508a-49ff-ae07-32cbc0168f75", "comment": "Malware payload (Mirai)", "value": "fda611ee51ad842c9e062e69b919b431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145564, "uuid": "793d9a87-b43f-496f-874f-12a35ace79fd", "comment": "Malware payload (Mirai)", "value": "1b9e17462a47afb7ba79400f147f699ca70909f51a971bab80e20177ae024ef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145564, "uuid": "66573248-ff10-4a4e-b086-7cc256cfc47d", "comment": "Malware payload (Mirai)", "value": "01175978379985bb00356525f58e13853e5207c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145564, "uuid": "58c96060-ccde-4822-a7e8-b9b4d2ba77dc", "comment": "Malware payload (Mirai)", "value": "8d6456f75b70b5ef05b1245d8d78f7f8c8c1ef03558d62bd52052871ef74f11c9ed11bd95da904d76a4c9edf8c926643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145564, "uuid": "12d878b1-b1b4-4a97-abbe-4b99dbb35c2f", "value": "T1A2531907BD4494FDC299D17C83BBB5BAC127307E123972DA2BD4FE1A5C46EA12E1D848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145564, "uuid": "4c66791f-84a8-495e-b03e-498cc451be0e", "value": "1536:A9f0oprcG5y4EbLJsqzfUjTQlHLqrDavn7:kZ9V5yDLJsqzfUCHLq6vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145564, "uuid": "436a9d81-174c-4f66-b156-a971d80fe627", "value": 63680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145564, "uuid": "352efdda-f90b-43bb-b351-d4e2c6d26cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145564, "uuid": "9d1009fc-33ed-427f-b4a7-ab19803540de", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5087e6-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136833, "uuid": "5f405b42-95eb-43c5-8bdc-8901f4da3256", "comment": "Malware payload (Mirai)", "value": "b32bcbe27566b3fd2aca0076e54c3c29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136833, "uuid": "ded9fca1-753f-4b0f-93b4-49b7d84a567c", "comment": "Malware payload (Mirai)", "value": "1c15c50caae2ae164f877208f486f446cbb04734d367be644bf519a0877b7659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136833, "uuid": "fb674332-f2b0-4907-b978-df05d0a39e4a", "comment": "Malware payload (Mirai)", "value": "454e586ec70e6f0562410ac4a530052d45f8e100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136833, "uuid": "5a631f79-c07c-45a5-83f4-b765de332e51", "comment": "Malware payload (Mirai)", "value": "7a7f1cfee6274eb15ade3353236bd6738769a0705bf4479b2d17b01f803fe748113205581a123d405731a78cbd9877aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136833, "uuid": "0083b3b9-22ef-4bbc-8508-a89d434575f2", "value": "T1B3732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAC2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136833, "uuid": "72c6d3dd-3739-4f27-b792-dcb8ebf79689", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136833, "uuid": "0a9a4056-3b56-4422-94eb-c820c5ddb729", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136833, "uuid": "27c37fc7-6f46-455f-8f6d-e8d04aee9cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136833, "uuid": "42690447-30e9-4400-81c4-212753154bf8", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da883650-0119-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770134597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134597, "uuid": "694026f2-14d0-4cdd-9cf6-84f0a124c55d", "comment": "Malware payload (MaskGramStealer)", "value": "f18418467beb1413cd20294fb8708fc1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134597, "uuid": "202cf1f7-45ff-400b-b94d-28c02e2df49f", "comment": "Malware payload (MaskGramStealer)", "value": "1c2609b021ac925066aeea10bfe9f1827683f1f68329bf7a172991155dd78ac7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134597, "uuid": "f8d5041a-78c6-4b4b-99dc-5d543451a152", "comment": "Malware payload (MaskGramStealer)", "value": "8935140e35292dae456d4f8ba982a3d6468e3447", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134597, "uuid": "19af2c8f-6521-4dcb-9b5e-dfa92cf1f5e7", "comment": "Malware payload (MaskGramStealer)", "value": "196acadad3e6e8d8790f1625153d0db86a0dd741f03dca91b1533aa7a25ee436231280d8ee44b9cf5771e6a2b1f9aeed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134597, "uuid": "e2d6d60b-e1c6-4bc4-a121-20167b3b59f8", "value": "T1FE263A52FC9505AAD6BFE234946122627631789443313BD36EDC1A6A0E3BFC42B3F719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134597, "uuid": "e33cc17c-bfc5-46d7-a3a8-6f891de5d008", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134597, "uuid": "b513f12a-2739-4cf0-8696-22bc31d7ea72", "value": "24576:p4lg4IFwcxkySFAMHU/RtwIxYkv2a2E/Rw6CFGCmPpviSTV5jLaXuw+CakFo/bN4:pTVkySC2U/RtwIxYkuaF/C7AVAK103", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134597, "uuid": "64e28c6e-6bdd-439f-9a31-d12936e59db0", "value": 4714624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134597, "uuid": "239af992-4a75-4333-8ad5-b5f66b4cbeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134597, "uuid": "eff66392-1fad-4645-bb18-cb8643dc235a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cba8ea-00df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770109403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109403, "uuid": "989cc713-bd12-4ffa-9979-568519b35f6b", "comment": "Malware payload (Mirai)", "value": "7f3942d04b8abc86b5b4885c58378114", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109403, "uuid": "f3c6d132-33d9-4be7-acbd-53dce92cf735", "comment": "Malware payload (Mirai)", "value": "1c9207b52bdf16c465fe091169e162142aa1307acf592ac8f7e161bc04b81e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109403, "uuid": "463fdffb-563c-4490-9ac5-516b3ae6f64c", "comment": "Malware payload (Mirai)", "value": "50fc18fe5dca5c67f04fef5cc507fcb5e9f2a515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109403, "uuid": "d2026a89-64c9-41e7-913b-d8dabbd85eb3", "comment": "Malware payload (Mirai)", "value": "337c6c282edfd1caa532186b526068ef51e43effc0dcb379f093a3f66aa6d66d25a8caa13505457d1ce7295433b9c882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109403, "uuid": "93aa52c2-b5ff-4402-9ec4-a2709b49feae", "value": "T1A1D3B021E4006DD1EC2129F578BA96B80350EE700BDE1586EFFDE95E647BD94386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109403, "uuid": "d4f20c77-0f57-46bd-bb72-b2266d4987f6", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/x9:PCdny+hovsmzbisJfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109403, "uuid": "7ad19826-120a-482e-9c39-4570d0ddee67", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109403, "uuid": "9d74ae48-4a8b-4c13-a7cd-4d57e83082ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109403, "uuid": "1389b33b-bd44-4bd9-bb81-00030d6ee40e", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590e0c8b-0116-11f1-a129-42010a9c0007", "comment": "Malware payload (XBinder)", "timestamp": 1770133092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133092, "uuid": "b6a23927-fe98-4abb-b439-048aa4076f91", "comment": "Malware payload (XBinder)", "value": "88c0540020d6f5dddac5d2bf36f99863", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133092, "uuid": "5780138a-c434-4d8d-b6f0-a05881c46f56", "comment": "Malware payload (XBinder)", "value": "1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133092, "uuid": "5253e185-bbcc-4c5a-9d20-76ebbace3e62", "comment": "Malware payload (XBinder)", "value": "c09b6a73de53da446c2fd876cf4b3590e2d58400", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133092, "uuid": "dbc211d5-955d-4ab0-8303-b9e92815d532", "comment": "Malware payload (XBinder)", "value": "45e4f092e8df88b46bab6da1aa5a2a660ee5c5942989162a16bc0bd3c7e431c57b8d32a605aeb05a248a6a92fb6f0fff", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133092, "uuid": "bed518df-aeca-4da3-b645-5360ef8f7fe4", "value": "T19EB47BDC87900C53DB252F78DDF16D20851BAF9B7DA8E789E825B0522333BDE50216E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133092, "uuid": "bc3c5398-3456-446f-a84f-c4d2709e9e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133092, "uuid": "cde3bc97-80be-4ab3-b55c-3b73d2695f9d", "value": "6144:LKq869LKHmH3flFcYxuNHRUbqFcFJ5rAWq12CsUP3:eqBOGv46wHaY8Ljq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133092, "uuid": "b2c0b1e2-59ba-47a3-97d2-b6330ea8ebac", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133092, "uuid": "f2b3c171-fcd8-4391-b493-7f6a2165a08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133092, "uuid": "ee6a02a9-957d-4604-8155-6b7bbc3d46e3", "value": "1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb81918-00d1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770103709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103709, "uuid": "c03c96b3-f93c-4a72-a012-5bcb1fa52177", "comment": "Malware payload", "value": "2a9b48936ed78b134981e0ced75e2108", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103709, "uuid": "56072de5-9761-453d-bafb-8d1103d87c4e", "comment": "Malware payload", "value": "1cce7eeea2db0cbb73498520f520175b30b69a1e49b5595aa791a1ecaffe92c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103709, "uuid": "c3453d66-23b7-4276-ae0e-5741c576bccc", "comment": "Malware payload", "value": "4e63e72c7ba216f8db43dfd5f6dc50523be6bd9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103709, "uuid": "b091c8e0-a80a-4fa3-b8c0-6328e451f1bd", "comment": "Malware payload", "value": "a10cf9cc73ceb53c744194a09c0836631a85ed6c6d861f7a6ea31645ab5c28666924fbe93389dfb9182747b54b6d41b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103709, "uuid": "fb8bf386-7ba6-40f4-8b2c-d1fb1268e9bb", "value": "T187E5F103F78284B1F8DE01B651BB6BBB4E3DA625032985DBD3E06CA54E611D2373E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103709, "uuid": "470685c1-e3f8-4382-86c9-ff30c388142f", "value": "57834f35e7a2b10fb99c0949f8aad23c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103709, "uuid": "dced47a7-3974-4773-9072-13340bd61fc3", "value": "49152:IdE7MEf9yqr3rpPsXnrDe5MxrOEIeR2NIPnLg96U7HRnMMHxBt8ar/pG:gaMu9Rr3lsXve592PLg9fBHHPead", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770103709, "uuid": "9176932c-01c0-4593-8509-3eee0a873b80", "value": 3051520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770103709, "uuid": "9aaa7314-2890-49a3-bc43-4495433334f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103709, "uuid": "9e0895c0-233f-46ce-a12b-b4ee0f8ea82e", "value": "broscfg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab321f44-013d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770149980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149980, "uuid": "b638ffa6-1f0d-4a1f-a2c1-d714fb18b04d", "comment": "Malware payload (Mirai)", "value": "5e16c5049d56eabb913ad2383b26c8b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149980, "uuid": "45fc9ec3-1b76-4438-8568-a15a6d06c1b4", "comment": "Malware payload (Mirai)", "value": "1d109cb706842a71102dc5b6952eb37a8f5e307a88e74efb6b4909372ba2d4a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149980, "uuid": "f6841a69-7462-465c-9088-414759993d16", "comment": "Malware payload (Mirai)", "value": "f6c8be7e68cef484ecfa85a99c26d7ddb94ddd90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149980, "uuid": "5534b8d4-527a-4a0e-848c-8284876e28f3", "comment": "Malware payload (Mirai)", "value": "43384843b7b3ccb245359a382ba32634ed3b802def726bad7567dc98c3467b389faeb704aedffb93d0cc12e1de759400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149980, "uuid": "40278ab8-8caa-439d-aff0-bda08adc9a7a", "value": "T1D8A3B50BAE539F7DF36C83754BB38B3A6755239233A0C585E25CD9401E6028E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149980, "uuid": "1aeb0a2e-c2a3-4973-88b3-ebbc9d5fd008", "value": "1536:vsyeGdPPFiNeSReSqMSXImXmWWnAj1i3/86uBJQ8rM0UnFBXE:vsEPP0NmXGAj188ZJQ6iFBXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149980, "uuid": "ae33d2a0-2226-43d8-8851-9aa286706835", "value": 105256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149980, "uuid": "60005596-44f8-4845-a84b-38f4ec626c83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149980, "uuid": "65fbe48c-7f9e-459e-afac-5a0ff49046b5", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8288f2-013c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770149557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149557, "uuid": "a97e308c-b6aa-4340-a1b0-fdedfbb3dd6e", "comment": "Malware payload", "value": "f89a56dbff959639e4b4112ced98fce2", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149557, "uuid": "d0f36ae3-4d57-4c89-8056-cb3dbb1a8b1e", "comment": "Malware payload", "value": "1d5bea0ae5facf0159f35ea0bead65369ceb83942cc7073cb459ff06c6f82f0b", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149557, "uuid": "d15e5047-a370-4eac-830b-91e66bf1f640", "comment": "Malware payload", "value": "e95d7cd238693d35932956aeb0b629b126830206", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149557, "uuid": "9abc38c3-0b47-4f0f-8b07-ede001cc2e54", "comment": "Malware payload", "value": "0ef4ec69b21f19aae9f93da3c72ecbcd6061f7fdab818218bb2c08037b1246d42fa5f73769503edf3b546495b9e900c6", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149557, "uuid": "ae396948-4687-458a-ac00-52441f4351a1", "value": "T1727502067D85C8B5E437CC710049C257F06D29EDE90991EB02E19E896EB4E9B0F1FBDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149557, "uuid": "d9c916e2-e4a5-40d0-af63-d34cb21b5da3", "value": "49152:Y/y7qDgaZ4YYJ1vBLR4qaxI+iCz+VnSON:Y/5DByYm4x5a5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149557, "uuid": "e2c7abcd-a9cd-4613-bf76-86198ab252b7", "value": 1668827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149557, "uuid": "aee332d6-8092-4283-a7dc-e163a2ee6201", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149557, "uuid": "49937662-4f41-4732-bd4a-e11a43692f7c", "value": "1d5bea0ae5facf0159f35ea0bead65369ceb83942cc7073cb459ff06c6f82f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd9de78-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770087867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087867, "uuid": "fe393c24-133f-458b-94e0-5a9f423878f9", "comment": "Malware payload (Mirai)", "value": "870f44db03c7d8c691788784734b3a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087867, "uuid": "9f1f661d-cda2-453c-b9d4-ba29b1eb73b9", "comment": "Malware payload (Mirai)", "value": "1e86a0de4de91d4747615e25d021ffde6cec82304e5b7a8c3ab6bae14873ae2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087867, "uuid": "2bf189a5-9430-456d-92f9-d41b27d24144", "comment": "Malware payload (Mirai)", "value": "73f3d8e9c5d180c1cb8fa069134c843da2e4becc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087867, "uuid": "dbb99de1-b040-4e88-9dde-346bd11495a5", "comment": "Malware payload (Mirai)", "value": "2a8046204aa4c1f1653813fcbec204c3473e6e61f6491a60e9b4248af3ba670439929a3a0c5944912e445c87079bd934", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087867, "uuid": "9056d239-17ef-40e9-906e-425a5fc24899", "value": "T126262951FACB94F6D5031D3040ABE2AF5731AD098F25EB87EA007F2AE97B6911D3610D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087867, "uuid": "6b96d8d1-ddc5-45a3-8b3f-e6303c8ee94d", "value": "49152:9FPnZcrHbtUxJfvZE9yt0irV/alfBcSHonizm9J9Z/0QhLODDUED+8ZBkn0VF1:9hnZAoJfW9yA6izK9ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087867, "uuid": "de220a3b-11ea-4eab-aeb7-637c3d4fe3c6", "value": 4452352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087867, "uuid": "741338e9-0a5b-4aae-8d96-0bcd5635cdd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087867, "uuid": "26a90ea2-5502-4b19-a917-6f6ab25dd17a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22712b45-00ee-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770115820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115820, "uuid": "21a4dc68-4518-45ec-89ba-1aa3127f4591", "comment": "Malware payload (Stealc)", "value": "d790fbfe6e9a81a218be2cda7bca0c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115820, "uuid": "b026dcc8-235a-481d-b2bc-7f55339fcafc", "comment": "Malware payload (Stealc)", "value": "1eb56716cb68e28799b9d476eaab2ed389d16ff77a88d63140779bbc47f40456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115820, "uuid": "02aa4e90-df62-44a3-9477-b679232a3250", "comment": "Malware payload (Stealc)", "value": "397a7a73406d9edae9d823ffb10feaab0c6370c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115820, "uuid": "5f7ead6f-005d-450a-b893-6676dc2e59ad", "comment": "Malware payload (Stealc)", "value": "09a925d41976d9630731ad3640b0f22f75d67cc435c4d463bd534d6cb51528990984c87d1d8fe0c32626010731d1667c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115820, "uuid": "eeda1492-bd8a-489d-adc8-a75031ba1698", "value": "T114F48D5AE7A502F9D0BBC178CE424553EBB2B8155770978F03E11AA61F372A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115820, "uuid": "8a149ce2-4b03-4ef9-ab0e-f614bae4bc4f", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115820, "uuid": "a1481ee3-98a6-4eef-a7ca-3ae99874a182", "value": "12288:jU8VHX4ZPBuvzkOkW7UE+YTRqwJ4pkS6ALSQTbAK4lVA:HVH6BuvbkW7xXVVmpkSzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770115820, "uuid": "4780034e-f403-4b39-8912-59516f5167f6", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770115820, "uuid": "83b74b8d-1c33-4cd5-967c-7d9df2613956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115820, "uuid": "aee5e464-1d72-4aed-9403-5dc108f0e017", "value": "x1eb56716cb68e28799b9d476eaab2ed389d16ff77a88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0120a18f-00fe-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770122636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122636, "uuid": "f83e5948-4bec-4d59-8489-457a02454f57", "comment": "Malware payload", "value": "2f7b4dca1c79e525aef8da537294a6c4", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122636, "uuid": "62b51033-e221-45c0-826b-997eae217726", "comment": "Malware payload", "value": "1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122636, "uuid": "aab4f4ca-c8f5-46a3-840e-8142b42410b5", "comment": "Malware payload", "value": "c4799d17a4343bd353e0edb0a4de248b99295d4d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122636, "uuid": "07f5da52-422e-42a2-8642-1d484e1b5316", "comment": "Malware payload", "value": "77443664269e599e097f9692be6199a8c1a976f75e3f603c031bc294b296d95c29ae8afa8d7311e34aa1646ea5b112ba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122636, "uuid": "ef609a6b-ada8-4abc-9e7f-fecb38c0144e", "value": "T1A5D3B5B400558A54E25392576F09FC882877F4523CF690F4BFEFE6B8E1BAD6CD616808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122636, "uuid": "31cacdc9-21e4-4ffa-87a0-ff09e4f1ef08", "value": "768:MgKfYjJoFvEdOcsJBAdVHPkDus/39GVHWGVHNRBHVHs+YGVHs74GVHsSihGVHsO+:MqjpybEtdqbBxYXxkT6lsbP2HcGD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770122636, "uuid": "d83551b7-5c49-4f96-8c82-5bc53ec3e33f", "value": 140625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770122636, "uuid": "aa5e0cf8-fbea-4c79-a88f-4d02782d3eca", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122636, "uuid": "ce2d17ec-4c3d-4a51-b5ba-81e696c7c55e", "value": "Courses.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e737e62f-011a-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770135048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135048, "uuid": "9c0d3fbe-fb11-479e-bbd4-946f6dbcccab", "comment": "Malware payload (ConnectWise)", "value": "f2bcd96b30aac75d5251249df8f3441e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135048, "uuid": "60c5283a-f5b9-400d-89be-5e8cbc03c6eb", "comment": "Malware payload (ConnectWise)", "value": "1f12c8b6d7094286f3d9965c4563c3ee53a0e4d19cf4a111e7519d0829ffa08e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135048, "uuid": "b7dc15a0-c3c6-44a9-81fb-f6a75dbfe1a7", "comment": "Malware payload (ConnectWise)", "value": "33789a7c580b1c0117e414b116262069a8770568", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135048, "uuid": "80d957b5-dee9-4ba4-a454-67d39a297895", "comment": "Malware payload (ConnectWise)", "value": "ec97a192e8d65e3a8585af06c95bbabb09de870788d333ee204d665ead823fe3324165597d74156118507a306d952ded", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135048, "uuid": "65dd49d2-eb06-4d53-955e-f5a336216c88", "value": "T1E1A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135048, "uuid": "cb9d5d3b-746d-454d-b0a6-4c7df53733a9", "value": "196608:jKaLNkbgMi4QiKaLNkbgRKaLNkbgZKaLNkbg:7WgMiH0Wg1Wg9Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770135048, "uuid": "925dc680-56c0-467b-9407-84f0b4d4c62e", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770135048, "uuid": "5ef55561-d321-48ac-b6ea-738709bc17e7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135048, "uuid": "b9e0bcad-af1c-4bb0-a7ad-c57786b53340", "value": "1f12c8b6d7094286f3d9965c4563c3ee53a0e4d19cf4a111e7519d0829ffa08e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9cb512-0118-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770134168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134168, "uuid": "ca25f406-8e3a-488e-9af0-c1c4cedec50f", "comment": "Malware payload (Mirai)", "value": "fd708e234ac35274d119b655995e644a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134168, "uuid": "ee2ba167-466a-45b8-a025-1ffd48a0b3d3", "comment": "Malware payload (Mirai)", "value": "1f54215739170aecf9ec3f877c8aa89c344bd421276b0e0c2e0d9cc4fb6b9068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134168, "uuid": "b6569ec8-f19d-4d6e-ba20-c663bd7250d0", "comment": "Malware payload (Mirai)", "value": "64ef98bc44e3e59bab5d6761d826ea215986830a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134168, "uuid": "933a81f5-1b89-4b6f-8d5b-f5cdb7a10c3b", "comment": "Malware payload (Mirai)", "value": "e682b4f8ad3ce1dbe3084757ce2486c0f22d2a19ba38dbd17b0b399e2bd0a0aa78cd3de97dca3a5b15c8296a0ec0672e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134168, "uuid": "b0acce78-48f4-4462-b53c-8c28b0f6fdab", "value": "T13D04F141FB09152BE9E34FB44E3B2F21933E48A624A7D1186609FB130E73E7A565B7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134168, "uuid": "d2453d37-b4d3-4a18-a75f-39fd6043a6cc", "value": "3072:ozdurayQy5HEcMf3oCadVen5qbyQvi7Nsq2u5AGJdcqCf/LE:ozdurafekcMwCQeQq7NsJu5BJuDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134168, "uuid": "2178b030-8960-4963-a027-22e869114495", "value": 186166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134168, "uuid": "770c34c6-3d57-4497-82ce-08b8fa874ebb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134168, "uuid": "6e4187d5-0995-4751-b8e5-ba517f79db63", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15874772-0135-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770146293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146293, "uuid": "0c4d3339-5901-4363-97cd-70161f305a07", "comment": "Malware payload (Mirai)", "value": "badfb777eb116655d97aec1f5859c6c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146293, "uuid": "5af9444d-3912-40a2-9a8a-86f2aa8b1fb6", "comment": "Malware payload (Mirai)", "value": "201c0b78693a3091d9a7e26aa7110c77beb13289ea5978f1edd4b1359567ea6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146293, "uuid": "4033800c-d947-4040-8939-5382c9f2d844", "comment": "Malware payload (Mirai)", "value": "64ce676db74bf1241221b201c695fe1537500425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146293, "uuid": "f41bbeb2-7f21-40b3-b85c-53855118391c", "comment": "Malware payload (Mirai)", "value": "df68e1fcf33671af7ffd3c0bfa7123876414f2b4f424e1abf11838759979455dc724936c43128d1793a8f409f675d347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146293, "uuid": "b57eaab4-ccd7-45da-b2ac-7ae4ef9d10d9", "value": "T1BB435CC8E5D3DCF9EC150A702136EB718B73E93E216CDE97C79859639992603E8026CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146293, "uuid": "c7ffcbb3-7956-4524-896e-0226d4173ba3", "value": "1536:PZa1CnL8Hqk0txEuF/dSIqAER5Fs/Rzhk3M:A1CnL8H8TE8UAiFsZ9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770146293, "uuid": "96f5d77c-45f1-44ed-ab23-d3031ded4ee9", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770146293, "uuid": "a5e95d11-eb8a-4c94-b3b9-6d22013135c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146293, "uuid": "f1afacd3-4cac-424a-b3a2-a261d18fb617", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d51510f-015c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770163137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163137, "uuid": "4f3f7d58-ad61-4353-befd-60497241141e", "comment": "Malware payload", "value": "2d72402bb77a5a9777a1f8cb398cca53", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163137, "uuid": "77237fc3-61f5-49a0-9dd4-20c78e713465", "comment": "Malware payload", "value": "22b600da8702a9b067f76048f48181d49dca2a54b96c9dd6609e7f3648be1a19", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163137, "uuid": "4f6d77d3-8a23-4c95-9838-2be27ef2e7c3", "comment": "Malware payload", "value": "a47bc00d10cbdb89bbda6bb408b39405f44f6472", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163137, "uuid": "0859a573-50b7-46f9-bd1c-03321a754b9f", "comment": "Malware payload", "value": "18d0fd6cb1901edef90045c9a2872b1213825a078d89da965a8937801edb845a2853154fae3d4f3ff5ad0402dff82848", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163137, "uuid": "aef12021-8bae-4b9f-85bf-0a68227b285d", "value": "T1CD461227B3CBE03EE46E473705B3A26494FB66616527BD66C6E4889CCF250601E3E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163137, "uuid": "8c61f9da-0245-49b2-9fba-d2e591f92758", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163137, "uuid": "cd8ea8ba-2bef-4c89-b5a1-e91fe397179d", "value": "98304:FrLYw25kQ8rY2CC7eal9dAzxhh88YtgWzeN2swISFv0QyrMwc:ZLYwg18rRCEJl9dAzJ88ierSiF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163137, "uuid": "f8000ad9-8137-4bd3-9a92-8a92ac9d4a1e", "value": 5700056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163137, "uuid": "5d71283a-92f7-435e-bd75-5f2f6eacbf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163137, "uuid": "9bee6817-096a-4e78-b19d-362ccdf4dda8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c738a9-0101-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770124206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124206, "uuid": "20430739-354a-4d67-9631-3a75240c7f0d", "comment": "Malware payload (Mirai)", "value": "d2c33978f4228d113b968de6883c11ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124206, "uuid": "bd2aa476-d655-4900-bbc2-fa18404b8a58", "comment": "Malware payload (Mirai)", "value": "231011f653fd0aa0cc0d4a2d89d36919e5b96df96cd73a13dce87af4cfd06b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124206, "uuid": "87020ed4-6736-4b3b-99f4-201c30f0cee2", "comment": "Malware payload (Mirai)", "value": "7d6b597a09b37895ce6499b50282cdac989b679e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124206, "uuid": "ff813355-bf90-418a-958d-1a87c09ca3c7", "comment": "Malware payload (Mirai)", "value": "5bec4566fff5d07938083bec87a9497a8f88bd90c6d8ec2321d21fb76842222c479e8133792ae89a854a734c312f3d09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124206, "uuid": "b15fbe33-671e-4a0c-89a9-5bb2d325d861", "value": "T19E630BC5F98780F6CD1B8D3091E7F63FCA31E8B981748A6DEF5A6F35DA275029102189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124206, "uuid": "617ded65-18dc-418e-ada2-ef892276f416", "value": "1536:2c0nDYPdOvIiV60UeVgroLYXiIBAna4mZBDe:2c0nIOQiV6teooLzIBP4mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770124206, "uuid": "249ac25b-8fc0-489e-bd59-d9c6aafb92e5", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770124206, "uuid": "f5c0b8b7-1b54-4140-82b9-22b6e1fdb2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124206, "uuid": "e356525e-f925-479b-9385-16fa2cb0b55b", "value": "mao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b931255-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143269, "uuid": "d719a9ef-9d5f-424a-a74f-27004f54779a", "comment": "Malware payload", "value": "6754c299d9f8ad86caf682f75ed48e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143269, "uuid": "79d7f232-d51c-4474-89db-b5e0d0c16d9a", "comment": "Malware payload", "value": "23768a3223e4289bd1d27583a87723ff9419c22159384b6dec7dfdfbb2b26dc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143269, "uuid": "8747090d-7253-4aa6-8d8c-5b2d4c96fc15", "comment": "Malware payload", "value": "daebee2aa7739d48fa75cbc9015b42597db69487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143269, "uuid": "15689870-4395-47c8-9524-cf912d78d55d", "comment": "Malware payload", "value": "0ab3f812b35feb43da3b9a081c5c7565ff60907aa4e82e1f8d794a7f2a581a4be7ec47f052f161ae72e2fb66771bd020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143269, "uuid": "2c66331b-fd5a-4c48-869c-912c40fd3e0c", "value": "T1ADD3F162F4C0DB63C6C4627BFB0E1519731713B4E3EA33814D258E2527E6A2B0E3795A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143269, "uuid": "607f3dd0-65e2-4957-9496-b13244322d26", "value": "3072:foTTImvmBw3c9ZAsfkq8bqaXAL2V+PJQfuabbX3DcyZP:fgIwWw3QrfDAVXAQv3Dcy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143269, "uuid": "d8f7aea5-ea18-483c-b9b6-2ba0220c60a4", "value": 142184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143269, "uuid": "be4b6aeb-0796-496a-9c6b-3088ae4d4e3b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143269, "uuid": "0c751afc-344d-49d3-9422-541727886018", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b995c1ac-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770151292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151292, "uuid": "1f1d226b-7fcf-4e26-ae04-658f22522b95", "comment": "Malware payload (ConnectWise)", "value": "5dfba1f96a9a8a6822241d08187d3762", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151292, "uuid": "fc17c694-14d9-4572-b7e2-ee75217a4c32", "comment": "Malware payload (ConnectWise)", "value": "23813901eab689ddcc42b695e2d2ee9bce4224e3e3eaecf4d1b520be34da3311", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151292, "uuid": "dd1e4e03-bed1-465d-a4c0-440af746eeb6", "comment": "Malware payload (ConnectWise)", "value": "639a5649df23a128b368b3f2717eebe0999c81bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151292, "uuid": "b1306fbf-c364-4138-87ea-e81537ef3d8b", "comment": "Malware payload (ConnectWise)", "value": "0c1dccf45329712c01e5a3ccb6f556833597d39bfe97c60530939decdaf9655e8f5214713b839f2bfdd6d31187f624da", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151292, "uuid": "65f3944a-8a4e-43b7-9c13-e2b5d5492712", "value": "T15CA6231172E58179F1FB0B39FD3A91B16A763C699E63806F1354391E1A72E50CAB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151292, "uuid": "68a896ce-666b-412c-ac8c-8884fd1d3715", "value": "196608:UZJbjFd29qxm2ZJbjFd29jZJbjFd29RZJbjFd29:U3b29qw23b29j3b29R3b29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151292, "uuid": "700b2af8-9607-4da1-824c-7915cc75e2d8", "value": 10067968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151292, "uuid": "1c980d3f-dbb9-4623-981c-a8f7da66fed5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151292, "uuid": "a673cae1-f468-4890-9735-4eff291f55a4", "value": "welcome.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca672eb3-011a-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770135000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135000, "uuid": "36fc62b9-6a9a-4cf8-90e6-743cec68a1e1", "comment": "Malware payload (Socks5Systemz)", "value": "e5afd11b75df0f0f8a5819631cec3721", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135000, "uuid": "1560041e-8f95-4dc3-851f-5468e5ad2e4e", "comment": "Malware payload (Socks5Systemz)", "value": "256b9eb69f2f2c9bb5e3acf217c7bd229199b4435bdc14a72e9237e065a7891c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135000, "uuid": "07d6df96-4ba7-494b-8a3f-3adc72c5269a", "comment": "Malware payload (Socks5Systemz)", "value": "4a28b6842d4f13c0ac2ab7ef4a8a836ffe5f5f99", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135000, "uuid": "baa7e4a4-df37-47dd-a25b-e1722e9f417a", "comment": "Malware payload (Socks5Systemz)", "value": "da2eddd809e034a1f76dc3e5c4bb9188bd5979b7a434563cb1eed3d8bd2b04ea5c51969f412b099425688d3c58b9e77a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135000, "uuid": "f4fea7fa-0803-42ea-a01c-8cad81da7c71", "value": "T14195235A0AFD5572D4BA4BFD51F6144759B170329B7A808F3788C0ACAE23EE06630B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135000, "uuid": "2d242bea-4fd5-4f22-b2df-311fe00ba6e7", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135000, "uuid": "2b2f9e1d-65c0-4133-b70f-4a2f34651315", "value": "49152:G5niR7F051hc2SZAQL3VneGgJ5LruU7+4:eiP05E2YL3VneGMuYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770135000, "uuid": "49545f82-b495-465d-9dc3-87cac8dabd74", "value": 2014208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770135000, "uuid": "5f0c42db-07c2-4116-8ab3-2122bc78b902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135000, "uuid": "e3c2b7d1-c0c9-48da-87a2-fbf259181be6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dc0e68-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140139, "uuid": "809ad2fb-ef83-4ece-9782-22789be28f49", "comment": "Malware payload (ConnectWise)", "value": "3d619137d760b6f4515db496a4e26d4a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140139, "uuid": "8cda5136-bac3-436e-b13e-e43649f3122d", "comment": "Malware payload (ConnectWise)", "value": "25a30aee6450b71633deea59ae66ca0c9411ae87bbb3dafdd5062e4dc2f151f5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140139, "uuid": "5a78d0e1-7afa-4621-9111-660d29507b67", "comment": "Malware payload (ConnectWise)", "value": "84b1631fc2e8d64ee87256df5a715e853dfd6454", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140139, "uuid": "f7d4f036-1e7c-445a-95b9-c4e858603d88", "comment": "Malware payload (ConnectWise)", "value": "0afa729e51a476c7012bb4d533dbc8458deb0d4e20d8343bf2490eea00ea04fd9ff4bb30834c82ed39c7ab973259a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140139, "uuid": "10b9fcd5-6916-43eb-9ae1-7b1bf5ea0a1f", "value": "T1AEA6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140139, "uuid": "58676d73-969b-4651-baea-17ce819a8450", "value": "196608:ZKaLNkbgXi4Q4KaLNkbgRKaLNkbgZKaLNkbg:9WgXiHeWg1Wg9Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140139, "uuid": "59af8692-2a1d-40d6-9216-e349deaf7054", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140139, "uuid": "abadb19f-3559-4b48-a5f5-5bd253eb6ab0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140139, "uuid": "1c38a89c-6ccf-4532-907c-e7449361aabb", "value": "zhinvite2026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8dcea8-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136803, "uuid": "e009de85-0c23-40d7-8139-a25657bb2cef", "comment": "Malware payload (Mirai)", "value": "950cb076497513cdee8eb53ddfaaf952", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136803, "uuid": "505476e0-0d1f-4ecf-8969-8627e3330077", "comment": "Malware payload (Mirai)", "value": "267eaaf94a0c610637cf8e72dd7082c363bcb516392cbbe2492f1f8b6ba7686d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136803, "uuid": "cc23b300-d43b-4a12-9459-2c2ec5b46c1a", "comment": "Malware payload (Mirai)", "value": "3885c85d7855f2260caa3a28dc1d2377d54c803f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136803, "uuid": "5d6c947c-e689-415d-a23b-ef609a4237de", "comment": "Malware payload (Mirai)", "value": "542347886cc94a9eefaa0ab5ffad219122066eec866b8500239a1748822543e8a6a2680f889c4232a3c46c6f90a2b538", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136803, "uuid": "0f3b57fd-6cfc-472c-9ddd-1a4f8e48ee88", "value": "T10C5165C432254BB4BFB15992B6F640157089A0D2AAC75EC9E2FCA4FE418CF0D6C915A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136803, "uuid": "6a788948-5b34-4ffb-b8dc-9e87dd2e4766", "value": "48:vzyuQgi4z3UQgi4z58Qgi4zHwQgi4zBwQgi4zdudzEQgi4zoCQgi4zR8Qgi4zKuy:vzyuvi4z3Uvi4z58vi4zHwvi4zBwvi4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136803, "uuid": "6e4aadbc-8abd-42a4-9a74-6f84be32058d", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136803, "uuid": "2a7c59e3-62e7-4616-81b7-0e879dd3ce9f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136803, "uuid": "07fcc79f-762f-445e-b943-fe344300c9ba", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5cc3c6-0106-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770126123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770126123, "uuid": "723ed33b-ec6c-4f82-b29e-b855849b6cdc", "comment": "Malware payload", "value": "275ac9b31d0fa0c1a7c41b92c33c693a", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770126123, "uuid": "71bd145e-556c-422f-a261-9f336e591425", "comment": "Malware payload", "value": "26d244cf283dfef6f3bf966a471716ad100343c58a4db36a06c234b5c5920f74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770126123, "uuid": "e0443f2b-f9e5-462a-adfa-28141fdcc1cb", "comment": "Malware payload", "value": "a279a2fd3f11978ce197e453215267d403e3a317", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770126123, "uuid": "32c66672-c5e2-4a67-a498-cb1f7aa963f3", "comment": "Malware payload", "value": "21cc7daf1904d46fb3041f94f2745c9fb68412b3a3119b350730643c0b605591a3ea84973f14d0c5fc75d103b58ae628", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770126123, "uuid": "a64a713c-6467-49cb-8347-f4e3928e6f3b", "value": "T1A353D0721459DC6481666038B1D87E29B460F6EE6CEE630214A1E831FFEFA87213DDC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770126123, "uuid": "8ddd2bf2-8b94-412b-949a-03f2b23d9f45", "value": "1536:qybBDTpEz/tb8S7qG0BLc5TNn8/ZJiuOBeybLYG2h:1fpEzh8S7qGCo5Jn8ZJcDih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770126123, "uuid": "6362e7d4-5968-4983-81b8-8a7cf72c806f", "value": 61390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770126123, "uuid": "26898d78-1d51-416a-b409-4720a998c017", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770126123, "uuid": "4b912b17-78e1-49bb-ae9b-783efd53de5a", "value": "5_11_1_1055_03.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f66138-0118-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770133937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133937, "uuid": "e9fca2d0-9f85-4c6d-a4cb-89e08d10e7bb", "comment": "Malware payload (ConnectWise)", "value": "78c1b87e322212e193d4faa9ba3f48ea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133937, "uuid": "18d29222-b437-4eec-9a96-ad6b28b28a5e", "comment": "Malware payload (ConnectWise)", "value": "28cc4128905aff14091bc5a1822d823affacbfba23e80fbd5035ee74783e2c3f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133937, "uuid": "d8ae3f77-c104-4725-8509-6f35555be368", "comment": "Malware payload (ConnectWise)", "value": "046eac4a230674dfd0ce31901778087465b8042d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133937, "uuid": "878b3021-621a-4ab8-b0ca-8343fbc6c174", "comment": "Malware payload (ConnectWise)", "value": "c8eff9aea07568ee74e788dfd9f38b06aff29f227b9117142958966ecd8ea2c9ff8230af63bf62dbfd3ffe3161fbac5e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133937, "uuid": "22a6fb4b-e79e-4d27-b9f5-f708083d0bd9", "value": "T13FA6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133937, "uuid": "f1f06ba0-f677-47f3-b649-bbdc5fa067c3", "value": "196608:0KaLNkbg1i4QKKaLNkbgRKaLNkbgXKaLNkbg:qWg1iHcWg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133937, "uuid": "75216928-3044-49fd-99e2-6e52b88bda38", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133937, "uuid": "8cfed4a0-5fd8-4631-a61f-4089ede2bbba", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133937, "uuid": "fb654001-a4e8-4d07-bdc3-725b84dbe5ff", "value": "28cc4128905aff14091bc5a1822d823affacbfba23e80fbd5035ee74783e2c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d6e59c-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136809, "uuid": "8dfd5f2e-b23d-45e6-a6f1-4a57ce857941", "comment": "Malware payload (Mirai)", "value": "09130c2730b8a5ebc7504473e59db9f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136809, "uuid": "0e44f90b-0f70-4dac-b209-ce4da484b578", "comment": "Malware payload (Mirai)", "value": "28d2d9759823d69e7fc46485b53a413b38ef2f8ff504dd397b6726c21c5dcd19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136809, "uuid": "c31e8754-ad01-42f8-baea-478cb21e103c", "comment": "Malware payload (Mirai)", "value": "d7bce1a087eae998cb9f9c8a9fbe4f27cff1a092", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136809, "uuid": "33e605d5-e53c-447c-a83f-abaa4a0b0f6c", "comment": "Malware payload (Mirai)", "value": "c1db6480e508f54d93779db08d6a344fa4f905d88af1e5b3602d623d17fca179542730d0aa1259852e7df11f2dc9a05e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136809, "uuid": "51e2fe2f-baa7-41a8-9be5-019220762af1", "value": "T1B9D2E145C48FC38AD1BA027018F9FEC91D08C74CA7A8D1779DB4787BC853D192AB946A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136809, "uuid": "86091f09-40c7-490d-96e9-3369426135dd", "value": "768:8h/f7b26ozNqAhsiL8ZcWTs9iM7ckSncukpnbcuyD7UM7X:8hX7i6ozNqAWfKbIMIkgkpnouy8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136809, "uuid": "3a58c92d-98ac-4ad4-a607-173642f0b4fe", "value": 29844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136809, "uuid": "435dd06e-eb55-4b42-a403-8e33a8255c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136809, "uuid": "c52c1527-2cb3-4f4d-ab0f-79fc7d1b972a", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5d87d4-00d5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770105396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105396, "uuid": "4a438a32-a126-4074-9ba9-00bad5bcc0ab", "comment": "Malware payload", "value": "0834ea4a3e6a0e4c9ec2111ec378c303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105396, "uuid": "3cb10e87-4a5f-47e7-8bf2-f84999bf1426", "comment": "Malware payload", "value": "28d5b45b374a60192159fd0c528f516f1701742c99db48c5a353e14bd46a345a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105396, "uuid": "b7e91ac2-caef-40d1-b891-7476a5364519", "comment": "Malware payload", "value": "2841b00908e73cbd2a751bff124f59651898d654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105396, "uuid": "8249de85-a162-4958-8d31-3d14fb4ec6bc", "comment": "Malware payload", "value": "9837a8e1818b93254b58c3bbccd6a15de38c6c97a4a9d1f469001c263118f87b96329d6bc84c57712e888d4c964aee65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105396, "uuid": "0daa2afa-d9e4-480f-aec2-ffdb2b7db8c8", "value": "T11CB533EECCF0B1B59AC810FA8B9D09AD8169F466FCB88D35880D379149F91747E5324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105396, "uuid": "e05f855e-76f5-4f3c-8932-04f9213674a5", "value": "49152:RHmFD3CuCwqORg4NNnkAF3wEtI4u4kTN6EI0f:RgDAfCNkAF3ta4kTsE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770105396, "uuid": "483eaa53-ea01-44c1-98ba-1e9b8f7f59a7", "value": 2404485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770105396, "uuid": "517c04c3-579d-49a4-aeea-351fb3a937f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105396, "uuid": "9af32db4-1189-458c-9766-dfee53defd6e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a78135d-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143268, "uuid": "1d821e80-42db-4fce-b99f-57dbcd5b5913", "comment": "Malware payload", "value": "398d38938e829be3c32f41ad83ebba62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143268, "uuid": "d6ca567b-f6f9-45d6-ac49-b67b5afd058c", "comment": "Malware payload", "value": "297febbd4038fcbb999397d21bd7d18ddd3a6db4f051ee3f9252493869d83c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143268, "uuid": "3be7a5bc-f7aa-423b-a13f-e7d519309fda", "comment": "Malware payload", "value": "50cd913232782ee4cf480274a81e4d28bed80361", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143268, "uuid": "2e397b6f-4a57-4ca7-9aef-f0b3bd9e756c", "comment": "Malware payload", "value": "5589515b98ff17be8a0439335a725910cf6a32acc01ce783c2400e6ec20677240307c061da47acfd6a46c05e2922ea03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143268, "uuid": "120f9aa0-0045-416d-b6de-a30e693fb788", "value": "T199C30144F9C0C774E45305B3047ADBEFDB3A1A598518D69AFB487F10AC342E5D2BB2A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143268, "uuid": "b45508a2-8bba-4dd5-9278-6314f8ed4954", "value": "3072:qa3z5a9yc6D+NA4hIvBb+zqLlYoCG469TWoH1fvKUxem4KU:qqm10EjhQb+O5Y36pX1fvKUUm1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143268, "uuid": "a669d941-9c3c-44c0-a851-a4072c171aeb", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143268, "uuid": "5f3d7eb7-a1e8-4cbe-ab75-2d6286a117f4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143268, "uuid": "4809eb9b-fdb5-4c92-bfe1-b96a27d311c7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a61b1-00aa-11f1-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1770086740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086740, "uuid": "a04b4295-6615-403d-87b0-732e3f4daf03", "comment": "Malware payload (MeshAgent)", "value": "3865aeb68066e5dddb5e2d27c88b27c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086740, "uuid": "05e4e5d9-eefe-4d1c-b78c-91a75f7ae09f", "comment": "Malware payload (MeshAgent)", "value": "299fa03980999a7c0de33193a06fb6365985866976cba964944d73c05a68476e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086740, "uuid": "90f5b932-34de-459c-a772-5f4db94d36cf", "comment": "Malware payload (MeshAgent)", "value": "2010872e5b5eb6e5663adff074bcf1c869208c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086740, "uuid": "893ff897-13dc-4ad9-a23c-9a640845533d", "comment": "Malware payload (MeshAgent)", "value": "8e7e54a048a6a36806ffd1aef91ab7b8019630212feb2146bc4b374eb8697c956905278dbaf9e539238f5a794358c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086740, "uuid": "baa407c8-4a8b-4ba7-9c8d-1d3077a97d29", "value": "T1ACF58DD2A3A600E8E9B7F23C85568517E7F2B81753709BCF15A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086740, "uuid": "d8c0fb1c-165a-40c3-8859-d24b6be08b76", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086740, "uuid": "f11fa3d7-369b-42cb-9c6c-bc3c94c6b8b3", "value": "49152:wdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5b7:EHvfGfZvZj1/N/z/owJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770086740, "uuid": "2527fce2-5e96-4630-a562-db90a1fb70ea", "value": 3482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770086740, "uuid": "32de5416-6e49-4c88-9729-524e57bd6559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086740, "uuid": "88d30b02-8bc3-4002-80fc-252e8d56e9c5", "value": "meshagent64-Jobcorp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1b1993-0093-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770076910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770076910, "uuid": "8b1a83f9-ae64-40b7-ad04-b0237a5d5b75", "comment": "Malware payload (Mirai)", "value": "c73fbdb740d3281570a57b24d5eac732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770076910, "uuid": "1ceb7299-eb22-4b2d-8ca1-422c5713b929", "comment": "Malware payload (Mirai)", "value": "29ce764b4783c65d187734a0370a6f07a89a40bc60106b0283d797b99391f317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770076910, "uuid": "3c4e7377-f26d-4418-8fee-39dfc84263ee", "comment": "Malware payload (Mirai)", "value": "4bcd2c9a17c0719842faf474d31ce1c81380606b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770076910, "uuid": "e2e1cb8c-9237-45a5-b973-809bd0e3b9a8", "comment": "Malware payload (Mirai)", "value": "0b7ae228744669ae36c68b457354afa732f76fec94b2a54b9be0661c5443a7f7a23428bf87555816c85576cd4048e6c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770076910, "uuid": "4273ecc9-4210-444d-8206-68ca55d48b5c", "value": "T15EE47C633B21DFA4D354C27105F3C7655AD420A21AE2909AB27CC7187E6162E3D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770076910, "uuid": "ea7d6f9a-497c-475f-b168-98a553c0512d", "value": "12288:Z/z97J4tCcR6l5XDCQcqt7+wYUEUyd3se6wZ4+vc8p1vMlQli:Z7L4tCcolR2Qz7+JHdce6oVEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770076910, "uuid": "3f09c29f-cfcd-4a52-8b4f-0ac1b21b89c2", "value": 704620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770076910, "uuid": "ab8f141a-74b6-41af-868a-926684ad135e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770076910, "uuid": "78d7d49c-d855-448f-b83d-6eb406d6bb82", "value": "pandora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e56d33-00e2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770110786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110786, "uuid": "0cbf6f64-2e80-4772-a18a-534ae25c6b9c", "comment": "Malware payload (Mirai)", "value": "f4f0010d9e2d895fa0b7260337638deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110786, "uuid": "c783bb79-697d-46f9-a8c8-470540c40f70", "comment": "Malware payload (Mirai)", "value": "2a829afb5ab199e55745dca07941de53a699aa1846d3b7657cc6a3327085add4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110786, "uuid": "99d9d622-95b3-4b58-9783-b62a00487cba", "comment": "Malware payload (Mirai)", "value": "b956cf479b01cbd9872696aaf2e8e3dff8ca12dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110786, "uuid": "8e1fe56e-ffa5-4cd4-aba2-22dbf94ca73c", "comment": "Malware payload (Mirai)", "value": "83d1c2a771282f45fe174f00dccfa460dba2ebb2904eabc62eeaae7c73bab264f0d73f5a2db913745c299fa493623f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110786, "uuid": "f6b820aa-ca1e-4c0e-8c6a-ff4879ea8477", "value": "T1A6148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110786, "uuid": "b1bd7084-9f6e-446b-92aa-2efc47667d36", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCRyUKG:BcYFAJ9/hjzsdjy1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110786, "uuid": "e84d0f74-bf0f-4bde-93ed-a8ba6a085267", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110786, "uuid": "5481d0a8-f1d3-414a-8cbd-7a5dac65fd6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110786, "uuid": "a85a7f51-528c-4af9-a69c-61fb5ee29129", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b8c85f-015b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770162636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162636, "uuid": "421e9f45-621b-4085-979e-23eebd988168", "comment": "Malware payload (Mirai)", "value": "fea396e2fc8bf0be5691708cd3cdfdf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162636, "uuid": "25bb9835-4a2c-43f0-9634-a4af9b003a30", "comment": "Malware payload (Mirai)", "value": "2b2a40645e55d9471e02b6ae11fb187819a42dd6ab3928ae352ea0be7186911a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162636, "uuid": "cb3651ce-748e-4153-8d02-eb074be0dadc", "comment": "Malware payload (Mirai)", "value": "7dc729d8318276ffbb5844db0d23d6e3a9d44d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162636, "uuid": "63f872e5-5a9f-4005-ab8e-58381f87b5a5", "comment": "Malware payload (Mirai)", "value": "427587aa0db4526f6548116520f8b4456fbd0759cb86ac7d6eb1ed1a33d3aebc835843dc737c84cc048ca64904bed973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162636, "uuid": "8e3ba900-c68b-4103-a889-7e21df7da6fa", "value": "T14493A44F6E539FADF32C83744FB38B3A6695239633A0D185E26CD6111D6024E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162636, "uuid": "dbd06559-7887-4ea5-95a7-67b2f776c559", "value": "1536:bP5rDZQE4u1jC1jf6j4foCEsxMdg97SJc6w1B:bP55QECoKIm7mcx1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770162636, "uuid": "57bdb1b8-0776-4834-bb20-5f30dee13a82", "value": 89112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770162636, "uuid": "f274ea4f-6e3c-47e7-9b72-24cfd597fd6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162636, "uuid": "5a552201-4dc6-439d-9a7d-aefaea86910d", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e03f17d-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139032, "uuid": "fe677d0b-e84a-409a-a389-07a55c753b7a", "comment": "Malware payload (Mirai)", "value": "514812e0f0a5994858719c18101a8cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139032, "uuid": "c6372c8f-b602-47fd-8e59-d7b728c205d7", "comment": "Malware payload (Mirai)", "value": "2b5e29a48d27e3a85172e62d36daf4c122494b31551a9cfd030ee3181a90b053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139032, "uuid": "efa16cef-fedf-4711-8704-ac975e8e0110", "comment": "Malware payload (Mirai)", "value": "218538c2699e23ac482bd79cca1bb9c1f827f8a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139032, "uuid": "9818c8aa-03ce-499f-9291-0f78bbb73729", "comment": "Malware payload (Mirai)", "value": "e3a5a5e062c3527de77c0a332fe4211091d192d2bfba8d10982bb955b34ff98c6bcdae9791a2058c32cfda6807552c70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139032, "uuid": "bec362b2-55b2-49ee-8e0c-6dccb189bb65", "value": "T123E31A56E7408B13C0D62B76B6EF424533239B6493EB73059928BFF43F8669E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139032, "uuid": "afb67c8e-fe04-40be-8126-519f6af6aaee", "value": "3072:Uo9zhzsmB4oIavKxl92R1b5nnUw5iq0mB+S5+M/91P/MQ1GHLN:UoZh/IavKxlURfnUwhz+SgM/9NMQEH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139032, "uuid": "a393aa5a-9c66-41a1-939c-c9bdd4dcdb4f", "value": 149192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139032, "uuid": "39c40069-8041-4277-a501-d11eb19e55a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139032, "uuid": "0040d580-c7fb-44d0-8eb0-50057a48f0ff", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e388246-0110-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130389, "uuid": "64d68cf3-02b4-4592-9f8d-08670a468033", "comment": "Malware payload", "value": "3f68652a79696cf8be50cebd36cfeb27", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130389, "uuid": "3dbdb747-dc2c-4792-8e57-4d66faef5ecc", "comment": "Malware payload", "value": "2be95778a0cfec7e4527184c9aa3b41d665f80f015d2e66d769da0383b546ce5", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130389, "uuid": "f29cb2c0-ae16-453c-8774-2e290e3a3130", "comment": "Malware payload", "value": "1df66127562858bee6e665fff260e14f5bcca525", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130389, "uuid": "91988946-08f7-45bb-ad4e-e9c21d445d63", "comment": "Malware payload", "value": "a2bdca522bc265d839491525ffdb43885719d38fb7258589a24f7f689f2c5632daff33d4dce40becfa00f61fd9d5555c", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130389, "uuid": "d67e162f-7138-4d9a-a048-64f42c47db6d", "value": "T1BE86F132F947A036EDF219B393FE5EBA29755C586B29E4C3A5C439C045324D322F924E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130389, "uuid": "f94f75e9-b2db-4c37-b981-c0a24e1b8e04", "value": "6a557efdeace28a169f628a301e31cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130389, "uuid": "f5932c1f-0631-4572-9503-7ab74c59f852", "value": "98304:J0CaRvn63VQHM9HXLMqEAVlLcI7PpNA0sw2Lw8EoRzbB1TeFYfm9WknYI+px4Suc:e/RC9A7IlSSUTe6NWewZxncOq3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130389, "uuid": "833aae80-7e80-47f8-b4a0-bb606080fdd3", "value": 8168088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130389, "uuid": "6b9f9f0e-b441-4f83-8013-e4178e786e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130389, "uuid": "83aec66a-88a6-4f91-9eff-e4f1c17af313", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9a9eb2-0127-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770140345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140345, "uuid": "efed67b0-b4ee-4c5b-8cfa-103e411591f6", "comment": "Malware payload (SimpleHelp)", "value": "c17f15001dba884eb630ddf8c0ca66b5", "object_relation": "md5", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140345, "uuid": "e94b35a9-7ce6-4fe0-a0fc-335a36ea053a", "comment": "Malware payload (SimpleHelp)", "value": "2cfef9ec0d1cde4d45eabe5efee971e4504dd0e0d0eaa3f14ad1c55f012ea2e3", "object_relation": "sha256", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140345, "uuid": "23c6f75e-7eb4-491b-8617-a06aea747171", "comment": "Malware payload (SimpleHelp)", "value": "bbd06c6acc5aab8c6e6c8693b797640b86a72dee", "object_relation": "sha1", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140345, "uuid": "fa6bdce6-3b43-4146-a1cc-af3a48b8dc85", "comment": "Malware payload (SimpleHelp)", "value": "050fecb6dabf7675278c6bceea4b3b7a1947044c5f535dedb096593372491049c941f7ba2227b10a59314f6ca1eaeb93", "object_relation": "sha3-384", "Tag": [ { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140345, "uuid": "0de73fdc-ed2a-4254-9dd0-699559ec2969", "value": "T1143733593ECCE03F7CFF1A6B20B9621D1275428E53E4A4276B32E50BDB597077A29C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140345, "uuid": "1437f905-84e8-46b2-a7f2-fa6922432d66", "value": "393216:XjOZJiaYPnKCoEHFCFQu6mhwLRwCV25qNtuLkpt12h0EIPPW2mRG:XjObiRYqFC6uLhgEENtuLQt5PDm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140345, "uuid": "38e6fd78-79fd-4913-bb54-ee125472520d", "value": 22463385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140345, "uuid": "d5eb061a-34a3-4d53-91b6-f8ea9090c273", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140345, "uuid": "e6a62d82-11ff-4f8d-8528-99d65d3469ab", "value": "eStatement370194931.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3cf58a-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130892, "uuid": "0e9a64e1-b62f-4c98-a684-d4ce9f0f83aa", "comment": "Malware payload", "value": "0b481a82572900e846a01c5538c02f97", "object_relation": "md5", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130892, "uuid": "173b0773-d247-41d2-8b4f-c6e48fd6355f", "comment": "Malware payload", "value": "2e92bebc2ba43da251e6e3da4c45997ac97c40882bde1797be6ecb5eb2de2edb", "object_relation": "sha256", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130892, "uuid": "9ccffff8-8b26-4d3e-b46a-5cb0136d5103", "comment": "Malware payload", "value": "58395460191328a15221ff1685c1fc1f7076be7f", "object_relation": "sha1", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130892, "uuid": "a84d6129-7b94-4bf1-be84-07b02a538bef", "comment": "Malware payload", "value": "ee01122df09c6c19853d7128738440df2ec80393bae99fe26d53374eea8dfb2f5b498504128973cdb1e792e977c8a969", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130892, "uuid": "602d54fa-3678-4ec8-a795-094c457de25c", "value": "T1A8178A03B2A78DD2F8FB1A35A5F9522B8926BD086F3280C751443F7B4C332E156757A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130892, "uuid": "95eaeaed-ed95-472c-8080-ccccdb6f74b1", "value": "d925af022d801d3a21eb63c20ea317a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130892, "uuid": "7261b85c-9b90-41a7-946b-aca3f3315085", "value": "393216:XwaLNDf1CPwDv3uFtbZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/S:XVeuuAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130892, "uuid": "d0344cd1-6164-445c-a7a4-340c4e145afd", "value": 20119072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130892, "uuid": "191e7b35-9cec-4bbb-8332-55f88d153d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130892, "uuid": "e6f14b67-3e68-490d-908c-3e47d1fb5fff", "value": "python38.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8698297-0143-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770152686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152686, "uuid": "829e2a84-3c07-4dda-99cd-e074cb8bdfa8", "comment": "Malware payload", "value": "dd550562326661afec6d33b1e3a7fd6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152686, "uuid": "a7c2bfb8-c006-4633-98be-2b64dd33649e", "comment": "Malware payload", "value": "2ea364bc30ebd06310c7671516e907c753881f9ae4490ed0ab2064bf9f8a8307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152686, "uuid": "6dd1572c-0e9e-4fb4-ae52-400dbf25519b", "comment": "Malware payload", "value": "e5c361abf0e49e6e3790fe1c89fbc46dd1735591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152686, "uuid": "8e4d1df4-df3d-4221-bef0-504e68c18100", "comment": "Malware payload", "value": "dc5afb032dffacc8c73feaaacad01842f9cb490ec411230b8b58ad515e9abf774ff813938c534421c29d8860cfa436ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152686, "uuid": "f2dc7169-a3b0-4197-8e44-5e192e52eee9", "value": "T19FB418257FE58E10D490157E8A7E3A09CB16E0F22502A3473706F7A24D45AEEDE2D3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152686, "uuid": "1234493a-c516-497f-99cb-f005fcc25739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152686, "uuid": "489af24c-c889-4b04-9415-268d0efa7a60", "value": "12288:GgOiBbg6MkYRLfiEYE5iitXk+bMt4aen1o1xAlc:ls0daeD4ayAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770152686, "uuid": "cc43caa1-d5f7-475e-b7fe-f1901971199e", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770152686, "uuid": "89b9d54b-29a0-4939-b85e-fa6c2d9fabfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152686, "uuid": "25b5bb19-0da5-4e83-b4b5-afe410f3b7fb", "value": "2ea364bc30ebd06310c7671516e907c753881f9ae4490ed0ab2064bf9f8a8307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a55b9f-0119-11f1-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1770134446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134446, "uuid": "cddafea6-f48d-4647-827c-7ac00740c989", "comment": "Malware payload (UmbralStealer)", "value": "4a0228521ca91336f8f8a7a4eef73e22", "object_relation": "md5", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134446, "uuid": "b0f1844a-9fa9-4343-8d79-f9ed85642422", "comment": "Malware payload (UmbralStealer)", "value": "2f36a482396284c90ea26bbc9a57f38c1273c20aa8c2b96087c0a1c281d9327b", "object_relation": "sha256", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134446, "uuid": "220829f5-26ef-4df7-a36e-771ad4d64cf1", "comment": "Malware payload (UmbralStealer)", "value": "6262daeee753722df60ccc8d240e122ec7d32902", "object_relation": "sha1", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134446, "uuid": "47bf181f-9f02-4091-96ab-48b63df12d01", "comment": "Malware payload (UmbralStealer)", "value": "3c4cb54a6595f85cb22f182dfa8d384663b083b18a4be4758d41eb70f8e40f511308b25f74c4ddff7c4abbe34d3d78ea", "object_relation": "sha3-384", "Tag": [ { "name": "DivulgeStealer", "colour": "#E4D94D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Umbral", "colour": "#E07450", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134446, "uuid": "821731c2-a4f5-4dfa-85a4-aec4bcef8591", "value": "T1C2347C5463BCCB13F35F9FBD96B1549B8B71E107E80AF78E0C84A8E82856B41E845E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134446, "uuid": "8afec765-15df-45eb-84c5-8de44161bb3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134446, "uuid": "b60c25bd-4e9e-404b-b87f-7fc4a8c890f5", "value": "6144:RPKRtufdY7vzXpjYgV53GUEMlqJ8eFNLZ+y:JG7vzZXW+4Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134446, "uuid": "8038ff0a-d560-452c-ab7f-e0ceeb17fc9e", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134446, "uuid": "9bbc94fd-02da-4684-97ee-fe5e4276bf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134446, "uuid": "ab1d1719-6aa3-459d-9cf3-dd142897d7aa", "value": "2f36a482396284c90ea26bbc9a57f38c1273c20aa8c2b96087c0a1c281d9327b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e652a444-00c6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770098969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098969, "uuid": "b74e7266-790d-476d-81bc-268a56db56c1", "comment": "Malware payload (Mirai)", "value": "ddee72d2ed04eb12094d01bc43763840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098969, "uuid": "54c2f979-1b12-445b-be13-5240d0154a4f", "comment": "Malware payload (Mirai)", "value": "2f72116275ff18f0d7a787390a653e902de12a73410df2b927ee16c74d77d8a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098969, "uuid": "3d838313-c2ff-48c5-929d-2d1810292535", "comment": "Malware payload (Mirai)", "value": "ac95db084e18fde22e65fc529f34618b8711f188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098969, "uuid": "293b5705-a5a6-489c-825e-947584c6069f", "comment": "Malware payload (Mirai)", "value": "9a2087d347045606823425bc5859199e37a2e10fd1eec8c05186a2cad132e9e431e158e1c715115216cd951046533d33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098969, "uuid": "98b42139-6683-4888-9ffd-67ca4cd72c07", "value": "T10C3302D073CD8050D4A846357697FF8A0F90F21EA6C4C03959AA1A2D9D7E5AC7D2D3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098969, "uuid": "11c8085b-fb07-4693-bdef-02d8f9917389", "value": "1536:Ay+va1I73pU0R2r+lhiHFNkL8y6YL1S8hrAv9DJ4Inouy8qqn:VsGIdUuKOACL76YL1raVDVoutzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770098969, "uuid": "d059f859-8a3e-46a7-bc83-81ab6e758bae", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770098969, "uuid": "50c99067-d670-4cf3-a157-2cacacebd9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098969, "uuid": "7c5d5172-76d7-45c2-9f3a-a8618f55991a", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dd1a75-0132-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145193, "uuid": "da025b48-b995-4542-8f2d-bfef894504df", "comment": "Malware payload (Mirai)", "value": "3fa263572e42a7bf1c30f307f65dfb0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145193, "uuid": "a4d17caf-a9a1-43d7-bcf5-587bc39e5588", "comment": "Malware payload (Mirai)", "value": "2fce8de8728f1291b308fa7f5d4f096e83e4bc90df63645d7de50e7c62463934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145193, "uuid": "9cde4014-13a6-4d41-816d-bc6fe17831e4", "comment": "Malware payload (Mirai)", "value": "bbff3f755b1e2891791cb74784632b602662f5be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145193, "uuid": "7e16a363-c6c9-4050-af55-ed33aee0d0d6", "comment": "Malware payload (Mirai)", "value": "fd29ace3894afff8036e73c8c8c9aadcb6bc18b5d62dd88a77c26564690e3638c60be71bc9df21fbb6b7fbdcc0aa411d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145193, "uuid": "526648b5-a3a6-4a10-9884-859d5f79cc6b", "value": "T11A438DBBC9A96AE0CA44817465288AF94B23D804A6D73EF5DB938D534007FECF5063F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145193, "uuid": "de4beaa8-48b5-4d82-83f6-a0c7fe0e5335", "value": "768:2/FB7hLOnabM/seRIcYro3APoDJWqYHREoveaLH9CAkYFn79:2/nV6nab35dAD9YHhGo9CAXF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145193, "uuid": "3071ec44-731a-4347-99ec-2ff03cb07714", "value": 58872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145193, "uuid": "51ac24f0-7e22-4eeb-9602-672d64ee3108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145193, "uuid": "54f11915-ad27-4f38-b107-f953c6921825", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990680db-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143507, "uuid": "c442a700-9f6c-4746-8465-6c9409d79d10", "comment": "Malware payload", "value": "d2fd4011982f03ba941dba132df36174", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143507, "uuid": "d1985349-ef7e-457b-9e6b-5c8cbdec3841", "comment": "Malware payload", "value": "3037aada46566ff175d353b4322e6f9c07462e935ffb1232f2766055372a50c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143507, "uuid": "bc1210ec-6a37-4105-bd99-8ed1778bd133", "comment": "Malware payload", "value": "f40406b0b95cf6c16dad825becd5567855001c54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143507, "uuid": "8b034069-1bc3-4e71-a297-069d0141f6bc", "comment": "Malware payload", "value": "c371e171416fb5f2302b38cb206b51ca9a055531aa960b502c84059ab7666f71f6bb69761ec242d9fa1c32a8c26b5f14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143507, "uuid": "7d699444-e724-475a-92ac-074f869d2895", "value": "T1C7B0489B3684CAA6863C996C3221B42680FA88791BAE8B844B5800C6844752C79CA662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143507, "uuid": "cf4802ec-26aa-4348-b29e-f171d1bdf1d6", "value": "3:L6F8iuqDjWl0+iu+BzS/RIUiuzypiuIMCnN:L6FGqXk0Q+uIueZxCnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143507, "uuid": "dd98c3ac-74a5-4c74-8461-f8146182d9b5", "value": 120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143507, "uuid": "dfaa22bd-5595-4365-9d32-75704c5d009a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143507, "uuid": "64b8a598-c28f-434b-bbe8-6a6ac37c2a0b", "value": "r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154db827-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128683, "uuid": "1253c763-9276-4924-8d4d-7964c68abe56", "comment": "Malware payload", "value": "ffa6aef8daee9bfa46153bcc2454c3c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128683, "uuid": "84d287c6-8e0f-4433-a565-a40358ea94aa", "comment": "Malware payload", "value": "30502bff49d33b2b04296daf4c0e8ba74e37377baa2ffc5efe6c949f02e95df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128683, "uuid": "074c7bcd-fed1-4c85-b031-664a87555480", "comment": "Malware payload", "value": "8fc24e5fe67b2d95eca33d71db6e8b8f2d9c50fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128683, "uuid": "8a5835ad-ed8c-4027-a597-d741ade255b6", "comment": "Malware payload", "value": "9c7333436d49f0c126c2f545f97c22ac6ee663a2f76e2017dadbe1a5c10a1a7fef0b2b5f1f1b12c71e65f0c41fd65bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128683, "uuid": "0ae7a203-b129-4666-aaa6-8183156d21b6", "value": "T18C7623EA354D339CD41EC73088237805B2FA512E5FF9992A31DBBBD07797425DA06B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128683, "uuid": "793e850b-b08e-4b98-a542-d4effb88eebc", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128683, "uuid": "c91729ed-5683-4117-82f7-168baf7329ce", "value": "196608:UPHYb9+OU9UpRBc8irAPg9eHVmcwlId8E9ixbs:uHI/UefBc844Ycwao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128683, "uuid": "014cbc2e-dd6d-4df8-aa78-abf4a8c4c6d6", "value": 7773696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128683, "uuid": "f54e0817-830f-43a9-b693-b6c6c61ee279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128683, "uuid": "ae1be72a-f0c4-4a92-820b-895b5d23dbf5", "value": "SecuriteInfo.com.Win64.Evo-gen.49995864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6267211f-00dc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770108196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108196, "uuid": "80d032a2-8320-4e3a-8f15-0dd2a8f8e630", "comment": "Malware payload", "value": "d8905a09f3acd32709ad5a20d504530c", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108196, "uuid": "f506c351-0677-467b-8d89-145655ad0be1", "comment": "Malware payload", "value": "30cabec3881131d8893b8c66d53ab133d73894509e05806e65b4cc8d8a1f7828", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108196, "uuid": "c8dc43a8-2bb1-48f8-a736-65d4b4ecc781", "comment": "Malware payload", "value": "c290008d5416086dfba068b921f2896fff637974", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108196, "uuid": "93951144-cfbc-4143-9ab5-7bd330e1c512", "comment": "Malware payload", "value": "7f4213a24691c30413be4590cf0caa3da3f0b1a6835347fb57ae03b2275b0f67fabfc53edc3a428fc4c2e45c58fbaf16", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108196, "uuid": "60754a94-a667-473b-a1b6-cac716afb978", "value": "T13743C0D25A18843402513D5E72B6A936B924F3EDE0CE5B0346B2F9B0B6F144F2768EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108196, "uuid": "e05dbded-bdb2-4cfb-8562-4bdd2cfd1941", "value": "768:rmtOd7+yb+WLFIFaKKKmwkN41zffH+++0gg340o8h8uuuuucVVV2yyy9UIjUIjOx:CqdLFm+41zffH+++0ggjL6UUUUO9Tfvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770108196, "uuid": "75e8e249-dd1c-47f5-9441-99621d95bc21", "value": 59783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770108196, "uuid": "905be989-3c1e-4fb7-8bc1-7ddcd5fe45a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108196, "uuid": "67eea2db-3be9-4744-8310-2b6809ced55e", "value": "4_11_2_1537_03.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13271879-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128679, "uuid": "3a0f229c-c86e-42fb-8650-ff5afb2a11d4", "comment": "Malware payload", "value": "17d561dd2cfc24abb2bf9e609c81cce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128679, "uuid": "22aa4b45-0d86-46e7-b81e-bf692b1804ee", "comment": "Malware payload", "value": "312549551dd5a9f42ca2efa6674a7725db67077e37394b65f9cf260c3d94955f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128679, "uuid": "24611130-8dfe-4ff2-87f8-a5bad2aee268", "comment": "Malware payload", "value": "7edfa157541aeed857f43c07c158be0a08cb4ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128679, "uuid": "baa34c1c-8ac6-435a-8c8e-620464d5e43d", "comment": "Malware payload", "value": "ec8f535df0ee1c3640fcc3eb207b74a6633e4360a91e446c242ad10576d1d708bd95e58f452cdcfcc965070b4ec8fe15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128679, "uuid": "ef57a6cc-d4e6-4a8e-976e-e1ccf42100c6", "value": "T1207623BC714D7358C01E87795433AC42F2B9161F42EC85AAB6DFBB8077EA410D94AF4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128679, "uuid": "915ee984-265b-4258-b1df-94c24d121321", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128679, "uuid": "6547133f-3522-4fb7-86d0-85ac365ecd48", "value": "196608:Fr2LjZSeTQDTSNVF5ul9MYBBNSzs3gHsG:mZSeTQDTSB2aeng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128679, "uuid": "591d733f-941b-427b-b47f-c5a866384c0e", "value": 7753728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128679, "uuid": "fe0f774e-2759-4df0-8fb1-b4d2322ce556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128679, "uuid": "217fde59-a62b-416d-82b9-d6061ae90ca4", "value": "SecuriteInfo.com.Win64.Evo-gen.96627693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb83d91-00fa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770121151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121151, "uuid": "15e99a54-5857-4471-9df0-c10a2e4b2f04", "comment": "Malware payload", "value": "2b4a9436c528e9268f259ed3cc69e6fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121151, "uuid": "22099e29-16d3-410b-bd96-00ecb00682a5", "comment": "Malware payload", "value": "31341b8a0fd327a98c4208b690640a3afce52abe9a9c598b497bc611af55f92c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121151, "uuid": "35f4a218-59b9-4113-8bd8-b2cb8070e99e", "comment": "Malware payload", "value": "326bf8a2cea5eb6fb32f0d87e5ede0000c7fdd18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121151, "uuid": "9e6f902b-12fd-4322-848e-1aef10022735", "comment": "Malware payload", "value": "6e5f397722d8b1bd043d464aa00c8849f8c886c0b7252e332a8eb0e300c948a23f84504d786563b4d11c92cfe8aaceb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121151, "uuid": "61c335da-e722-4a18-846e-30214befa1ed", "value": "T1ADE423B37D7E05FDEC996F04E0C25EBBB33D66CA65C2D8D90336630AD81DAD208A5464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121151, "uuid": "87647665-3569-49d2-8920-e32dca1cfe31", "value": "12288:SI74X9cHbU1yzmsWQlvTed1up3903TPrlH9L8dtIjsFwp1NBjhZrpwC15oUPUA5:SaoS7U1yzGQhoupe3rpdgKEwPNZhFPUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121151, "uuid": "7176f3db-d7ab-40b5-977a-afb011b4e63f", "value": 677429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121151, "uuid": "defb7201-a7d7-4338-82bd-9c5af3153382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121151, "uuid": "4579f0e1-936c-4fc1-946a-178cbe3dcb59", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b41316-00f0-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770116710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116710, "uuid": "cc489deb-a22e-47da-8630-99f6098e8971", "comment": "Malware payload (njrat)", "value": "357ce300a82dd7255ff1dfff2f41dfa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116710, "uuid": "09b3653e-51c3-4785-ae2a-1c2ae2185c14", "comment": "Malware payload (njrat)", "value": "31969eac0dfce98123ec54c284d3e895242342f623d80aa9ed94f562c7918454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116710, "uuid": "32e96c2d-c26b-4649-9412-04e89ab365a6", "comment": "Malware payload (njrat)", "value": "2f9216e740c7648aa407867a5e36e39d1a1f979f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116710, "uuid": "761c0832-e26f-4a0e-988b-cd0ea7eb2549", "comment": "Malware payload (njrat)", "value": "8d51463a01cd30b28d4008ddb600da9ef1240bbf911332f61a9cd0cafb32eacf1635f1433597b8c83971c395bf9f08dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116710, "uuid": "fa0f6402-6ad7-4f62-a78c-b52fe7e18cfc", "value": "T14593D84977E96524E0BF56F75871F2005E34B48B1602E3DD58F219EA0A33AC44F89FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116710, "uuid": "d1427c05-2957-4fa4-9c77-a5eaef0576c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116710, "uuid": "4e559b44-c814-4900-9543-864e63074f58", "value": "1536:y2KPWSwWbaDNul2O1qjEwzGi1dD5DwgS:y2bPWbaDNu8eTi1dlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770116710, "uuid": "12741af9-02b7-4662-bfec-c6643c832844", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770116710, "uuid": "17ba4c70-3ca3-46a1-92d3-eb67583db270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116710, "uuid": "2ac56597-72f5-4c02-a91a-7b803e4858e5", "value": "CelestialUPD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6dcc06-00e1-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770110419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110419, "uuid": "10e379aa-a491-4ba7-aa90-835fc73c0d04", "comment": "Malware payload (Gafgyt)", "value": "2df216e6c01b82b90a5cd528a5695dc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110419, "uuid": "85b461a7-200e-49e4-aa0e-df21a7b0d555", "comment": "Malware payload (Gafgyt)", "value": "326edf8286a81926b1a445ba0bd175023f459d7f97b1183291cca68950319b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110419, "uuid": "f321f92d-a9a1-434b-a874-ce1db720b0c3", "comment": "Malware payload (Gafgyt)", "value": "4d46b8b4e47c73913a27b890f4a1788fc89c5bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110419, "uuid": "eced7202-d278-4dd2-9f0e-55119fc41232", "comment": "Malware payload (Gafgyt)", "value": "4e09df5cbd41d75222d3bc0414cdb2d983417d5dba096f626aa95148a2d9a0967ebdddc9f925d6afe7c36338c86db273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110419, "uuid": "2f026b3b-fc64-4b72-a446-4f53be8b8840", "value": "T1015302E050F5B465C62293B662044F0A268ACE92BF05DCDC30CE135B6D8AF9F1F995E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110419, "uuid": "52a5c070-e9af-499a-b98c-d92ba314533b", "value": "1536:XznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6vTNs/Lkg4azHT:TrREB5taUVLQlwtt0rG/LGazHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110419, "uuid": "624244d2-cae8-4622-9909-df316bc956e6", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110419, "uuid": "f7545e5e-a921-4d64-8f87-a1d941eebdc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110419, "uuid": "64c8d57c-f85a-435b-acd1-525ad6557ca9", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5ed918-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136798, "uuid": "51bc63b0-6b30-45f6-bd59-061853b05438", "comment": "Malware payload (Mirai)", "value": "6c074869a0b99686a88c3e0b1e0351e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136798, "uuid": "6b36b2c4-235d-4151-996c-890f87054abc", "comment": "Malware payload (Mirai)", "value": "3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136798, "uuid": "b0ac4c46-d58d-4b3d-8b85-48f82e703793", "comment": "Malware payload (Mirai)", "value": "bedf9b962e138739ab113da34a3cb1c523602019", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136798, "uuid": "aac74b31-5753-43ca-a56b-d761177bb66a", "comment": "Malware payload (Mirai)", "value": "dafbc2f42603d57d0ed3e2cb46ef24e12db9fabcfff23b47131569de70c9cc1e56adf3fdf60c9548b94ee15ab9659de8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136798, "uuid": "621fe789-7453-4d7c-9ccd-ff083d15c501", "value": "T1DB5177C5B31049F5BFF15E96B2B48404B088A092AEC75AC9E6FC75FA844DF0C7C52967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136798, "uuid": "d49192ce-daab-4121-a97b-cea8fc187cf8", "value": "48:vzybRz3vRz5jRzHbRzBTRzdubRzouoRzRjRzKrRzLbRzH9Rz7x7RzAfRzj9e:vzyNz3Zz5VzHNzBFzMNzoVzRVzKdzLN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136798, "uuid": "078c39aa-3da9-4ac3-b155-93e4e4cc3003", "value": 2695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136798, "uuid": "f2ef1e6a-b291-477a-8844-46422c18cdf1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136798, "uuid": "7427245f-2fae-4a18-8b89-021649ac1afb", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8547e57-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136795, "uuid": "86167f61-d911-477d-8366-d2fb5b88493e", "comment": "Malware payload (Mirai)", "value": "533e607f4d0052baf630bf558b712608", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136795, "uuid": "2d27129f-5d06-40b0-b7d8-f7c3bc0d87c7", "comment": "Malware payload (Mirai)", "value": "3359c7ac7b33795005de4c5818b346a1363604bf9f654bd3c026fb97841b2c7e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136795, "uuid": "0e5def12-30bd-4d7d-875f-b87d49fee576", "comment": "Malware payload (Mirai)", "value": "d474209d0b6b8f582d1fd80c5756fc90acf11430", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136795, "uuid": "7f9aafc4-986c-48d9-bcbb-9f12e7bc1218", "comment": "Malware payload (Mirai)", "value": "0bee2c8f9e015eeee569bdc854e7b55194484d032faabfe7a50e9d6d23a5a0619a31a345eb1c21aadcdcf129b3c4de62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136795, "uuid": "0d778a2e-f50d-494a-aef7-d4b877cd9616", "value": "T137518CC832644BB4BFB159D2B6F580157089E1D1AAC74ED9E2FC64FE014CF0A6C916B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136795, "uuid": "900ffecd-0285-4f68-a26f-47a19dda0195", "value": "48:vzyuSz3USz58SzHwSzBwSzdudzESzoCSzR8SzKuSzLMSzH+Sz7x7UfSzAuSzjWl:vzyuSz3USz58SzHwSzBwSzM9ESzoCSzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136795, "uuid": "88d549d9-6000-4ca2-bd10-367fa1f28b20", "value": 2821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136795, "uuid": "51db4456-1fcb-4592-8627-434afbfd32b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136795, "uuid": "c9a54b6e-ff1d-4e6e-9c47-84ec57296f6a", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059bf43c-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128657, "uuid": "ca34b305-84b5-49f1-9c74-f7843af17cf3", "comment": "Malware payload", "value": "b8f059645a5c77f5741865efbd5e895d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128657, "uuid": "c0a36bf2-45c7-402e-a60f-c98abad657b0", "comment": "Malware payload", "value": "33bfe8099c2871f2a9752ef4d2b4aa585400dc0063319f5da881cf0cb1f5fe97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128657, "uuid": "52592bf7-1198-44b2-bb77-4eff10102f37", "comment": "Malware payload", "value": "59ac4368b70614039fb71bbdb525f14762e71d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128657, "uuid": "7bc1e0bb-a6d6-4333-af7c-baa11bf9ea47", "comment": "Malware payload", "value": "e83f5b0d71c9b4976c44e15b36767069882fcc0758a14061798cc480b44ad5757af56e279c2efdb743a25608f597e38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128657, "uuid": "c9d6f9ed-3392-49d3-8406-a46f59ecd941", "value": "T1A17623BE220D335CC45E87745833FC00B2BA551E5AF9A9AA73DB7B9037D6421C687B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128657, "uuid": "7c10b8d3-2451-4452-a4ce-423c656bc3ae", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128657, "uuid": "e662561e-ac11-4b7b-a98d-b0467873c0c9", "value": "196608:4Y9JkHPbrp6tvsohBXO3vc7wKtVHqCVQH9ADQ8La3Haz:4aJkHPp6JsuXCEVQOc73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128657, "uuid": "2bac6311-e3b3-4b08-8129-2f363786da91", "value": 7748608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128657, "uuid": "6c0556be-238a-4485-bfb4-905faf7e5253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128657, "uuid": "7671ba8c-ec9e-4bda-a133-798f78e4e88d", "value": "SecuriteInfo.com.Win64.Evo-gen.56544868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67862be9-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101763, "uuid": "fc85064b-25a9-45f4-b51e-9dd4db8060e2", "comment": "Malware payload (Coper)", "value": "7b73774c9e8e074d681f695b09dbc1c7", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101763, "uuid": "9b6103f9-9121-48ea-8c97-f7447d31852f", "comment": "Malware payload (Coper)", "value": "340d1ff4143a560c2ca4400a6c2ca6e9448b6392c203ec190893e773b7a00265", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101763, "uuid": "07ab79fd-9f61-4c9c-bc70-62602f230efc", "comment": "Malware payload (Coper)", "value": "2e5c5dcf09190fc8db4c2b81d1409cf4bd9581a6", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101763, "uuid": "053c2adf-8bd3-402d-b385-2e9a28c86f34", "comment": "Malware payload (Coper)", "value": "347ac25526f28a909633a4be96b99a975d3c64a3699c933e54b2a31848d661343829b5466f162ac81e898bf3c723ad12", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101763, "uuid": "87b253c2-8664-481c-9206-8627c359f5d1", "value": "T191451205F39DD217ECBAAA30896B83D4A125BE40CF0167AB3941734D5E716C4DE23BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101763, "uuid": "1bbe406d-163a-4bd5-9857-2e8c5e331682", "value": "24576:vc8MlxqncZnOposrm8oVQXGi94qTKLTDym2iVpzIipwNDQeouXImmnoX4B:vcHjq+OfAgGRqT8TOMVNw9QeouXImX4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101763, "uuid": "5a53b2f4-1bba-4b37-aba7-d5387f46d7e0", "value": 1172711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101763, "uuid": "b8379da3-5183-48c1-88e9-a0e022abb4b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101763, "uuid": "88ae2b2e-661d-4676-b78d-6b48a76b57de", "value": "6effb54_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7123109f-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101779, "uuid": "84127688-efc3-4934-9e60-0f4ea353e9bf", "comment": "Malware payload (Coper)", "value": "cad0bfb90dc75748a37a5ee26fd76085", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101779, "uuid": "3689b980-56ff-4005-b67a-21ac0ad0bed9", "comment": "Malware payload (Coper)", "value": "3434bad9d01dad7ad4e7525a3936c527376699e3505e70171b083c1226f0e90c", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101779, "uuid": "36e71739-b860-4d19-9f97-19d77adf210b", "comment": "Malware payload (Coper)", "value": "454d415aa4d84e9719a185ed6c582cf8c62bdd15", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101779, "uuid": "c12acfa1-8a93-4f44-aaa6-3f15497d9641", "comment": "Malware payload (Coper)", "value": "d1b76b9f3a9b865b40eca5f030aff73ab3d48e8428f1f40adc8ff7d61341da39c4aab8a31d97db001ff3d9f4b5ede015", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101779, "uuid": "920c7070-204b-4a28-bcb9-5f6105901b55", "value": "T1FE451245F6C8CA27E4BE6A348916C3D0A634BE54DF16B72B3901B30D1CB27C59E1BB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101779, "uuid": "c046765d-0f7d-4103-b293-3b28b5dfc2d5", "value": "24576:kuAhKnRpDw+fSfQUO2hFV59D14usPMgfHMEGJkKpBcj8M:kuSKu01T2rV5N1hskgPMHCnj8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101779, "uuid": "c5ff213d-30af-45ca-82a3-10ab4d5b4ec5", "value": 1176787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101779, "uuid": "f3371c52-6838-4457-a1c9-fbf6044f1ab8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101779, "uuid": "9e527a9d-0376-475c-9597-f769789cf29c", "value": "b69a147_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901d5192-0115-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770132754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770132754, "uuid": "84f2b14d-6c9d-4727-9e9c-9682eeb75481", "comment": "Malware payload (AsyncRAT)", "value": "630b555543697f3cbdc25344c187a416", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770132754, "uuid": "7fb14718-3c86-4c95-b1f6-ba9c186e1545", "comment": "Malware payload (AsyncRAT)", "value": "343ec0a4898fb3a52c40b54fb4989284f32d9162fda6daf849654787d34de79e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770132754, "uuid": "c1dd8ab7-ff70-46e4-afed-ece09e87bf0b", "comment": "Malware payload (AsyncRAT)", "value": "21bf8f9b600b188c7f668d826b40d5663294dc62", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770132754, "uuid": "145da235-e2af-43fe-be6a-530849ded19c", "comment": "Malware payload (AsyncRAT)", "value": "b073c68593dd0fd77e42ff58451cbf8285924c8c01a3fdf308a3887928da9ccaaaeb218a879352460c20646ae10729e6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770132754, "uuid": "5278f5f0-65e9-4059-8e76-d246d33de50d", "value": "T118E23B4877E04312D9FEAFF02DF271091275E11B9913DF5E0CD889962B67AC246507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770132754, "uuid": "6fa5d639-6347-49ed-8946-faced8f42b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770132754, "uuid": "2660d020-244f-4e71-954a-6d9ad96d625f", "value": "768:f0dT+x9p94nvGFbO75VCDFo9jTOjhPbu:ST+xt4n+bO75VmFo9jTOjlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770132754, "uuid": "102eaf4a-3383-4fd9-8993-83b6aa804ded", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770132754, "uuid": "1d17cc33-4f90-4743-8e4b-8e2791b13823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770132754, "uuid": "386e192f-eea9-4649-b92a-5bd75c10c1a4", "value": "343ec0a4898fb3a52c40b54fb4989284f32d9162fda6daf849654787d34de79e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1325803-00f4-11f1-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1770118690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770118690, "uuid": "6523c50c-e0b1-4813-b19d-876f38ddb9af", "comment": "Malware payload (SpyNote)", "value": "4381c3a1cd22d63ace1f0a812edb5cdb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT APK", "colour": "#67C354", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "TG88.apk", "colour": "#7B1567", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770118690, "uuid": "e544b807-d7d2-4f40-a148-74126fafb5a7", "comment": "Malware payload (SpyNote)", "value": "34670aa23c3e50240fab2f820652f3f5d6eabf7177c6d6d4bba6c39a7b11aff9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT APK", "colour": "#67C354", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "TG88.apk", "colour": "#7B1567", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770118690, "uuid": "03191f08-cb22-456b-b54d-9018b44c02c9", "comment": "Malware payload (SpyNote)", "value": "c189da849f78b43c3cb11a5ceb839ee7d506e9a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT APK", "colour": "#67C354", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "TG88.apk", "colour": "#7B1567", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770118690, "uuid": "1aa597b5-09d9-4fe7-87b0-85f64f5b73dc", "comment": "Malware payload (SpyNote)", "value": "8ca25b1a2b1b6b62a9ad6e8543b46543248120cf34a21f2ffe1ef114ea019c792634565c3ff52a8f1ded700377c96c97", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT APK", "colour": "#67C354", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false }, { "name": "TG88.apk", "colour": "#7B1567", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770118690, "uuid": "8880c574-f4f2-4d53-911e-7d646866f4c5", "value": "T1C906F11BDE09DBD3C16C93F87E170DA86A671F48C5416AEB00543EAF3EB62860DC955C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770118690, "uuid": "cca65069-47b2-4062-9505-111efa06e074", "value": "98304:3IFTFiREHf12tXsmto5nD4m16mz3zBnTs0tA4:4FTMRSf1kvtyn0Szd/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770118690, "uuid": "65ce111b-49c4-4a7f-aa8d-db875bbffc64", "value": 3791533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770118690, "uuid": "fc7cd0b9-a388-492c-8e74-b25552755620", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770118690, "uuid": "e7bed152-65ca-4482-8bf9-f1a637d96c13", "value": "TG88.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaab0d8-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131195, "uuid": "7df29764-eb16-413e-9424-f1c2ea08ce70", "comment": "Malware payload", "value": "91a1c4644b310e3d73edf1e55d7d1122", "object_relation": "md5", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131195, "uuid": "6de3c1ff-65f0-4974-a9b5-38f130dfca83", "comment": "Malware payload", "value": "362bff3c31671ce55194e6ca7998a764c78e047454dbde971ab6219d1d5eebd9", "object_relation": "sha256", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131195, "uuid": "0aaddb6a-7075-4689-b4c0-ead33d6237c8", "comment": "Malware payload", "value": "0ce9a22d64ac95e59b0a9d7e0e4db227fb7b9889", "object_relation": "sha1", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131195, "uuid": "19d0293e-b7c3-4d4a-b11c-6c06523bf34e", "comment": "Malware payload", "value": "52ec92ef8355dd59698e603f4fa2496c002ef6282e39e2c38acab2729140fb7bb4bd0d1dec2e57bfd30b2132fa0cabb9", "object_relation": "sha3-384", "Tag": [ { "name": "88-210-10-123", "colour": "#830574", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131195, "uuid": "5e72cc9b-e467-4748-9791-beb16b9723e1", "value": "T10D269F31A981B164F8F524B3B3FB5EB24CD68D69E72690C390D478C885316E366FA14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131195, "uuid": "31a59e68-22e6-425a-b55e-c2b277dd726f", "value": "61e6280acd56796ce5960f49cd77e101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131195, "uuid": "8b2b2dfd-e4b9-4f78-9fba-ed46fc7ada08", "value": "49152:QpHXPaAsuR1qSnW8wrhbNfupzU/mIIfn4HPHnAMTPG+pGT/L4ag6XDJD/VMewKgl:e76b8zkcf4H/AMy+AFgeJDNMTWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131195, "uuid": "e4527a8e-602f-4017-b921-af1e533a111b", "value": 4712448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131195, "uuid": "b61ef69b-1d57-420c-97fc-212cf96631aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131195, "uuid": "b3b1aad8-e061-4caf-82d7-7577de661c3c", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a7becb-0113-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131739, "uuid": "739386de-3279-48d6-b0a1-4205d15ecea4", "comment": "Malware payload", "value": "fd0e1bf22deae02f582a9935644728c7", "object_relation": "md5", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131739, "uuid": "8d9d3eb1-ff0a-4e92-9be8-9a2252006e8b", "comment": "Malware payload", "value": "36baab7ccccc951336038df2ef6ba1dbe81e5c9a51318779514476f2df3dfd93", "object_relation": "sha256", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131739, "uuid": "ce480b5f-d9f8-433f-b62e-fa39fedaf7b7", "comment": "Malware payload", "value": "42f5131542b19ae6c5b3dea10bba74f902518d7f", "object_relation": "sha1", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131739, "uuid": "033d98d0-2138-4c58-bcb9-2ec2700cfa6f", "comment": "Malware payload", "value": "3708618f1992a8327c5f5a8aaee886b00f29f03686737daf74652c0ca2e79390eb315b1f56b88cd861f00add80dfd31e", "object_relation": "sha3-384", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131739, "uuid": "1e1a7a64-c156-4025-b0ac-53410a18b34d", "value": "T1AD954B3AAD53ADA736DCA3D38F939424ECF4817A5A1311F872E841CE3058D469F9891F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131739, "uuid": "22c20357-9aa4-4ad1-a8bb-1a783a1feda4", "value": "12288:WjpFfuizU6hSbanCG0JBab4Lle2/UZ2UGTzo3ff2lQ5FdZ7e2sxP+Mp6n9PQ/mj9:2kiIR5kPEUAKffZRIPrpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131739, "uuid": "ee9f5028-ce7a-4d9b-b9b6-b1eafbf3ef80", "value": 2035681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131739, "uuid": "bd2b5d97-a3ef-4226-9195-fdf5a894deb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131739, "uuid": "82c4dda3-56de-4b95-b8d3-2f50b27444fe", "value": "froelichia.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346790f8-0134-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145915, "uuid": "a59e242d-0ff2-443c-ae8a-421ee451db16", "comment": "Malware payload (Mirai)", "value": "78fd9e7dd34f0c64a7ca9d4c7b00b81b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145915, "uuid": "f85e3fd0-a02a-4ee0-92a1-c10d53317bcd", "comment": "Malware payload (Mirai)", "value": "37511f960894bb1bec92f792eb9a772a6a7926596155cbe3f60ca2b81a04e743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145915, "uuid": "3e2c8a40-7b6c-4a92-be7c-4446126b2fb4", "comment": "Malware payload (Mirai)", "value": "ed8cb5e55edc0f1829e09c1ce3dce60747e9b10c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145915, "uuid": "87796e7a-5a28-4ff4-8be6-dcbca16f2fbb", "comment": "Malware payload (Mirai)", "value": "6d8ae92726dad64afd758ab085c9884168d8ee3642464f2c8dbd3392d54f546233121a91e61b281cb681e808f49fa5f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145915, "uuid": "36cbb474-29df-48b5-8896-10e955528423", "value": "T159531782FC81DA07CBD01336BA5E51CE33257399E1DE7207AD126F613ACA91F0DAB156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145915, "uuid": "26da6b6e-5cde-4f2d-9229-988fd55977d1", "value": "768:R2vdBKuGlXfq3EkjjrMilYKhoB5Uz6uPel3Q+Eg1cmKF4cPpo77HabBNu56upsTa:wv347knYildOUE3Q+FcRXPkXpswm8FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145915, "uuid": "4b6b23d5-eab3-4a0d-8c7a-877b8e034eb3", "value": 63656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145915, "uuid": "08a6c39e-0b8b-4f5e-9f07-0d991c5e8621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145915, "uuid": "b3efdcba-e8f4-4c43-9155-b4b0f207f14c", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a0a0cc-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134163, "uuid": "e62d56fb-4f4d-4431-8d34-980a7b8eec62", "comment": "Malware payload", "value": "46c4cf0a546ef00ad010f64d57f75797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134163, "uuid": "72de0293-361c-440a-a965-545d3b7268ad", "comment": "Malware payload", "value": "383874f35c0a3cd5ddac4a12897831d0b7171a27e0649bdb4e67cb3c6f512756", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134163, "uuid": "36c4c218-0321-40c8-8327-098cf77dea0a", "comment": "Malware payload", "value": "21ae5e56492b2b4626205a4c6d7e159054747781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134163, "uuid": "eb7439ab-fb95-4677-8ca0-5267b20b53b6", "comment": "Malware payload", "value": "32b650b83ccd49be6496a533ddf08cb77dd5e73b51ddd269f8a2cfe55069e966465bd2d62b1d105ee2de3cb8f9ced6b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134163, "uuid": "edec6a76-4ec1-43a1-a924-d0f3f4efdbf0", "value": "T1BBC3F188E9D2C8F1E883C57700D7A7979B30AD2A5055CBC6F34ABF507C30526995EBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134163, "uuid": "f576b2c7-1f5a-4476-bc6d-c3897edc0440", "value": "3072:qa3z5a9yc6DP10CfEggGdlyGpE2BfG6bfTUxlqjBar:qqm10ZmmlyGprCYBar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134163, "uuid": "e6f564da-bea8-4b81-8835-ae7c8ab5d1b1", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134163, "uuid": "d12ac76e-8871-4734-9b8a-91664c064893", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134163, "uuid": "64843247-6871-41fe-9843-67b1fbd118b0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829c67cf-00f8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120276, "uuid": "2103da92-293e-4e68-9993-18c52ee3e9af", "comment": "Malware payload (Mirai)", "value": "ce41c38b92ab2f00cf7cbe6397580bb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120276, "uuid": "d7279bab-6f6e-47a0-8f3d-bfe870554b55", "comment": "Malware payload (Mirai)", "value": "38a61bd124a9326a536056f65f7512fda68c3b183ebc72371fdc51abc72f2a31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120276, "uuid": "01720228-bd12-4bf5-80e3-2e88400ea01c", "comment": "Malware payload (Mirai)", "value": "bda163bb4c13171011ab996ac2e5454b65d58f87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120276, "uuid": "8525b09d-39bf-4b87-979b-569c41021c63", "comment": "Malware payload (Mirai)", "value": "dd95b7b1ec462f90e0000bdb80934c44ee5881585f08203e17626b3efc532c54b7ad3b1c6d4f9ed52838526f4980ef4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120276, "uuid": "ae98490f-b6eb-4489-b9c0-1d360c6ca769", "value": "T118E33A42EA418E03C4D51779BBAF42893322E755E3DB73069D14BFB03F86A9E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120276, "uuid": "2ecc4d31-05f8-4df5-9099-88e22f733eec", "value": "3072:KSV/3YrGDPUWFmupkcHSCeYn5egAXwFHKoU8M/9ImIj:7ZYraUWokkcHSC7QgJ9Ko3M/9Ims", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120276, "uuid": "4a2266cb-66f1-4b9a-bfea-fe8c2781b47b", "value": 144892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120276, "uuid": "43777b05-3e7f-4b64-9796-ab6a0763caea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120276, "uuid": "7cbada85-5a87-4f61-a90c-558b15b5a5dd", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c3ff7c-00ea-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770114072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770114072, "uuid": "0ca7ebaa-d8d1-42be-a6d2-925c04908e72", "comment": "Malware payload (MaskGramStealer)", "value": "7075b3da25915a462ee320f6aabb7894", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770114072, "uuid": "377ba813-3962-469a-83d0-d7379a9c293e", "comment": "Malware payload (MaskGramStealer)", "value": "3937c8dc51758282678f3d3bff8b14c2fea74feac232681381c9a62d51ed02fb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770114072, "uuid": "6c83c340-a3de-438a-ac83-aaa2d860224c", "comment": "Malware payload (MaskGramStealer)", "value": "63350e1c1e461b57b2276dfa90ac3c4558f750b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770114072, "uuid": "7a75a64a-9898-4b20-9046-e92f17aba5d5", "comment": "Malware payload (MaskGramStealer)", "value": "e16df0245c4bd707777e519ce9f7d833bec9a9defb47567c29809d79c0d1a228c9da6581df89ecaa71e889104156f11c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770114072, "uuid": "802ee86c-e9eb-4aad-96c6-e8bf0de0599c", "value": "T172B5333912493FECD8BB9AFA409D46FE666F9B1CE47117481F5782E03037102FE66A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770114072, "uuid": "3c78a5e7-7814-4cd5-a404-8d5fd47658d6", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770114072, "uuid": "579aeaca-2323-4884-a066-87b0edcb155b", "value": "49152:sJZquAIiLzj5MFE/0zYx2vaIHKyAMFxPJ4kubTvDIH:sJw/dvqu/0zYx2CIHVAMFxBsTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770114072, "uuid": "d025286f-1929-480d-9a48-1b43a6ca6706", "value": 2378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770114072, "uuid": "83abb3dc-6509-4202-b853-1d3c483ff049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770114072, "uuid": "c42b5c05-ed10-4631-a682-d31f8f904da6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c114408-012a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770141552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141552, "uuid": "01c0dff7-2e31-4dde-a5b2-bdee69fc25bd", "comment": "Malware payload", "value": "7c783f8b56569d8564988b2a520a3a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141552, "uuid": "04a8870d-ba64-4904-ace6-225da1723389", "comment": "Malware payload", "value": "39877e61c63ab967daf22c6214269ea676159f0ba2bc885c9cf8404503fdbfe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141552, "uuid": "420add98-a464-478a-afd3-8a17eb1bf58a", "comment": "Malware payload", "value": "d3843efb29750a1194d3a1e771fe52ef5dd470f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141552, "uuid": "13d79abd-7bc5-4c22-872a-177f0367c8c2", "comment": "Malware payload", "value": "1639dec64511dd8071af1bdcbf2c227a30024c81a2bf3097c21492580ade2d0c6246486ce3b7664fa096090d7189c840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141552, "uuid": "83c38298-a83d-4a8b-a15d-17a1e947d089", "value": "T1D1D6330963A005EBF8E6CABED563984AF266BD512F91DDCB039053402C731933B7A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141552, "uuid": "39ccebd8-0ff5-4234-887c-3af91d9b9ac4", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141552, "uuid": "b615b417-7f1b-4fb9-9738-82316b04e214", "value": "393216:W85vzabVw5AuCA6mdUSC9Iv7oy1P//wBMbxkh:h5vzeVANCA9qJuUEPXwBM92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770141552, "uuid": "64210040-2b7f-445d-b2ee-e806c521e895", "value": 13748450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770141552, "uuid": "c093a81e-3835-4e22-a5e6-29d9db4f841c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141552, "uuid": "323e8252-329b-431e-bdbe-aedbb446a50d", "value": "ch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0109abe5-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128649, "uuid": "43353c04-d3d1-4a37-964a-b351a3971801", "comment": "Malware payload", "value": "90357f9caaa3fb0379842f2dd3414e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128649, "uuid": "25a9992c-ab09-4f16-8ac7-3b5262e587f2", "comment": "Malware payload", "value": "3a0d7f0353b83622985e3f9dfdeea765ba82f3eb96c5f97a49e2d150f1670be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128649, "uuid": "110fd183-a489-4a3c-b561-a62a81f16a0b", "comment": "Malware payload", "value": "fd09e554bfe840d9496a5693ddd13f3f668e8ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128649, "uuid": "dd07c2b4-c6a5-4519-b517-0f818f31d667", "comment": "Malware payload", "value": "e14343ca377d3224fda077600079df9b9497f2d630ce7836a785c1dc0b23b88771a2e55a5e43b15f83a7046cfead1078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128649, "uuid": "cf9edfcf-f576-485b-b2a5-ce945ee28e66", "value": "T1A37622B9214C3758D41A87B08423B946B2BA521E4EF9497FB2EB7BC477DB830D906F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128649, "uuid": "d2ca4e8e-4ed8-4219-a3cb-84d7c8e2c03f", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128649, "uuid": "52409bea-e304-4d40-a770-610f1587c69f", "value": "196608:Y3Q0A43FU5e8y2hTSM+s4NoYEOw0W3uAKDyU9HeNiBi:qxFU5dyYn4eGw5OHey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128649, "uuid": "4e79a5b1-fa53-4150-96b3-9484e71489fd", "value": 7772160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128649, "uuid": "7bd9f0fa-0810-4b87-a107-77b4c083c2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128649, "uuid": "f5cadff9-35ca-4bdd-8abb-d3e39e185133", "value": "SecuriteInfo.com.Win64.Evo-gen.28864974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4177595f-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139065, "uuid": "bd87a765-6cfb-41b6-8409-ec4bc8379594", "comment": "Malware payload (Mirai)", "value": "33cf0e2c8f1d8a7689e00e43e8e6cc6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139065, "uuid": "a7358214-0dc5-49aa-b70f-4a8c80d080be", "comment": "Malware payload (Mirai)", "value": "3ad8580d98855b7a930dfdb41c16ee2a9dca901f5c1676defb01a633bb68ddf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139065, "uuid": "4f15c3f8-eee0-4af3-a16a-1150060b7467", "comment": "Malware payload (Mirai)", "value": "ffaa492be103488b0eb83352f85662b841270436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139065, "uuid": "c81b90c8-9521-4326-809f-9d151e720e58", "comment": "Malware payload (Mirai)", "value": "ecbba72dbe3697f404e0680a68d01fc4683384e1c6e5e12e2da2e4ec55148ced9f742c37c4fff9f511160270e37a26bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139065, "uuid": "2e36fcd8-2048-42c6-a035-288b6ae9b1e3", "value": "T177032B82731C0447C2622EB0353F1BE1D7AEAE9222E4F389750FAB49C576D339546DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139065, "uuid": "cfe5950e-5acc-4333-b396-bc45528aaf2e", "value": "384:iDMAQRBPcTdFsfonCTwz8ZXvS0no70ezfbINB1evYaO4D5Avd86+UMQn7T0a8ICf:cSG/sdwSq0nodIaO4DNJ4d8I4+D+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139065, "uuid": "825b3715-6073-45df-88fe-9802a7309a8e", "value": 37984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139065, "uuid": "ba160f48-4bed-4ee5-aa07-57ad46682430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139065, "uuid": "d5233f4a-e4fc-4475-9f64-60bfadf272eb", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91f878a-00fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770122515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122515, "uuid": "ac9c5985-bc8c-4302-9b72-4276458ed9e6", "comment": "Malware payload (Mirai)", "value": "001f8cb4564f1ab59207392fd5608fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122515, "uuid": "df109ccd-e2c5-429c-a7b8-87a648c1ff07", "comment": "Malware payload (Mirai)", "value": "3ae5b43af044c95ac0bdfd11fe1dfe5ef37d8d81b83e478995945d49e54ba029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122515, "uuid": "2684c2c7-2aa8-4901-8aa7-c55023c051e3", "comment": "Malware payload (Mirai)", "value": "a6ffe8d0fa8af95e9fab104bc51c08a841c3a8c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122515, "uuid": "6aa28f77-e452-4e52-8166-8de9eba81157", "comment": "Malware payload (Mirai)", "value": "cde7a6e739084ff8c6bced3473948cee35dd04acc8b4676a9d1e1ebf69e39e04b76675bf01f8e869ce8488e9c817092a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122515, "uuid": "990bfb46-90fd-4f9c-8a31-73b974d0ef9f", "value": "T180534BC8E5D3D9F9EC050A302272EF31EA77E13E316CDD9BD3D45A36A992602E54128D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122515, "uuid": "08584ff7-62ca-4180-8a0e-68e6168b9b29", "value": "1536:/kzOIng2n4sSBCu9WsVXLaZvuwTWFvevtDd3hkVD:8hngA4sMTdtLaVtWp+RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770122515, "uuid": "6673cf9f-0f9b-45fd-861b-f9ee96c54e1a", "value": 62768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770122515, "uuid": "4e357da9-928e-4a36-9fdc-bcd952f8d7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122515, "uuid": "abba9b2e-56c5-4616-bd87-f31d5259831c", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9f12c5-00aa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770086660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086660, "uuid": "b9308cf9-df6a-4035-a03c-055d49adacbf", "comment": "Malware payload", "value": "32f3c40b0ed1c5cf23430be7f9eb7b06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086660, "uuid": "d14594bf-6ea1-4dca-8d5e-e9958794b2ab", "comment": "Malware payload", "value": "3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086660, "uuid": "075fecbe-ead1-4eab-b4d4-346f2a48e40e", "comment": "Malware payload", "value": "f7910d943a013eede24ac89d6388c1b98f8b3717", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086660, "uuid": "d7bee361-79d7-4cff-b9be-bf077d014e5c", "comment": "Malware payload", "value": "2bd422d62cc643d7543b5ae321ea0bcadc6c1843b99376e9a28e9e1fd5fe8fb743d058f6b14a8898e120e27261ef9864", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086660, "uuid": "482e0258-d7a9-4d79-a235-b62c2c86da67", "value": "T193835A01B5A1C175E9BE19354428DA754B3EB910DEE1DEAB7789067E4F302C2EE30D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086660, "uuid": "4cd4563d-ec21-466c-8625-73db8fca57ed", "value": "6e0c507abd1e399c9f4a687429fd2bbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086660, "uuid": "9e1eb385-6bc5-4331-9f15-3c627b767f1e", "value": "1536:l37Q8zFxFa/kgno6Xkf4PtmfTitry3LCuBscOp2Z6UsWwycdb0VGl0zA6r/aP:ls8zFxhgno62utcitry3LCuqz2Qfb0Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770086660, "uuid": "c0dce2f4-5dd2-40fe-8451-ff949c7eb00f", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770086660, "uuid": "4cc7c3c1-eb58-4528-999c-55ba020a0b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086660, "uuid": "d2f4747e-1a6f-4008-b2c9-63757d109775", "value": "_3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0272ff5-0110-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770130634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130634, "uuid": "ceac7404-b222-4a73-99d6-51d8be371335", "comment": "Malware payload (LummaStealer)", "value": "382a7fa713abbaf99d2b5f654cd6d439", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3926", "colour": "#F1693C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130634, "uuid": "901f6bda-1660-4ace-bea3-afe3d29c0f6a", "comment": "Malware payload (LummaStealer)", "value": "3d42edad74aa17a791c465be4e01c92869c2b1afaa702c5e16c49796b76e3052", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3926", "colour": "#F1693C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130634, "uuid": "633cd5a4-9a2a-4f7e-b6bc-d470b3f06ce2", "comment": "Malware payload (LummaStealer)", "value": "15130fab65fac3a0a9e9ea42a70f8d6715442961", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3926", "colour": "#F1693C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130634, "uuid": "7488556f-271d-4a92-a1cb-96089762082a", "comment": "Malware payload (LummaStealer)", "value": "e0820110700946bd38e8e114a2d73b9d8f89e55e29b47df0e8e92943db8fe5c0949908a953bcf807a7cb61f5989eef82", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3926", "colour": "#F1693C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130634, "uuid": "be91666e-3cb2-476f-be20-40110be370d5", "value": "T117E6330D7541E14DCC970A8FBED1208B32A2A8D3A4EC1F7DB9E8F4485DDA4F3A663561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130634, "uuid": "1149cdae-3491-4ff3-953d-4995bef357c8", "value": "393216:N+jqr1iEvs4jbSs0W3E7VZqAD8tsicItCLdD6fK+Qm/Zm:N+2rVvsmbSs0W07V9AnEIf/Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130634, "uuid": "086233ef-22ed-4139-acb4-1aa023886931", "value": 14585475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130634, "uuid": "d60d019a-50f2-45ca-8bd8-75bd62c06773", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130634, "uuid": "6405ea3e-2fc0-4ac5-9653-537b7c9eaec7", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18af573-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770101967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101967, "uuid": "664da943-56dc-4870-8a10-4a2162040e53", "comment": "Malware payload", "value": "8e32f7fe1c409b0dcd922584790b901c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101967, "uuid": "2dc6c432-3427-4fc3-beb0-ec04a7e499a9", "comment": "Malware payload", "value": "3d7b67fa8cd8566ba69381623091f97bf59baf31d3135200f1b71c8274b4cf3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101967, "uuid": "bc6cf07f-5188-4fe1-bad1-756d296450b0", "comment": "Malware payload", "value": "35958bbd0d2f2a48347ab4f2768e8a72d0daee8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101967, "uuid": "3669d903-6c22-414f-804b-a93fc03e4a4a", "comment": "Malware payload", "value": "57e38f88ce1200f24e031b200c00955268d838f36608262a6c4978f2f2e7ffeb639c011c90c5ec1bbd8b2cb8fe7368f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101967, "uuid": "fc74203d-375c-4acd-9374-36d29c33be0f", "value": "T1A8259565AFC22F25D19C0BB845ED635B62803B455AAA063613E4CBD43647B3CFF5A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101967, "uuid": "39ec7424-b19f-4fff-ae59-4e27391bdd50", "value": "12288:qXZJFJtREmnHA4O6Zyvh+4pjE/shM8qdW9PfF:qLHAr6Z0h+4pE/shMld+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101967, "uuid": "dc59fdd1-234c-4977-9ddf-0a60ea27507c", "value": 1019923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101967, "uuid": "a0aaf33c-9dfb-4064-9958-30bcacee004d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101967, "uuid": "1f5c8306-9f5d-409b-a2b1-57dac188e211", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a1a299-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143503, "uuid": "c2d0d2f9-c52a-417d-a939-2bee23e2ff40", "comment": "Malware payload", "value": "5cb765ed8ea6ff5339db68b0c1827357", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143503, "uuid": "f6ff5d28-cd4a-44d6-9cec-fd06be8ad859", "comment": "Malware payload", "value": "3eccc5f786b95dc991aab99a98414d03f7033154ce8c682079e15f7dbb27735b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143503, "uuid": "b8eb0941-1e87-4266-b604-6d22efa07e56", "comment": "Malware payload", "value": "c1750a10df8d6285972bc7eedc88ced98e190ef1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143503, "uuid": "120d2482-7e05-4534-91f8-1819ef62deff", "comment": "Malware payload", "value": "0d3d310b517c1c164b09bf605b3184972e3dcd3d35ecc92b1abc16083dcb79e760a88e5530e846a9a5156cb2926cb34a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143503, "uuid": "d14515d9-dcf0-434e-9f66-1822ff0033cc", "value": "T1DB01ED6F3312EB92CA3CA91D32167554F1F797799B7E8B885A4000E6C489A7C309793B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143503, "uuid": "6d062146-f79a-4af2-b834-f0db5897c3ca", "value": "12:SdT8w8T58TK8VndT8N8K8H8wdlO77khdlHG7Bgdl6dJ7GS6dlh87PfjzT:7TTiNw25cMOPklHG7B8oxGSmh87Xjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143503, "uuid": "f4b08639-d0a3-4ab9-83aa-2c04cd8d3c83", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143503, "uuid": "03a210a0-28fc-47f0-abbc-d6b9fc0c0f40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143503, "uuid": "1dd8a6a9-f4f2-4aea-8d7a-0c5281548327", "value": "xc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb2f57a-00d1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770103675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103675, "uuid": "e87869d4-6d01-4646-a000-b03fbfd6c865", "comment": "Malware payload", "value": "feb6baf3885f630d829c3c2c4cbb3194", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103675, "uuid": "7cd4df78-d74f-43c0-a4d3-39de85fed786", "comment": "Malware payload", "value": "3f2bad9ecf216a36a6ef50b12202de1007071ee43b660dbdac8a8937dff9e91e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103675, "uuid": "e0888583-3c77-4b1e-8681-4f5dbaa92277", "comment": "Malware payload", "value": "715f84762c1c612ca7b4323ed14ec058eef1c78c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103675, "uuid": "fc95f1dc-7d9b-4047-9b29-52b17e188fc4", "comment": "Malware payload", "value": "7d94b94b457259bac8b9ddd0d290f9c45bc627bc9455590b5ef4c2ac193e17ee7d2fd94f8758a0c6dfbb84c19f9d3493", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103675, "uuid": "0a85a7e2-b446-472e-9960-a0ff59da6212", "value": "T19CA5334127CCDB88F9C0FBBA206F7ED56D8B9F43978F9166A6B367190D553C02822187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103675, "uuid": "8f73edb3-2677-42bc-9fd7-e8b3aba52cdf", "value": "c0ab9930369e7a7fbc0167da075f29cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103675, "uuid": "f585687e-5f8e-4ec8-aa0c-776b2d8e2f8c", "value": "49152:8CB42RwvS9vHAcPh9bjQ+DiQV1XDq2fF0LrumYS:8J2Rz9vAglBdN0Wmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770103675, "uuid": "b25ea9b0-1d7c-4ee0-9295-8a8be063b8a1", "value": 2076672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770103675, "uuid": "d588a706-9883-49fe-9f4b-6426c59c99b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103675, "uuid": "fad6ca60-9153-4bf1-ad9a-c59591d67e5f", "value": "broscfg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f071a371-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128621, "uuid": "9e783ab8-2f0b-4b8b-9f48-fac27ebf7d11", "comment": "Malware payload (CoinMiner)", "value": "b9372bd12472ce8022df4f39256472a5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128621, "uuid": "159c2792-8ea0-4586-937b-3af808a83222", "comment": "Malware payload (CoinMiner)", "value": "3f6c07ea4268c72b4a81bb18aa9372fdc0b93997b96d0f2295d6107015426580", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128621, "uuid": "e82898c5-5b93-4e80-acb2-c4bbb71daea1", "comment": "Malware payload (CoinMiner)", "value": "fd91ae4872bbaf8b06b74a960582700fbfe29d5f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128621, "uuid": "d9d4a4c3-9982-4556-85be-1dc83badd7ca", "comment": "Malware payload (CoinMiner)", "value": "23cee8aca02a529bdcc1bad84732b74368fbdee5a9640603353573fc200e9279afa40befe97aa1b399d0dbad277f68de", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128621, "uuid": "639a5b4f-3093-4ff4-bd49-c6ff5841438d", "value": "T1817623AE714D33A8C02DC7349133BC08E2BA552D4AF4A5AE73CBBB907797814DA46F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128621, "uuid": "3de1ab0a-fc0b-47e1-9825-1c5583cb8986", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128621, "uuid": "4e90f04a-fd85-41a3-84e3-b612860371de", "value": "196608:PuHsds2Hz8/RZP0YXyo4g/bDnRUUtHBhPnwWcGo:Pyv2qr0Bo4AbDnRrj5nwrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128621, "uuid": "130397cb-2957-4e61-832e-5582909059f1", "value": 7753216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128621, "uuid": "501715e9-6ae5-4dca-b1fb-b492c1b6fc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128621, "uuid": "0389254f-08c7-4582-bb72-8eb7ea9ed5bb", "value": "SecuriteInfo.com.Win64.Evo-gen.11723317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5a2aa-00c5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770098203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098203, "uuid": "003524b6-d5c4-4415-9869-070ab7169eb6", "comment": "Malware payload (Mirai)", "value": "b5f2811a882c4592d4203c445e17be78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098203, "uuid": "4a0d366b-52f3-489f-8371-6c1ee5510813", "comment": "Malware payload (Mirai)", "value": "3fac799fe182b7a5a55c3604f74232e56e3f74a4da11d6f02818d1dead7b5127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098203, "uuid": "28ebe5fe-74ec-47f4-9f6f-904df5058ed7", "comment": "Malware payload (Mirai)", "value": "9866cbc579728fd6fb70746689803dfabd1c319b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098203, "uuid": "6d84e227-03b1-45bb-8466-27bb7b709aac", "comment": "Malware payload (Mirai)", "value": "3ceed09c7dfa466010665d9038d2e4c92a37ccca316e059b22bae5024a3ce4598857ba0e1ff98dfe09b85d8480fb3d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098203, "uuid": "2b8e88d4-b0eb-4f9d-a93a-b23f6c869340", "value": "T1096312041737DAC2C5200871883A83E963B87AFAD94B15BD2726D3DC6BC1D2B676D58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098203, "uuid": "b3284f30-205f-4c66-9439-4879f3aae1a6", "value": "1536:r9uNsyItfJ0cRy+9HnDps0+hVnBL2tlS7LhooY8ikqjtR:Ss+uy+DGl/nBCriLY8i7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770098203, "uuid": "8d95f523-21db-4df8-96c5-367f6471c1bc", "value": 69368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770098203, "uuid": "cc7f61c0-990b-40be-862b-61961ae7f3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098203, "uuid": "4d48f581-605c-4d4f-adad-f95b19552d2b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c89250-00ca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770100466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100466, "uuid": "bae8520b-e492-4396-8833-226403b90273", "comment": "Malware payload (Mirai)", "value": "326bcd8de8cd0b36c90351392639725d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100466, "uuid": "6f2e35b3-80a3-49f1-bbd8-eda689037bda", "comment": "Malware payload (Mirai)", "value": "3fc0eee8e47efb1969cec1c2568c87aab29c6a82a963b924a801c54619a8b2f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100466, "uuid": "abfa348b-f0ac-4bbd-a72a-9d1bfa48146e", "comment": "Malware payload (Mirai)", "value": "40e58220bd0947f86c4578068c0b8f1eb5aedd2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100466, "uuid": "d3455bc3-f9a9-4fac-bd9c-b6d2621331f3", "comment": "Malware payload (Mirai)", "value": "3d3abb7caac298f23c81a11e88afea75a4a69e6cdccb80e8f1452a75e6fe8d8ded361025ae09ff31c4d8a64a5b7b96e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100466, "uuid": "add8f4af-e640-4416-80df-a764d42d795a", "value": "T13A33F1E46F6E8BC6F0E8E47F903D770E1680740A3945E8AFFA6C161A79A7DD42214670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100466, "uuid": "a0b2522f-d4bf-45a4-a52c-978d61bb91c8", "value": "1536:/9qUv9rEvb4FucZME0jdAlZ+7fEnouy8Zqn:JZEvQCE08Sf0outUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770100466, "uuid": "8ae5efff-a1f9-4d3c-b822-b1b6731e6d29", "value": 52100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770100466, "uuid": "70f27531-8721-45b5-a3d2-e4822deac759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100466, "uuid": "c1f8991b-3328-4c04-a6e9-c69074e505c8", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54c5c59-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128629, "uuid": "d1b53fe2-7649-410d-be6e-bc7c408afa2d", "comment": "Malware payload (CoinMiner)", "value": "ee7e935c71307a27baaa93518a35a492", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128629, "uuid": "f01fd827-7f78-4de9-866b-a6d08e119390", "comment": "Malware payload (CoinMiner)", "value": "4257ef7556b439531fb1cac9956971d8bac1a6f2ae11e105258bea24e9b5934a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128629, "uuid": "cf659595-6737-49c6-8a24-848ca65160e7", "comment": "Malware payload (CoinMiner)", "value": "4f9d072c731f9282648af618150044013c2c9008", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128629, "uuid": "b63793ba-d97b-4b65-8271-181d19292412", "comment": "Malware payload (CoinMiner)", "value": "ecf5dc13deec93c096e2956068de1d973384cef5de747940c4b2b395c86941de88ac3e92ab3d79f5ba2049b53066e904", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128629, "uuid": "63f1cc59-73d3-40ee-8ab7-e38a7dceae06", "value": "T1AE7622FA714D37A8C01E8F345437E900F0B9904E12B9C89B77CA77D43BAB425D95AB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128629, "uuid": "4681be94-3cd8-4d79-8243-acb71e1b50d0", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128629, "uuid": "2002a0ed-93b2-46a0-8c03-1a621bb45301", "value": "196608:B2V4ghV1hjyYYaM9oakr6eZ79cM6D9y16ph:B2qghVz7K2drBGx9y16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128629, "uuid": "517e49e9-b645-458f-ae40-3c7297b7ea5f", "value": 7778816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128629, "uuid": "ff1b6fea-8f58-429d-ab75-29e15a65a89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128629, "uuid": "67c9ec57-da9c-4b3b-8ec5-103b11c97d67", "value": "SecuriteInfo.com.Win64.Evo-gen.86564777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb397c7-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143511, "uuid": "aa4d5696-9eb5-4a8f-978f-d1d7c80ebc09", "comment": "Malware payload", "value": "3bd1b36a970864c3698bd34009134e1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143511, "uuid": "d517ec1e-fb41-4237-8d3a-6109efac6073", "comment": "Malware payload", "value": "42ada048f47e17d022121ca794962037752ca6d9dd8fef8fe47f764396da0039", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143511, "uuid": "d367bbc2-42ce-4a6d-af0b-6b6b8ed0f487", "comment": "Malware payload", "value": "422f94c75b80c40dc8dee67c313fd36c3c683dc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143511, "uuid": "94df88f2-77dc-4e2e-ae51-2133bfbecb61", "comment": "Malware payload", "value": "13f5172617bcd3eed9f6c5979355d1c181acfa6661ed6612b7bf388c7f2b920d7d9ee0669d761ae5bfeabcf3025d31ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143511, "uuid": "5afb6b84-c8b5-4e12-b846-0933aa8d3429", "value": "T1B5E0209A3210CB95C5B4DF5C7243155D307D83B8F33CCBA8D080114EC47291C3059F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143511, "uuid": "0c0f5ff6-2bdc-4bca-9ec4-eee6646cd377", "value": "6:S7dlHOaGLKiFF7dT8bxklIkCF7dT8cFWDF7dlx8Z:udlHOaGLKoVdT86I9VdT8cFWDVdlmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143511, "uuid": "396715b1-5352-488e-9fa8-182151a6e836", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143511, "uuid": "e93d554e-d23d-407d-84d9-b616680623c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143511, "uuid": "6c1b1bf8-727d-4645-9c70-6ed7cc04a23a", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c047bb1f-00c3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770097616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097616, "uuid": "2e5a4495-9bb6-4d37-9b19-e7a4855e7277", "comment": "Malware payload (Mirai)", "value": "3a477467418ce057a23347059153f9a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097616, "uuid": "2578e539-ac8e-464a-a5c6-4c1ec3347227", "comment": "Malware payload (Mirai)", "value": "431776d13d6e8312c4e34a94be9401c2303e71bbf5694d84f2db2db1cc301f9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097616, "uuid": "93e7a746-c3c2-4514-b890-ed7e20c2edb0", "comment": "Malware payload (Mirai)", "value": "17c03cbb5c09a63d4c331ab977b411e357ad7127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097616, "uuid": "bd782b40-5696-4e0c-83e9-89c1791373fb", "comment": "Malware payload (Mirai)", "value": "8cee76a8696a24604d03ba7cb6068960b4cdd4d402ba8b0fff68c6f78974cb2dff2a21c32dd0c47139f693235c70df9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097616, "uuid": "4110f291-94f3-4473-b6f0-256cc32495ee", "value": "T1A05302B0944E5E14EDEBB6BCB9F9B9D60BE0925E30674770BBAD8362024F45173118CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097616, "uuid": "508be364-be38-432b-8b08-3a6b67ee1c6e", "value": "1536:pgMgcnUqBMwaU2PCC9BhpBFwdmbYRHAcTkRr4u+qgw01WXb:pgMgcnNBMbU2/9cH9U4u+qgwoWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770097616, "uuid": "eb4db847-9998-441a-80e9-66bcc6b10df6", "value": 63252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770097616, "uuid": "1c13d89b-2294-4e7c-8732-983d6374e92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097616, "uuid": "b76a810f-225c-4c01-9959-8b0bd06cac8e", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a743df-0110-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770130586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130586, "uuid": "dad2e1ca-fbca-4691-aedb-3c88dc4bd62b", "comment": "Malware payload (PureLogsStealer)", "value": "523a2fa6ed7f5b9fb333d9f602bb6abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130586, "uuid": "b42c6fa8-3fdc-4fe6-b6c5-9b5cd7800d9d", "comment": "Malware payload (PureLogsStealer)", "value": "43cc49c98406e66bcd5b7ca38bd1dd299a7b6826a04ef6a95db8fd08533ae1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130586, "uuid": "aca69c21-3b67-4a54-a87a-1b1d8073fd8e", "comment": "Malware payload (PureLogsStealer)", "value": "de83024bda07a482caa7e6786edce7a2f380a0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130586, "uuid": "94b09bf1-e5f7-4bce-a877-b69379dad39c", "comment": "Malware payload (PureLogsStealer)", "value": "3f32f94fc21abbf0430804629ae215ad02ea07a91afba30308d45dd137737ac318ab48e9f037677e15e2f00da73595a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130586, "uuid": "276be68b-f153-4fba-a811-ff290baf4397", "value": "T1A2F63304780F46EEE71147BD83B938F4FAA6BE249E6A47B059F8B11735B453248BD344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130586, "uuid": "c79f17a2-2df5-4ad8-a0d9-2e95f1c0f38e", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130586, "uuid": "7613358f-b980-4a45-96e3-8ed13451b03f", "value": "393216:PY1vqk2zWeSWSr1OtdKZWajTrIiifhIJeMC+JAAMs:Wqk2zrpSrUk6IJeM7aAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130586, "uuid": "b2ea8be2-e435-4123-bb52-8efde93e255e", "value": 15394816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130586, "uuid": "bcfa4293-e3ad-446d-81c3-c32ee6b2e91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130586, "uuid": "96a8784d-8d9e-4fa9-85dc-04274379b615", "value": "Installer_v2304_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96afbeee-0103-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770125034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125034, "uuid": "7a82ed12-eecd-4a06-8acb-30feff055650", "comment": "Malware payload", "value": "3be078bb25ed99d2c56482be3f2481d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125034, "uuid": "47ee212b-e360-478a-b94b-8b9b8711f6a0", "comment": "Malware payload", "value": "4400bcb89554d703426032b26fd582ded744093eada44f488d5bd4d68f78b5c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125034, "uuid": "538157ac-05c4-404e-a1f5-2bb737c5293e", "comment": "Malware payload", "value": "73d7f5649c733974b85a51e3bca488bc27a25db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125034, "uuid": "cc2f0533-9a37-421a-baae-3aff0a85974c", "comment": "Malware payload", "value": "faee3c6f95c1ce03555737dd8abb2e6a5b57987247025c121aa3bf8c6eb6fa8fc67c5c9d6389a7f7610b2bf6f630d183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125034, "uuid": "656e7424-6dbb-4f5f-8690-39fdc4672335", "value": "T1415533EA2EC7E5DD4D331FA64F8217EC22D3671AD8F83D62F61C29B805162947172788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125034, "uuid": "30f78803-2221-4d7e-8a0e-b77a50f6ef7c", "value": "24576:zit1JUGplKm21od3sLtK1UJbhifypi9yTddShMWLew34nMKRwoGwKBiv:zUOGOmOCcLm8639UiKs5IMKCo76k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770125034, "uuid": "3a1d0546-a76b-49c4-9f0f-bf558e00cf74", "value": 1393823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770125034, "uuid": "5b82352b-285d-45f0-85e0-ac2473cfa89d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125034, "uuid": "0a6b3e11-d446-4cc3-99fa-f9681e98f0fb", "value": "bizy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631293a1-0116-11f1-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1770133108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133108, "uuid": "e1d165be-2c2b-4717-960a-09c41718f93d", "comment": "Malware payload (SheetRAT)", "value": "237f45749867d712ee1fddecfec5f443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133108, "uuid": "a27d5733-b075-43eb-8407-c4375e57278d", "comment": "Malware payload (SheetRAT)", "value": "4401f655b53ca3dadf500acfc061967e2bd896f118532ec4b75de5762f779a96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133108, "uuid": "e4fc45e7-c39a-4348-893d-dcbfdfb5a2ed", "comment": "Malware payload (SheetRAT)", "value": "1e8401e88acd766251a2628e589d235d1569f8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133108, "uuid": "ac293926-4047-4ce8-9f37-ba8a75136735", "comment": "Malware payload (SheetRAT)", "value": "f12e864c0e8762b8687c3fd5c9f022a434e57267b26d8593ec64db70f445767bde39d4a6671fba31ad8ffc1e5400da35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133108, "uuid": "e692f1e7-b1ab-48cb-a4d0-870cc211db97", "value": "T154A4B20CFE91F845CE5A3DB7CBE610148B7125C22E2192463149AFFD8BA537698E367C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133108, "uuid": "72388308-32ab-4206-a8b0-2a6b7c6b09bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133108, "uuid": "c092e117-cf22-4c31-a45e-1522f0607218", "value": "6144:nIxKU3U8wx1v6mBFgTje6VlWT8cBHRL2g+c2Dg5hsmGbu9uf:nIx1OX6MiTjPVle8cpRX+osm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133108, "uuid": "ec21dfcd-d3f5-4888-801d-63ce8261c257", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133108, "uuid": "d946b240-e58d-4bf8-ae78-e54d91e8b1ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133108, "uuid": "f5a0806d-6bcd-4a8b-b1e3-95b1738968c4", "value": "4401f655b53ca3dadf500acfc061967e2bd896f118532ec4b75de5762f779a96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6fbacb-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101769, "uuid": "b27baefd-7d27-4840-aff6-4dce51e4fca0", "comment": "Malware payload (Coper)", "value": "8072e7837c364f8480bc6dca9f4c4f57", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101769, "uuid": "931ff79b-6903-4716-baa2-fbc2c9fbb468", "comment": "Malware payload (Coper)", "value": "44612fabf9a13d78f845f0932c6f332647684c8017f5a8410ec24b483a186e27", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101769, "uuid": "a2da72ca-193a-4da5-924c-01ccf5a9e1f4", "comment": "Malware payload (Coper)", "value": "0efab175913d1225e335473ae6912aeca6b64d1a", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101769, "uuid": "8006fd52-6345-4dd3-a338-f724f18c8f0d", "comment": "Malware payload (Coper)", "value": "9e95e968b1ddeedaafc694686aa61adf4713a5a7cd9d1d2707e2ad64f9b76f39c23b249fdc1d0f91dd1f54e575dc2e68", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101769, "uuid": "7f3ef860-1183-491b-a910-7c5e994c78af", "value": "T14B451281B3E4CA13E8BE9A74490A87E49B347E50DF51176B6652370C0D32BC69F22B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101769, "uuid": "cb722ab5-fa8c-4be7-b71c-c7227c89bbad", "value": "24576:NonTeZ1YutZEkLh9+DpGzuyq/0i08h9s+5bkUl37YsyEv4lBkZwSXn+K2izLCQ+I:N681YuvEkH+Dpqrq8l8h2SR37Ysvv4la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101769, "uuid": "26206111-cce2-45d5-a946-8b462997c644", "value": 1172715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101769, "uuid": "30b6c5f0-3e0c-48b2-a9eb-97496d6543fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101769, "uuid": "d6a26c2a-b8ab-459a-b44c-098c1013c98f", "value": "86e7a16_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819874af-00d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770106101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106101, "uuid": "1aafa554-585e-4f44-b64d-59e98fa099a6", "comment": "Malware payload", "value": "677c58481018ffe44345fdd0ccefb9ba", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106101, "uuid": "079c5270-497a-4a07-b886-cf8b9d41e3be", "comment": "Malware payload", "value": "44923e3db1b3f55bf5337a1a8db8f19699950c276e480b7ab56408f729a30236", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106101, "uuid": "7f13be79-c3fe-47d2-9788-6e680bf740d9", "comment": "Malware payload", "value": "af7377fe1aa51ef2cc8285450ac65c38966b807a", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106101, "uuid": "bf80e9d2-36ba-4e79-89aa-913012ab98a6", "comment": "Malware payload", "value": "71116b61c6820fa78406abb458eccd73a462ae1638635cb6088f6286b64cd4a44e2dd9449c23373a809bb78fb6932359", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106101, "uuid": "c19c4eb1-bdee-4d3b-91ff-d38fc3badba8", "value": "T119215626BD03CE6725D83533DCAD3B88E4E5EC0950E7DA86B3F4D08C40CD45A929F16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106101, "uuid": "8e1b94c7-a8c1-4715-9317-d6f31b18365a", "value": "24:Mvuu81AkZMwHByfKRmUHszWczQqzejHjkjFiNT1Vm5AjDdf7jDb0Ctw:HueAkZMwhyfKjHe/YHFKA1j3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106101, "uuid": "3823b77f-86ca-4d95-9a57-86a7ab443225", "value": 1334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106101, "uuid": "65d67fe4-30fe-4cbc-849d-3c7589e72734", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106101, "uuid": "f35a5c33-e9b0-4789-803e-40404294916e", "value": "sample.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4ceab3-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101774, "uuid": "72377403-bfed-49e5-8e48-22b4221a5f00", "comment": "Malware payload (Coper)", "value": "31ba6cdef34d4181afa650ca02d5cffc", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101774, "uuid": "b842322d-0568-4013-b676-2c068966a6c5", "comment": "Malware payload (Coper)", "value": "44ce621f601a8c68f8984324e2883cb431adcae410a60a36f6f252ad5d0fd467", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101774, "uuid": "e09552e6-12e2-48ed-ab9d-0cb7fe08ca05", "comment": "Malware payload (Coper)", "value": "813127dc211a376d8f174e23eb2191d50c461b4c", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101774, "uuid": "74a7b19b-12c5-4613-b3cf-46f7cedf7f02", "comment": "Malware payload (Coper)", "value": "69850accbeef5e80f1233b31d51ae5128722bba2c7040ce34307b80e4cc12e2b6af663aeeee4ef25011338717ecc9975", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101774, "uuid": "0c49a0db-8543-4133-960a-bb59468ee0c9", "value": "T157451245B399CA27E8ABAA714C928BD456317D88CF4143A32E85770D1E72384CF62F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101774, "uuid": "608d6a88-2eb2-4017-8eee-5cdcf327393e", "value": "24576:BdrU46jPLMC1Gr+IXS7BqNaKdEPo2GHIcpLUeqmgaA0+/m4q1lEGEmndkMYmwKP:BdrbaDMC1TIXS7EaMHIIALmgaC/alEGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101774, "uuid": "f6c64464-5bb2-4045-8e2c-678ed22c047e", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101774, "uuid": "d52d9e0a-e1e5-499c-8b16-08ff74d561ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101774, "uuid": "7ce897a7-54e8-4a47-bc69-df92c6d04d04", "value": "993ad9b_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cecbf1-013e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770150288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150288, "uuid": "75e70454-25f8-4d2c-aa0e-60829c5c61a6", "comment": "Malware payload", "value": "323415d794580cbd45faf449abb7a815", "object_relation": "md5", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "darkside.cy", "colour": "#4304B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "webbased", "colour": "#4129FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150288, "uuid": "463e1b19-712e-42b3-a0ed-60b8d5902abc", "comment": "Malware payload", "value": "4544458cd52f7440464cde95e74e7812f7aa6ba936bda011a5b1e6f684fafa47", "object_relation": "sha256", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "darkside.cy", "colour": "#4304B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "webbased", "colour": "#4129FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150288, "uuid": "2ca441f8-1ff3-451d-9f58-401a7a524fd0", "comment": "Malware payload", "value": "73f38e6255ae783e67fa206ea59c4806628b3eae", "object_relation": "sha1", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "darkside.cy", "colour": "#4304B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "webbased", "colour": "#4129FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150288, "uuid": "0b5b61ff-e8a0-4cbe-abf1-06d4ea299659", "comment": "Malware payload", "value": "bbb0249652389492535df63ed01a8cda25d1eb933c269f104ce1feb9868b4fa642c9ad78372f819871f93a13fc8464c5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSide", "colour": "#3B3154", "exportable": true, "hide_tag": false }, { "name": "darkside.cy", "colour": "#4304B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "webbased", "colour": "#4129FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150288, "uuid": "425931a5-9440-478c-864a-54e69ff0f09d", "value": "T15C83F93AD5ADB17AC3698978DE0A0D54DF63FC8A4398BF4B53E10DE50F96A101F0DA81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150288, "uuid": "242eeeb0-8288-4378-a180-9bf0211decaf", "value": "13202ae6e20dc0e6f8ae3713ee808076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150288, "uuid": "1a73c3b1-f3cf-4816-a839-0347af00c77f", "value": "768:9IsJsfFNCcJWbKGhj8p1on5ykNgFd1djPPZcCyklecRg3h/P1uwEKQnPVBzezE3q:4iBeXLkmvjyklewUaZnDqzg8UJz3VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770150288, "uuid": "3ee5b6e2-8391-4d92-9cf6-d5bf62981400", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770150288, "uuid": "0879865c-9b15-4618-8f48-c9575c0b3e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150288, "uuid": "1f7078a7-8faf-409b-8db3-afaeb273ac30", "value": "4544458cd52f7440464cde95e74e7812f7aa6ba936bda011a5b1e6f684fafa47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa1cc04-00df-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770109713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "7766a614-2e11-40df-8ee3-961e8155d49b", "comment": "Malware payload", "value": "e0429722acd5862217b2f8c2bb176193", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "4084ace4-fff5-4f64-9762-cbf3490499bd", "comment": "Malware payload", "value": "45f7b4585a6bddd0d20db23cd6baabf1076bfe664fb1e6696dd7e16722c10149", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "5292e2a3-28dc-4e0d-b8c4-ed52a92fe42d", "comment": "Malware payload", "value": "18554fe129813511b869beb830bf1fa855bcfb51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "33202d16-7c06-46ef-bcb6-9989c6f7c331", "comment": "Malware payload", "value": "20b4c14ae7ebbcdae4af0ceb90f07006053a85948c068b9d38c33a19ebf6fd02bd2035900d48f72be52b42881afd0a39", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "c16a36f8-233a-46bb-9eb1-6d8488ff5401", "value": "T109423C713664B331329DC8ACA076E8162F45359FBA704810F2EEB5C86FED620F1A95F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "69b560f4-5a98-4f41-b7d1-72b6ad769b28", "value": "192:Sn99BpAzWPiuRYEVL2hdN5ns549ocOK1Y7IgGXz:hAVLNN+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109713, "uuid": "4d31906a-936b-409f-8d85-ecb8ca5707ba", "value": 12477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109713, "uuid": "9812e5f2-8804-411f-b303-a6ac7bd7bea4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "d8888ee6-d619-46c6-8eea-69b31bdbff5b", "value": "45f7b4585a6bddd0d20db23cd6baabf1076bfe664fb1e6696dd7e16722c10149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c5f90a-00e3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770111187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111187, "uuid": "c11e54dd-e4f4-4607-99a8-71bf09a145fb", "comment": "Malware payload (Mirai)", "value": "fbc5234f091a3d619e324f6d36e3977b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111187, "uuid": "4380cbf4-352b-4ab7-b7ab-71bc0675ece4", "comment": "Malware payload (Mirai)", "value": "478296f7e63ce407a06e18aa0e9ea7cfefbc9c78552aa37f893563ad1b86be1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111187, "uuid": "bb98e65e-0ed6-4a76-bafe-38312fc28839", "comment": "Malware payload (Mirai)", "value": "f55d66ef8f4492bbea3dd804da73a6d173fe6157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111187, "uuid": "04766b54-7704-4590-ad5b-e89dbe4cbdbc", "comment": "Malware payload (Mirai)", "value": "8afd52c4ade185a37d0aac8d98eed888af8352e358420856d0703ad4073ca37e60f05a16e1f1e7eabde8d5d6fa94ce21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111187, "uuid": "213b71fe-ad5c-4e01-9717-b595978f23e0", "value": "T19B6312EADA35BC4FDECC9B39595022756088D6D1F3B3981035DBC48D9B1A22FD50CBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111187, "uuid": "5423b767-9aa2-4756-ba67-94be707eb512", "value": "1536:9VUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbf4eNR:fp0T2WCbgc8bm/gCAv3JwpjbfRNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770111187, "uuid": "50460501-60f9-455b-b1c5-6ec4006a7c2d", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770111187, "uuid": "07810622-b2ab-401a-b5fc-5206f2a21eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111187, "uuid": "371f2317-bbee-4ee5-a4ec-fd7078d25fb6", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d08cca-0101-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770123958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123958, "uuid": "d084f9be-7eae-4e81-a5a6-739a02e1264b", "comment": "Malware payload", "value": "5900a0aa9ed9443fbc73ebfba5de0ab3", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123958, "uuid": "ad4690e8-7ef0-49a3-8f34-dea0dea5c683", "comment": "Malware payload", "value": "478aed491279bc953ecee8cc7edc569d25c6bd386057f0bbf78486eae9c76275", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123958, "uuid": "3e59976e-098d-4159-8f55-d52d6b718239", "comment": "Malware payload", "value": "0fd63b4dbab755da4efcee6400d3079df95b9eb5", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123958, "uuid": "faf46521-f5fb-49a8-ac22-3e30afc8a3a0", "comment": "Malware payload", "value": "ecb502a1016aa52619b0f147c12550b43922f5d88dd94db5266c65503222852da63c9ada5a49d7ddaeb42fee886f8b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123958, "uuid": "640d7909-1eb3-42d9-920b-473e6b2a16c5", "value": "T1A1A1620763E72FFB9A4A4DE95398620724F6C0BB38117A7DF7E515937426A41BC31234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123958, "uuid": "569fbf62-377c-4422-b06e-0227617929bf", "value": "48:CzwM8GS0KOqpe4x4GSawYmGSaaZKtmGSanl4GSaaq5KkCR5GSapz5ZGSaai:CN1Bt0zWooW1l35PC2feT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123958, "uuid": "d7aae6c1-201a-4058-8d35-28e59fd363e0", "value": 4881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123958, "uuid": "579f6901-a24f-4f59-b113-78be20dcbf97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123958, "uuid": "6fffd99d-9a87-4fb2-83c6-36eac837ed49", "value": "captcha@144.31.169.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa8af5d-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136968, "uuid": "5786e608-37bb-4fad-a221-b49d5a3c72b1", "comment": "Malware payload (Mirai)", "value": "e6c460b62bd2f7fd6e171d767baa0992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136968, "uuid": "7cb29173-8f7d-4773-b82a-1fefb72fe974", "comment": "Malware payload (Mirai)", "value": "47b9fae86712ed112f7e8e42fa5496a8b3adff5e717724f913fdcda987f68dbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136968, "uuid": "6f565760-f6da-47b1-90f4-68a1c95fbc2f", "comment": "Malware payload (Mirai)", "value": "78690ec4f53c06b8f50865cb26c5c21a04ad3d4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136968, "uuid": "e09c7d4a-0fa6-4fa9-b5e3-4353bac1be64", "comment": "Malware payload (Mirai)", "value": "fd9ed94d14cd19984e89b28c3ec7690d7b92602f7cf99df9934e3f55b7db143c82b0d99aa67065621004b5f133594dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136968, "uuid": "596c4d69-d187-49ca-874a-c8904feb63e9", "value": "T1216328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136968, "uuid": "b784f3b3-3d96-41cd-b9f2-b266450fceb7", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136968, "uuid": "53852a5d-223e-4093-a3d2-62feb7e3bf85", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136968, "uuid": "ff185c20-e8a1-462f-8ef7-2da4b54f89dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136968, "uuid": "0d262ed5-cbfa-4fc7-9e4e-de4511538ab4", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff68283-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136808, "uuid": "b5663a1c-edfe-43b6-be82-ffacb177e4aa", "comment": "Malware payload (Mirai)", "value": "5bd514927923113e760711bde96ae4e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136808, "uuid": "9f31ab57-e861-4d48-91f9-6b4b93ba3ad6", "comment": "Malware payload (Mirai)", "value": "482fe1c5adf10b2feb46d79a6ba89ac5865e73fda816738642d61c03e2149e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136808, "uuid": "4d3f802b-1899-4f77-b53f-8c524b9cb982", "comment": "Malware payload (Mirai)", "value": "773ab51ed565bb95a26316d0e28d978481a0d233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136808, "uuid": "5f7d6ea9-a6f2-45b5-8125-f5aabd8447e3", "comment": "Malware payload (Mirai)", "value": "b14b9f24d9ffc1e9ba3b550264d54dece4964134f72f6d037365b47b154a5704d5303430c6abc98076cc74057d66f6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136808, "uuid": "6ebbbe2f-93d8-45b5-b6e0-272191a136ee", "value": "T1DB535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136808, "uuid": "af5609a2-b2f8-4d65-b5c2-09949000f573", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8l:N1GjR8EVGOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136808, "uuid": "d6ead5fd-2142-4379-94aa-fbc4a1de91e0", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136808, "uuid": "f6cf339a-991e-40d1-8195-575192923d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136808, "uuid": "86c52b7a-3ea6-4595-9178-64e699cab356", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e61ec3-0134-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145912, "uuid": "f470b8e0-eaa9-440d-837c-f4e970995b15", "comment": "Malware payload (Mirai)", "value": "88a7b2a6b369b6fb88a573c99feefa5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145912, "uuid": "633747e2-b486-4a82-bd33-e741f8737531", "comment": "Malware payload (Mirai)", "value": "48737f8fa20358f195fb9670e6ee0444c9760f50f02bda7d78472dbfd0a08bab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145912, "uuid": "7b17a8cf-68ec-4018-9a0d-65afe243f45a", "comment": "Malware payload (Mirai)", "value": "47dbfb7b652f26228f2895c5b80ea8e839157b7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145912, "uuid": "9e713001-7a44-4d8a-8617-a24f03a810aa", "comment": "Malware payload (Mirai)", "value": "0a12c111c32a9309b2f27b1ad367825c4fc5d59a7f57e45397e1581ed5197f1e1a11ea11926049707781fa9f8c524b65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145912, "uuid": "b5bc4656-6112-40c5-81d4-8bc51b5ae6a3", "value": "T1C6D33A46EA418E03C4D617757BAF424A3322A755E3DB73068D18BFB03F8679A0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145912, "uuid": "a1287775-e34f-49c6-b48b-11ba9e1518dd", "value": "3072:ditfjAZh67HKpkcHSCeYn5egAXwFDKuwTM/9OdfI3:AiZhnkcHSC7QgJBKuEM/9ORm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145912, "uuid": "57d15d4a-dac3-4b2c-86f4-049104586039", "value": 140329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145912, "uuid": "9cb22fb6-a0ba-491d-a766-1482635bcec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145912, "uuid": "78dcbfaa-4283-40df-a6b8-55825d67fdd8", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690763f-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128658, "uuid": "b89a08e8-a573-4c9d-903c-144c43c28cc3", "comment": "Malware payload", "value": "0a62e827f54e74551c7ebbd5f46703ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128658, "uuid": "1acb48b9-168c-40ff-8d2e-fbcfca4495aa", "comment": "Malware payload", "value": "492fad786f3c58bbc57c842f92f157ffebcd561adcff48a5f4fde5b7e78d7a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128658, "uuid": "c9dd11ea-9e8c-4a7c-8185-fcd7930a5877", "comment": "Malware payload", "value": "341e9e24115de01bc011edb6aae5d544cbdfb5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128658, "uuid": "e2655f32-a435-40e7-b7ad-27c36f331ccf", "comment": "Malware payload", "value": "3a482c7db4c39f3a13986be602deb35ecdfe747859a7ed1b6d46b235ca7b8f5229dbbd4656b62f2aca3f6f12e0631bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128658, "uuid": "880eb04d-e0d4-4511-86c2-3e0c46e1cd9f", "value": "T1DF7623EE224C375CC01E8734D423BD4572F6252E5EEA46AA75DFBBE0378E8244D46B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128658, "uuid": "d95f37d5-fc23-49b9-8f7f-a359b37a00c2", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128658, "uuid": "c473e708-5d4e-4e55-96fc-97e970f7b3de", "value": "196608:qMiKlqZ8UgmhrB7El845nQyTYc3YQz0T:qMAGU//70nQ4HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128658, "uuid": "7ecea86f-dbd9-47ab-bcff-7c92020820ad", "value": 7763456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128658, "uuid": "18477c24-e441-4017-b1f6-a069f8157374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128658, "uuid": "7695fe79-1b28-4b09-bb70-5d4b05fb8870", "value": "SecuriteInfo.com.Win64.Evo-gen.28588369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be2b4c0-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139029, "uuid": "39037738-7a33-4d0e-870c-7f74d52d063f", "comment": "Malware payload (Mirai)", "value": "5e13844d7bf8096709ac71aff74d1751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139029, "uuid": "da834f0e-e130-4f7f-8d14-a75e24b418b7", "comment": "Malware payload (Mirai)", "value": "493c33bdfe017c1e2c7b2401286018034fdd9588662711e911ea505de155a0fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139029, "uuid": "a9ef003e-5808-4cb3-bf39-bb9c85a944e5", "comment": "Malware payload (Mirai)", "value": "9316c970cf2dbd548126d2d0b7c658d2933578a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139029, "uuid": "ed713a0d-7038-48a2-a74a-60846f14b206", "comment": "Malware payload (Mirai)", "value": "a17fd4a89dc922e000ef1defee4cc80ea60d8ad1eef1d600fc027dbcd69c2685219063df1038d0a3e26307c71e0160ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139029, "uuid": "bcc49abc-345c-40d2-a242-9086329d987b", "value": "T179132843289184FCC558C6B09E7FB627C933F47D2231B65A33D57E22AE8AE201E5B585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139029, "uuid": "f23532fd-dc26-43fa-828f-d0d8769feba2", "value": "768:Oqrrx3SNsxRA4bbLsxt1yRbq5Nrd7CjMYh0ug05nBaot:Trp/bLsjjNrd7CAYh0onBao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139029, "uuid": "a9c91b43-6fb1-461e-ab61-80506e0a2d3b", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139029, "uuid": "3120a585-0434-4410-82f7-4edd489d4db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139029, "uuid": "ba893c7d-7440-4e72-9c1a-384b3180d25c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac5f430-0129-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770141496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141496, "uuid": "7c0c05c4-fc0d-4c19-b903-2cc5874eb9c1", "comment": "Malware payload (AsyncRAT)", "value": "54fe11c8c750f9ab079274567f5f1c60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-jan360gmbjd-del", "colour": "#FD3CB7", "exportable": true, "hide_tag": false }, { "name": "ja308900663-36345-portmap-host", "colour": "#3E33F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141496, "uuid": "67d66dd5-70cd-459e-aeef-1f0d65d6d319", "comment": "Malware payload (AsyncRAT)", "value": "4a3a6a74be0ba5a00979178aaee06538ff51c01c1b63d547399e44086f4a93d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-jan360gmbjd-del", "colour": "#FD3CB7", "exportable": true, "hide_tag": false }, { "name": "ja308900663-36345-portmap-host", "colour": "#3E33F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141496, "uuid": "541485bd-7d07-4dba-a46a-0cb682b95ed7", "comment": "Malware payload (AsyncRAT)", "value": "aa916011a7faea04165a5ab54a2e37aad324d3f1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-jan360gmbjd-del", "colour": "#FD3CB7", "exportable": true, "hide_tag": false }, { "name": "ja308900663-36345-portmap-host", "colour": "#3E33F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141496, "uuid": "962c8ec7-9177-4792-8503-3302ba21ebbe", "comment": "Malware payload (AsyncRAT)", "value": "832ff9677685c427e6cd1283bc5f8f87b2c2ca7788747be6358cf1058b39dcb066a4626610a047efb8cd06336d2d1e51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-jan360gmbjd-del", "colour": "#FD3CB7", "exportable": true, "hide_tag": false }, { "name": "ja308900663-36345-portmap-host", "colour": "#3E33F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141496, "uuid": "b37aa3c3-3404-44c8-a7bf-83a054fbd65c", "value": "T16133E7CE27A881EEFF7E0B74A8F1DD454E7AA3633903D54E1CB441863B13B8589416E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141496, "uuid": "e4452e2a-fd48-4073-a75b-ab0c8caa9cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141496, "uuid": "a7e5e9d0-7150-4082-a556-20631951b7ed", "value": "1536:NuIfdTsXB2jzcfnMt3b2XSX/4d/wIdvWmZf+:NuIVTsXB2UfnMt3b2pH9WmZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770141496, "uuid": "a3b431a5-4634-4585-bbf0-db1ed243f6fc", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770141496, "uuid": "a7435427-26cc-448b-8b9c-f79e21f11222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141496, "uuid": "d5991278-0f0a-4f2a-a827-e6ce241eb768", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaa6840-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140136, "uuid": "f10d5119-8018-47f2-b7b5-41a21a35f7fb", "comment": "Malware payload (ConnectWise)", "value": "21864b76aa849206e5002a23179cbde1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140136, "uuid": "af5fb67b-5eb1-452a-b871-e5fcd02fe1d8", "comment": "Malware payload (ConnectWise)", "value": "4a663062df10c917b10092f46db367145234e5d28185881815f5a3de048e5c1b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140136, "uuid": "c0fe89b8-db51-4890-b014-6b9d915963f7", "comment": "Malware payload (ConnectWise)", "value": "c9358682b5ea768a6548380af10b5529fc1f4cad", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140136, "uuid": "59d79a46-0ec1-405d-afc5-3536bb63cc49", "comment": "Malware payload (ConnectWise)", "value": "8450c8ec2ba0381b8ea8a852ec2f9977bedf1df4d5948fb2a7d70c719fb7ac3d801dbfc1b5065300227554dc3f24f04d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140136, "uuid": "0bca2984-a49f-411f-a516-fdf1520b6946", "value": "T182A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140136, "uuid": "a0d87e83-368c-4f3a-ba38-5ccea0287e72", "value": "196608:jKaLNkbgki4Q5KaLNkbgRKaLNkbgZKaLNkbg:7WgkiHdWg1Wg9Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140136, "uuid": "30ede07c-6196-4f57-ab2e-15efe0f7e7f8", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140136, "uuid": "e9691fc8-4bd1-4cd4-b3fc-889002a66aab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140136, "uuid": "d455750a-9c91-46e7-a7a0-6e677c207cae", "value": "SioreePartyGatheringCode.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6a5e2-00d2-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770104109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104109, "uuid": "aee4d960-3d35-4605-a904-c207058dae21", "comment": "Malware payload (Gh0stRAT)", "value": "8744d1478283776211349df280352d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104109, "uuid": "77654519-73bc-454e-be53-4f548c907798", "comment": "Malware payload (Gh0stRAT)", "value": "4a69639afc8f9f53c5e1ca363272aba3740be5ad628a4ab803ec7b8a24f75d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104109, "uuid": "c4c2839e-bd13-4cb4-89e6-a165383a4179", "comment": "Malware payload (Gh0stRAT)", "value": "0b013ecb40ebc6610455c6fc73885cea0e5cc5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104109, "uuid": "8c4dbf6d-1db1-4851-9948-171f26baf685", "comment": "Malware payload (Gh0stRAT)", "value": "4d8f4730dfd1c705cdea885e8c6a74a5c14399cd1eff5fe0fe9cdcdbca4d30083a817d9b0267794718fa17059fbbd638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104109, "uuid": "418c7fb1-be69-4b33-9a67-e9618c31a53e", "value": "T1CBE4F1E4BBCF62F8C8A3FE3E83259275536723E2E8113594D4394B9A6D13117CA190ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104109, "uuid": "76552130-f3db-4356-b2c1-6aec6d7a1ba8", "value": "14f8e4dca31086cd0498de53fcba2af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104109, "uuid": "807e1f60-15a2-4c06-8ca7-44a738186d33", "value": "12288:TocL6cIGASS3xgLIcei8RTkNVlzDBEbouH5d2yeQRkTM9mQ:ccecIlTk9zVEbouH5dDXwGmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770104109, "uuid": "c3fde642-9438-4181-99c4-300aa62463dc", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770104109, "uuid": "873065df-bf1a-4b89-aa6c-dadf5c58b3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104109, "uuid": "7f31b8cd-7f02-4ec3-a58a-7f52d975b9e4", "value": "8744D1478283776211349DF280352D4F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0ba746-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128615, "uuid": "9af1f73b-acae-4fe6-99fe-1eef0978386d", "comment": "Malware payload (CoinMiner)", "value": "6016c4509bf4ee8e0eb0498786b4a71a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128615, "uuid": "e8263688-429d-47b8-974d-0cd991a03242", "comment": "Malware payload (CoinMiner)", "value": "4ab235b466502dae7a908da94c7a06c896e0b2d4b23b01a482f0b42fb0066909", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128615, "uuid": "3255bffc-c74f-4b42-8d95-6a2c33a1ae46", "comment": "Malware payload (CoinMiner)", "value": "94a72c373dede95fe74aafb8631b0f76ea78fc4c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128615, "uuid": "1fee7abf-2bc8-430e-85a7-8dd256c341bc", "comment": "Malware payload (CoinMiner)", "value": "d9553c5d9f8d34f4270a4fe8c01c671f573f2d38374706eb7ab8e461adcbf71f0cc300ce7358a632004aa730eb725e8e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128615, "uuid": "9e7f690e-c48f-459e-a3b3-a8893485b4d8", "value": "T1E176236E714D33A8C02E87389133BC05B1BA116F4EF995E6B3CEB78477AB410D546B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128615, "uuid": "462d6748-3e52-4742-8f3b-898d2e738247", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128615, "uuid": "836e1e40-1cd9-4c9d-900f-0736e5be0dda", "value": "196608:V74bHNGiFbwfxwpxvfViMfRYuUFJQkaH3VSy2LxxMdstWT:VUbHNGiMwvfViw3qOFSyuxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128615, "uuid": "9eb66528-987c-4751-a83a-89322dac0892", "value": 7769088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128615, "uuid": "aec1c3be-da52-4928-ab31-f25362c3adcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128615, "uuid": "25cb51d8-679c-42f8-85a7-8ef5752b8bc9", "value": "SecuriteInfo.com.Win64.Evo-gen.87828647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd1ab08-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128643, "uuid": "ec824336-7f3e-4c6d-9cbf-13f362d6fba5", "comment": "Malware payload (CoinMiner)", "value": "8c53446bece1886b3bc9518c735f24b7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128643, "uuid": "53cccb6d-e66f-498b-8880-34550fb3338c", "comment": "Malware payload (CoinMiner)", "value": "4ba0fd7e7adb1e713ca792e4c6da18841b21da7ed892035d82ac25f1308c081e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128643, "uuid": "20f808de-73ba-4cbd-a59d-364ea89716bc", "comment": "Malware payload (CoinMiner)", "value": "503d17bf39460841350f738033362612dd3df255", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128643, "uuid": "0ddfddc6-b239-4b74-9eaa-d0a82be3532c", "comment": "Malware payload (CoinMiner)", "value": "12d4d0f03f723fa3c639c1c7f8daf5f7d05979858f5cc7c71515ba7d2216ec1bc2378449c2904d1fdd1c80dc53f74bd6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128643, "uuid": "95d34a08-d0bd-44d1-abb2-f5bff30ed397", "value": "T1747623AA704D339CD02EC3799823FC44B1B9521E16E999AE76CFBBD433DE110D946B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128643, "uuid": "b7cd0ff7-8e92-4eb5-bf63-bc9fed558198", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128643, "uuid": "a0715b51-69a0-4b74-a43c-fa62832d575c", "value": "196608:/i4vWR8qsB0Hbyl7NeFo5eexQY0TQco/ij2uVDaCx7:aFRr48FoVQHFo/iXVDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128643, "uuid": "a0da3a1b-4026-45c9-aabb-5738837a906d", "value": 7776256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128643, "uuid": "88ca58a2-8f0c-4352-a422-50225c3fc756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128643, "uuid": "ececad03-ffab-4835-816f-e1c89704095d", "value": "SecuriteInfo.com.Win64.Evo-gen.28811199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b95971-0136-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770146768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146768, "uuid": "aadddbe8-60c0-4b60-a24f-a15e9478209e", "comment": "Malware payload (AsyncRAT)", "value": "50c479a0b0b24696f9a6f8661db3d6c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146768, "uuid": "31ced121-67d2-496f-b30a-9bd07970a3e0", "comment": "Malware payload (AsyncRAT)", "value": "4bfe02df6ed7e7511a1ae9c44a2d1eed1b45147037c1c8770bc7be0fb6622a74", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146768, "uuid": "28f8eeb7-5b45-4786-bf4c-ac8da2b97751", "comment": "Malware payload (AsyncRAT)", "value": "52fb7321acc2a2ba73db7180a0505398dbccb4b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146768, "uuid": "a365ac9d-400b-4b72-84fb-c656846fc2a8", "comment": "Malware payload (AsyncRAT)", "value": "d32893e5add2fcc0d17f4c702179fc9cabd822a40b90f52614daa0d7c45b33732b9d7d881959c87b589bbe53fe3738b4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146768, "uuid": "40a59fab-d81a-407a-8e42-d9c171ad6e5f", "value": "T109232A007BE9823AF2BF4BB85DF26145867AF5633603D64D2CC451DB5623FC28A426F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146768, "uuid": "c521ff9b-6b61-4ac2-829a-1656f70d50c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146768, "uuid": "9af60487-c2f3-4e69-a364-b127d8256934", "value": "768:iu/euTMUzwJbWUnBtJmo2qV6T2QAm7PINtjbcgX3idju9IlcidjoBDZyT:iu/euTMzX2mTNlbzXSdjOOjOdyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770146768, "uuid": "f79c7060-5995-4016-9873-27bfc226e84b", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770146768, "uuid": "70619db3-eab7-4a65-8082-7d7e1fa28aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146768, "uuid": "59bd56f3-8e8b-4615-aa55-291ac83c19b2", "value": "CalybraB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da477bae-00ed-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770115699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115699, "uuid": "db6791b1-5133-4816-b94a-7dc56eb87c56", "comment": "Malware payload (PhantomStealer)", "value": "3151b9fccd46b30fa14f5908fe6f0df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115699, "uuid": "61a07712-1a09-4208-a20e-d40518883c32", "comment": "Malware payload (PhantomStealer)", "value": "4c3ae6b27ff6c7003f1d58a9c09f69c6a877f5db5b285abe919ff41e1654c6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115699, "uuid": "f410ed38-96c0-4d71-8012-cd67e9712379", "comment": "Malware payload (PhantomStealer)", "value": "b19772dd7dbb14a7ff952b81c5b5875b2d399567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115699, "uuid": "4910a932-d577-4dfc-be83-7ac9f69edae6", "comment": "Malware payload (PhantomStealer)", "value": "6876b65165008bb8c1994d4d6687e95bb0b4dcb71116693cac12d33845d17d20e26a57f3354ffd97e42983573bd4ed56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115699, "uuid": "bf10a93f-592d-492f-a200-94e1c52e251d", "value": "T1DF85F11513E86A68F5BE9B3C4779411043F5F85ACB36DF2EB989808C1C21F97DA62327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115699, "uuid": "7f927668-3e6c-40e6-9590-ad92b2129bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115699, "uuid": "6de39f2e-c4b2-4f10-8583-adbe737b3c50", "value": "24576:hvRst1d5R43L6c/riv3ksjU6UsHMcrE0Jv3oqv5BYg9AxMkDnzffInZ:0t1d5OBi/7xUsHtJv3sxMcfIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770115699, "uuid": "0bef4cd7-c968-45db-9a75-f62eb789705f", "value": 1840640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770115699, "uuid": "bce63ec1-821e-45a4-95e8-2a7bab35d1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115699, "uuid": "5c2df281-f12a-4da9-bcee-6f5ff323cc5b", "value": "Richiesta d'ordine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0343647b-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128653, "uuid": "db5037f6-bc47-46ad-9814-c0a029158340", "comment": "Malware payload", "value": "9acaed2889eabbf6520e5c74bc0da2c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128653, "uuid": "094a1989-507b-439f-a9d6-03eef6f20c38", "comment": "Malware payload", "value": "4c3cd484152a85019af1e722fbf5e521fd56ef3f20d82fc6b80a31f9b280ae51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128653, "uuid": "0fb54bca-bcca-4e51-acff-8ed7496458a2", "comment": "Malware payload", "value": "d6cc2c659d7b4209bb15236d3523443ab00809e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128653, "uuid": "b806a7fe-e9df-499b-95e5-bdea19fa3603", "comment": "Malware payload", "value": "bcc02d46cc351e246c330e27f1c36208011c8f3acac697847d8c3432d45c16a75605d33869ff6a6365baaac4e5ee61db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128653, "uuid": "b66a3f5e-a65b-412e-b395-287714d462a7", "value": "T10276239A614C336CC41E83789433FD18B1F6915E4EE5D5BE72EFA7C0739A821C94AB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128653, "uuid": "9c6b9d87-912c-4980-a11e-204e00085440", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128653, "uuid": "daf9d352-5e88-4954-bfc1-4dbfe9a376e2", "value": "196608:5YBLAviEzk/Yvx21WznSYZypurlhaBdde5G:5wdEzkwJ2oznSYspMlhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128653, "uuid": "6c7a9017-55fa-4e58-a7cd-44a2a28d8414", "value": 7765504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128653, "uuid": "c37d8c1f-442c-48a5-a356-1ef56b5714b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128653, "uuid": "373fa54c-231f-4ac9-8904-2929e4fe5ada", "value": "SecuriteInfo.com.Win64.Evo-gen.31235578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b274d0d6-0140-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151280, "uuid": "e1437a88-6cca-42c4-a110-68657036ea16", "comment": "Malware payload", "value": "269181136d456c2cf5b1a95bb17d0e18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151280, "uuid": "fdca9bd6-b03d-44b7-afc2-2e5b1002e405", "comment": "Malware payload", "value": "4c52b95de38389ec565fb084cc103bf23a1282c07c0e70ed0040b252baf80452", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151280, "uuid": "8f929f09-e674-4be8-a38e-ef9477e9da54", "comment": "Malware payload", "value": "1e52eb899030415b6e94d545c898c596db17978c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151280, "uuid": "969cb106-4ef7-454d-bace-17876f591ea6", "comment": "Malware payload", "value": "5259f6f7ad03f8d24ab96432904802ba7ff8d9396c7efc168420d9be14ea3e78855c1f378a01f0028684e770a6948fd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151280, "uuid": "1a4d67bb-f3a8-44f5-945f-a5cfd9dcae68", "value": "T16435179A4CA6D4BE790EFC2D0A91D902CFCD026433135F7BC6231EADB415610B9E657B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151280, "uuid": "fe7a00c8-a9c9-471e-b167-f1138e91aec6", "value": "3072:wWzbNB4UMDC+R4UvXmyLzECk+4UfQLfbQB4qGfBc0D:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151280, "uuid": "0f50474d-328c-497c-8be1-b5a14e465bc1", "value": 1148567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151280, "uuid": "f1b4faa1-1e25-4617-a34c-9bf85c781eb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151280, "uuid": "43b816ed-dc4d-4b4f-9d56-804ae0078213", "value": "New Order FT25294C7O7F_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760d8a43-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770120685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120685, "uuid": "fd5cdf38-0f72-48db-8395-15643534cede", "comment": "Malware payload (MaskGramStealer)", "value": "d94d6fae1495a27e0dc865ea5a6db30f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120685, "uuid": "bc6eced5-831e-4658-b4e9-3bcacbc49ca9", "comment": "Malware payload (MaskGramStealer)", "value": "4d8b7ee5f7d5f3e54fc380a318bcbb5c8c4b57dd71e9d8e9f8c9d829fb8a5a82", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120685, "uuid": "79a125d3-6b05-4b3f-aa88-15d939bb19a3", "comment": "Malware payload (MaskGramStealer)", "value": "358978a11babbd0c34cf08f6d8141d2b1d60fc1a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120685, "uuid": "969cdd1b-b57d-4896-b056-364e4cebee67", "comment": "Malware payload (MaskGramStealer)", "value": "25a16d2605464dd8b3076e96f316537e99b92afc953e4d27614779129fd346ddf159dd9ccb96228ea1b63124c1f305bd", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120685, "uuid": "43494df1-a2d1-4648-9f34-44b33135eea2", "value": "T114B6239A96D993E8C4D30A40754B12DE75C1795E82FE8D193ACB2C037720C6B4A8FE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120685, "uuid": "39540619-38f0-4bbb-9feb-03f3d9f8af33", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120685, "uuid": "0e2929de-10a6-406d-b5a9-2e18f986fe60", "value": "196608:zgMVr2VZ/5L/MMkVfR5+1xqU0NAm7khKXU9YufRTiMYkvQfjQUcl:T6Vh5bMdZbkh6UvTiQvQfUUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120685, "uuid": "9543dc08-f9d3-4704-9d79-e0cb8d59a9e7", "value": 11093504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120685, "uuid": "222ba743-aa44-4e85-b86a-204ca33665e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120685, "uuid": "2679ef06-00ad-459f-a435-9c197bf0a523", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606a3be5-009a-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770079846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079846, "uuid": "86c76784-b0dc-4a38-93de-48e5559c2e7d", "comment": "Malware payload (Vidar)", "value": "4c0836606c5cad2a1bcc77ea4fd6e828", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079846, "uuid": "be8f1626-7a8b-4a89-940a-9704ee3e6848", "comment": "Malware payload (Vidar)", "value": "4e63ad7ed49f94572e409e6764c8d1ca4f2253643f527fd2f03deab7fae691ac", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079846, "uuid": "8bb37a62-5242-42f9-b74c-b3c5b0b4b152", "comment": "Malware payload (Vidar)", "value": "424fdeab82258fa826c72db977cb93f35125d780", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079846, "uuid": "f061483c-d7c9-4368-bed0-04d338ca104a", "comment": "Malware payload (Vidar)", "value": "66588a45488a92e976ea72077eddc43c714ed732751337282285de8acfc57e3b2cb1ff19a62a19a56298c65316ef236b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079846, "uuid": "d40fa43d-95bb-4851-a4ac-4a08b9507dee", "value": "T13586297F729592A8C26D853FC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079846, "uuid": "67f5bf29-c1dc-491e-acca-8f608c87a76c", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079846, "uuid": "7eeb7db9-df32-4b44-97b0-1e2eaef539ce", "value": "49152:nNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg3Q49dpSMrP0AlbK5:nz7Vp7LQ49dVPpuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770079846, "uuid": "cf8dd952-baa4-4bb4-8e89-21501b75cca4", "value": 8538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770079846, "uuid": "602f41cf-2d9f-4c82-a2f4-6648147da150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079846, "uuid": "6913f69d-9498-43dc-bb73-faaa20a7a5c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9efe8bc-013d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770149978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149978, "uuid": "82b2f9c1-8845-4545-a834-44ab6889d674", "comment": "Malware payload", "value": "35840867e230bf31363bf4652f8784e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149978, "uuid": "d7d25661-c800-4a8c-b4c5-c8ac4beab194", "comment": "Malware payload", "value": "4f496ed8617d5dd02f42198dd2de10881d4296647fe06e2e3bd6139f723a0750", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149978, "uuid": "2ad0b381-cf9b-421b-a74a-2ab675fd0d2c", "comment": "Malware payload", "value": "d869e3ba459dcdc6b87c38522469477ee6ae8f27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149978, "uuid": "364daaeb-f030-4dd3-a48d-3c14585485c8", "comment": "Malware payload", "value": "f380228c9a0302a82620a4803eb00b74c0eac5f8ad9f64c77b58a53e835ab2195d6c635817f7ec7b43ef0371a5fbc213", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149978, "uuid": "6d1f99f8-828c-46eb-aed4-574b88aa3ce2", "value": "T1C7F0E90FA04BF03AD08419E8E761FB55AC30B86B5373CD5C78407650FFD64247962240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149978, "uuid": "3c050bc0-2cf3-433e-8d11-1ceabd92e110", "value": "6:hLgjJ5Ja/+YcLN7+Y3JMF/+Ye0IdyJ44LIXLoO4eGLw+v+YdF/vNnQz2JMIykwFV:lSjkOLZpqjW3bo/8pqF82Q/NiTZA20t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149978, "uuid": "d6d23fb3-f115-4222-8a9f-fe880b49ec9e", "value": 526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149978, "uuid": "6ab8e895-9028-4458-a372-8690c5007e94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149978, "uuid": "3f33cb38-48bf-4390-bcb4-b394c6ecc98e", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c0d43c-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136819, "uuid": "4d3d1369-421d-4e13-806a-c0b87a873cb3", "comment": "Malware payload (Mirai)", "value": "5faedd2b1d5ef6168868f075c2d2cbcf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136819, "uuid": "d7f7117e-a27c-4431-9391-d45a310b83f8", "comment": "Malware payload (Mirai)", "value": "4f5cb3510e2aae2a2ba8903c6b44915725b581a69dc9a0c1cd4648d807d4e38a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136819, "uuid": "c655411c-d9c4-4aa1-9281-14dc21beaa8c", "comment": "Malware payload (Mirai)", "value": "88afff2d290f4fa8e2693dc682ec98688754f1ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136819, "uuid": "7668f51b-e538-4cc6-a90c-8f02f07c99ac", "comment": "Malware payload (Mirai)", "value": "bbb3d3cb07387f0dd15968de1918e361e2cea8ef3ea6acfa73261674e4d082e52af95f9e4c226b907df53333790d9004", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136819, "uuid": "76b8e110-d447-47c1-8c41-77e2032a2d1b", "value": "T12851C5C573614BB4BFB14E92BAF68005B085A0D1ABC74EC9E2FC64FE454CF096C915A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136819, "uuid": "df2d7bd8-3102-4cf0-b1d0-dc2c70bec815", "value": "48:vzyuBz3UBz58BzHwBzBwBzdudzEBzoCBzR8BzKuBzLMBzH+Bz7x7UfBzAuBzjWO:vzyuBz3UBz58BzHwBzBwBzM9EBzoCBzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136819, "uuid": "73ae3507-d98e-4336-baff-114f0f54053f", "value": 2877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136819, "uuid": "8a166e28-489f-4bfb-9245-8fbcb0b3c61d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136819, "uuid": "58e1d7d4-ba39-44f2-9e66-535d8c64233b", "value": "thinkphp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f00ed-00b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770092783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770092783, "uuid": "1e887cbd-be2b-4aca-a401-f8eb4bb05842", "comment": "Malware payload", "value": "f80a2d76fed43284122e449c9f8ffc8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770092783, "uuid": "3b9f4506-8dd8-40a3-b902-8051974f62fe", "comment": "Malware payload", "value": "4fad4215a12ef6b677ee757b7e7f81c61b2d7d3557ea15919165fa735f8d8769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770092783, "uuid": "8401c6ad-2924-4529-8cf2-a6ff50965faf", "comment": "Malware payload", "value": "9bd80ba8ade893d028df8a6e1a0b005c8e8dbe7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770092783, "uuid": "082b8b17-902c-4af7-bd48-bf5b2e8bcc62", "comment": "Malware payload", "value": "70aaca897d4e6b440aae31fe91b50f1b8c50ea1335942421131cc64e508bbd0d92f5f20ab2c3d686b5e944d345582ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770092783, "uuid": "1935b829-3376-4018-b795-90577b17a8ad", "value": "T1B8F2184F6B1600ECE4679278A99B5A83E6F2B80A0355DFDF43804A251FDB3D02C7EB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770092783, "uuid": "92bca447-8bc1-4a4c-9b77-8ab07b45f554", "value": "c2da38b421e56dab776c23604ba5beda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770092783, "uuid": "de69b80d-f70f-476f-b18c-f60972c9f234", "value": "768:WOLmRNlnXsxNrLw3KbXjUIy8UvtDZ3UxB:WOaRNlnXsLwwNUc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770092783, "uuid": "422d9b26-1b98-49d0-87ea-cc4954df3d59", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770092783, "uuid": "97cc47dd-a49b-42ca-97bf-4adab74576ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770092783, "uuid": "6d96909a-e64c-4dd5-ab58-5ca4bbf4ac97", "value": "SandBox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9988d9c8-011d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770136206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136206, "uuid": "5ba310dc-2c47-4be7-b82e-5fd6407ad06c", "comment": "Malware payload", "value": "3f08b3c20f2ccf735414b01062ea7c95", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136206, "uuid": "746cfe53-a76d-45e5-a06e-2111f6792eb9", "comment": "Malware payload", "value": "50e1c4bda6062d6303c3cb79a1eaf732cd82340537e947265bd7a637049c3c57", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136206, "uuid": "0712afbd-06a7-4fe0-afbf-0be32b326eef", "comment": "Malware payload", "value": "db7a78b234ece66ccca9b371c5704a6ee8d3d86f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136206, "uuid": "c4d065be-d7c0-488a-bd39-0724e2189652", "comment": "Malware payload", "value": "4f65bd69492eecda8cd10e49b493f2172c94726dd552e1ccc1839f8669fd94ac4203d3a96e881124ae430cad949d36ba", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136206, "uuid": "6bc6a7d0-54f9-43d0-a6a5-20b04060eecb", "value": "T15B51A8A85F63E4F55423B02E91EFE3772F4C879A1D402EB6421E5328B19153D0B5EBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136206, "uuid": "b9e760aa-a5b0-4b87-81d0-bcc080d0d41e", "value": "48:bAVn1F4+uAAYgeYQz9l2XokwCjcKcz+DHwdKOgW4mzrJsu8Zo72tGm4X2m5yX2L4:bAV1eXAA9Kna3cUrwP7zrJsu8Zo4m5nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136206, "uuid": "29f8a700-e2e3-4dab-88fe-e96ae8d0d304", "value": 2912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136206, "uuid": "963778c3-4447-4100-a038-86a505ebd7b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136206, "uuid": "5561fac5-7acb-4b33-99e9-be36a3c7958c", "value": "rRichiestadipre.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76f247-00bd-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770094790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770094790, "uuid": "544dc718-85e5-450e-ac99-4dfe41aa79e5", "comment": "Malware payload (ConnectWise)", "value": "66cb0d0c66098e645a5d05da5ab8c471", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770094790, "uuid": "04410340-99e5-4733-9b38-b314078ec633", "comment": "Malware payload (ConnectWise)", "value": "512afccb10313d5cf15cb3ccefda19a3634388457784a198119be80de158f657", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770094790, "uuid": "58d39ac1-e310-426f-adae-f0c6cde8a5d8", "comment": "Malware payload (ConnectWise)", "value": "619e371cb1e140c33b8c0c627db0cf84d2d8fc05", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770094790, "uuid": "dc28e869-2ba5-40ed-90be-3921e2195789", "comment": "Malware payload (ConnectWise)", "value": "d07b52b6224cc4e67e3ffe6f6699671de901900a7f804bc4fb95531e61a943b21150aff8719aa306e856bb6ed404ec85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770094790, "uuid": "341392da-d8da-44c5-b5c3-bb78010a91c1", "value": "T1CBD622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770094790, "uuid": "a0425f61-c600-455f-bd2c-4fa12c4ecb88", "value": "196608:aHxcp9ym3nltDUJVpHxcp9ym3EHxcp9ym3zHxcp9ym32Hxcp9ym3KHxcp9ym3cHU:oGplpyGpiGpdGpEGpYGp6GpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770094790, "uuid": "0f82327a-582b-48b1-ba5b-f2ab9c3535b1", "value": 13545472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770094790, "uuid": "8d52e31a-9434-47c7-9b5e-840c45a828db", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770094790, "uuid": "ec73291e-35a2-4616-8e5c-d266a16627ce", "value": "WindowsUpdates.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32d8226-00a5-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770084763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084763, "uuid": "c05d0423-4fe4-446c-a8c5-44f65fc1c98e", "comment": "Malware payload (ConnectWise)", "value": "f2b9abb57725d927aac362aad065a177", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084763, "uuid": "d6806d4e-9f06-4eed-99b3-e4ad6cff1e5d", "comment": "Malware payload (ConnectWise)", "value": "513e1febe3eb273e63edd43ae830c5552f98fc46b5d960cc651bbce7fa07c932", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084763, "uuid": "cb2906d4-a9d5-4925-940e-a83cf19c4b73", "comment": "Malware payload (ConnectWise)", "value": "4481e8ac2d8e6e24bfe22f9ac0d4534be0c376c2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084763, "uuid": "314015a0-6124-4f2d-8346-2a1f7c72133f", "comment": "Malware payload (ConnectWise)", "value": "314598decc430e3ee859d8443e063a9976b2d5fe313b7fc118ddc3a72ac31ae5bda1134917f114117be4367bf0be57cd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084763, "uuid": "37055440-bfac-4f50-a1eb-c220704e2446", "value": "T1DBD622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084763, "uuid": "0fdeb630-13aa-4085-b905-8540c3d8520f", "value": "196608:4Hxcp9ym3nltDUJV5Hxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3CHt:GGplpaGpPGpjGpeGpOGpQGpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770084763, "uuid": "473bdff6-ae15-4ee8-be89-e5575d655915", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770084763, "uuid": "57eb535e-619c-470a-82ce-8aea47f92734", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084763, "uuid": "24e92e74-79bb-41cd-8126-f137bf13d525", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ee638d-00d6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770105679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105679, "uuid": "8cf21303-540d-407a-b162-53637d9a8fb3", "comment": "Malware payload (Mirai)", "value": "84b53d6b4a2d6674ae76a5d6afaf6104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105679, "uuid": "fbdce06f-190c-4c8d-9c0c-edb73df4ec31", "comment": "Malware payload (Mirai)", "value": "52971d44f240e3b25e5f4a8e2bee7bf0536dd7a22708a37fb5f853f4ab7aa5bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105679, "uuid": "696e386e-5046-4c58-9036-09c0dfab511f", "comment": "Malware payload (Mirai)", "value": "eb6351d0f97b202a9e94b971f48eb2df9861a8ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105679, "uuid": "cd7e12b2-d064-4142-9b72-0b60b9792df5", "comment": "Malware payload (Mirai)", "value": "e8190997afa460facf9739d760edb1d3987d16ff91a1a1f6464520da3b6abf64f7af91e5462ac1530e97be7a8e4f2488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105679, "uuid": "10f53946-851d-4b8f-997b-d66dac6f9729", "value": "T13CB3E085B210AE55C02272FCB1870A90D3B16E7B4B9A150B4473F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105679, "uuid": "4cfd3c8b-0a1d-4493-9b57-25ac94eb3053", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwug:aevXCLr59hmNwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770105679, "uuid": "052096f3-d774-4b34-957e-fe1168054460", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770105679, "uuid": "12d8c434-0278-476c-83a2-eaabd87814b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105679, "uuid": "79c41151-6780-451b-8491-a2ba1fafe9ce", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1819a11-0143-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770152621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152621, "uuid": "dcb38d57-8796-4524-b62b-1c00a6baa341", "comment": "Malware payload", "value": "605d3ab318b01cea4622fc4ae768de54", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152621, "uuid": "508fc02c-b54b-45ea-897c-5d5957a34ac5", "comment": "Malware payload", "value": "529f346188bb4405fdd0480d3a7bcae6a94c9b95d29b9ab105131407a41d5cc5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152621, "uuid": "5f6a0bfd-d225-4e27-a02c-75da53e06038", "comment": "Malware payload", "value": "9153d0bceee48914ca43eb3652c80ba58db84550", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152621, "uuid": "85d65b07-b8b3-404e-9f1c-a6ec6d07e097", "comment": "Malware payload", "value": "a3330e674174c1bd9d24fca9c0f3d14f4f47832fba8570bd6dc6453f55b8a1fee9b1ce0d2eacef97fe2a210e22fbfcd8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152621, "uuid": "da286f3e-5936-445f-bbdc-32df766dc7ab", "value": "T13035239CFEC8E72AC44156344497DA649A3AEC057FB2C043B333F1417A397B516DAB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152621, "uuid": "1295f392-c5c0-4990-b4ff-cf2a8965206a", "value": "24576:n5NCxM6bch8fe7Vw1SW5elJ/Kn8M2FSPHSVLkZGTCeenDzP:5oxM6Kwe7VkSWlEFSPLYRen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770152621, "uuid": "637f2a6e-bf5c-4814-8a64-19727fdedada", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770152621, "uuid": "baebb0bb-ab3f-4bb4-8cad-3984e859fbac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152621, "uuid": "bd21f8b5-9bde-485f-b9eb-c4311c393e08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e1cda3-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770143493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143493, "uuid": "746bbe63-b6a3-4a64-bdb3-8fd89ce2f5f0", "comment": "Malware payload (Mirai)", "value": "b84cc30d0693f13ce684378d1420e9b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143493, "uuid": "1ed29587-fe07-40c7-9dec-60aa0fcee458", "comment": "Malware payload (Mirai)", "value": "52f0a4ad4cb268800c821a2d9626f3848986e5947dc607ecaa222a2d0922186e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143493, "uuid": "e780afd2-39e0-4d46-badc-132bf21b5186", "comment": "Malware payload (Mirai)", "value": "95fd72d16f217e827bc0ffedc1c87927806e69ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143493, "uuid": "7599bd83-015f-4f48-8b63-ce384cd8a84b", "comment": "Malware payload (Mirai)", "value": "03e59a4d99ad9702a3039face865faa5c32025af335977240d470321dea0c656355655181599bd580c5033f81f536f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143493, "uuid": "73189ae8-51b2-450f-965c-71288d6734c5", "value": "T162C35B03D661C5BAC0C762751BEF8632E563B4F91731322723D4BEA02F129D99F5A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143493, "uuid": "ff67ccd5-2b58-40de-a08f-6eb207819852", "value": "3072:xMxB5Tc9xfHxFScXc7i+TMoc6ygmom0ea7HWvP:Cxs9x/g7jLEom0eaTWvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143493, "uuid": "590c7a5b-158b-4f10-90dc-3bc89b0e40a1", "value": 120952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143493, "uuid": "801702ba-6056-4146-8c11-3b1ae93aa8b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143493, "uuid": "f933a294-6155-47b9-8433-88c1bbc93a7f", "value": "pXdN91.x68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b026c0-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770151286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151286, "uuid": "53a67b28-f958-4da5-a91f-a5db55875678", "comment": "Malware payload (SimpleHelp)", "value": "07f29c48ef1bc8f31116b24e40822064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151286, "uuid": "e3119a1b-d579-4b9f-be6e-e8ac46d417df", "comment": "Malware payload (SimpleHelp)", "value": "539b06cd5656e12d5998d40a684bc705fe131c6a7a907285c669303453f9f79f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151286, "uuid": "c338ea1e-69e5-463b-8d06-3ebfe100083c", "comment": "Malware payload (SimpleHelp)", "value": "2d0c07f9ce3713237377f2749a63495784c9a7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151286, "uuid": "4c8955ad-cd09-4822-ba25-8727522fc8f3", "comment": "Malware payload (SimpleHelp)", "value": "0fda29e68865f815b4eb56c644136903b5be013d8a97a0cae82bbb70a2fe24c281403e0656b2a6338fb09a6f95db7c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151286, "uuid": "bc5a85a7-4779-4298-81f0-7acb59bab406", "value": "T1AA873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151286, "uuid": "c10528c1-2c7d-439a-9064-c0b0ac44a27f", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151286, "uuid": "a20995f5-8214-42c3-ae99-ae473ba34717", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bO:/uRf+nAu2FuQd73XyFeDMnKTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151286, "uuid": "da49c52b-b70a-4b43-b69b-3b9c4705ae06", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151286, "uuid": "ec6c5ec2-4bd6-44fe-8626-8a4ef87ca012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151286, "uuid": "91d77dc4-7a34-4c78-aa17-7cdab29956c1", "value": "MicrosoftExcel.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00e3ad5-0128-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1770141022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141022, "uuid": "45b2921a-d848-48e0-a931-c3da2952b8b3", "comment": "Malware payload (RustyStealer)", "value": "1218afa9a44f1c2a6ed7d5535cb56abb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141022, "uuid": "c0a39906-73b0-4318-882a-96a0965aa3bb", "comment": "Malware payload (RustyStealer)", "value": "53cc94a73508d5856b8ef38d1b03b858ff81e3054e9bc11615c3b637e597ff20", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141022, "uuid": "d015b23c-426f-4f7d-85a4-1d763fdc718e", "comment": "Malware payload (RustyStealer)", "value": "b1e4d564cbf273dc5b052b4d5b4ff01070963c5e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141022, "uuid": "4ed918ce-cc91-4073-a85f-17347d2e4a27", "comment": "Malware payload (RustyStealer)", "value": "b767b1b69e7af9a837ae6eeccaf043e5167ed07225e064a762e8fb08a60f41bdc40f02d221fe4d5082c672c40e1e0ecf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141022, "uuid": "4f39acf0-6596-4eae-9da2-b8676765ba6f", "value": "T1EC669D11BB9F99E9C15AC474C34A8B335E6134CB0B32B6FB418456393EAAAF01E3D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141022, "uuid": "0eb1c973-804e-4dc9-8c7b-9b2746c0a14f", "value": "8ec0b7e3571fd79ea899606d225314ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141022, "uuid": "68782567-1d2d-4417-a2e8-506821f06a01", "value": "98304:AOBCCZz3s/voaIp58tSQehUIL7/w2lFfOc1Jnuhd2M/MHak4fKQ1Uk7:/O/vgQe2QNFCd2lmfKQ1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770141022, "uuid": "a1aa7e45-b171-4185-903c-9e1bab433eb7", "value": 6717952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770141022, "uuid": "2fc4053d-0360-4b81-b985-d42a36d3b3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141022, "uuid": "79319501-cc47-464d-be73-8fb1e8bd1be4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b862b9ad-00fd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770122514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122514, "uuid": "f3842b22-939f-4de7-a46e-9f0c8f7c0614", "comment": "Malware payload", "value": "40e3099e6546bbe3fb66294bf5045238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122514, "uuid": "b3490bbc-9c6d-4aea-9e3f-d9b3e21de8dd", "comment": "Malware payload", "value": "53e48d22a0a1655cb2992283e7e7d403c5c7ae3527e205da22d3f0bfe776b5d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122514, "uuid": "68fc4777-13a5-4d9a-8745-178b5a8c3b84", "comment": "Malware payload", "value": "103bef7c5194b500dcbfac50f73970e80721a53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122514, "uuid": "57d7e8c4-b912-44da-b08a-0f105d58614e", "comment": "Malware payload", "value": "75ca867bc9edabf014952e990cbb36da157b1056e500074aa198336057ac334d935573987e3184548466b576a55b2801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122514, "uuid": "c4ba380a-31df-4b71-b11a-c1c1782a798f", "value": "T1D3A327781445F36CEAB6A078F41229E6152206183FECD1E36C8365BBFFB4748B16DD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122514, "uuid": "907f6c66-ce56-4011-8bd2-1761a20dd429", "value": "1536:JEEQC4qrwG1VLH1MuzoFhSl81MYEVBIVCCfy0K9Ouj:J5OqrwG17Zz4hs8WuFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770122514, "uuid": "0dd7e6b6-39c0-4ff5-a983-8e607bdc008f", "value": 100108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770122514, "uuid": "5ea53423-ceea-4168-82a4-b5f1bd236270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122514, "uuid": "36acb291-5fa3-40f3-8ee0-7afd4848f729", "value": "mao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8689a8-0113-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131970, "uuid": "ef341bf4-081b-40a4-aaeb-e1cbda315053", "comment": "Malware payload", "value": "0ed93021d836a2444b8c1bd3e28b33ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131970, "uuid": "539559fc-ab76-47f5-9bb3-dff080aeb907", "comment": "Malware payload", "value": "54847772fa835a901d022e6fa7cfed894d593cce6305760e24c5ed4af269d2f7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131970, "uuid": "f2bfc754-41f8-4a46-a3c3-7e03204b4a47", "comment": "Malware payload", "value": "24d1587ee50fb56dd2484b796eca65aa34e2385e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131970, "uuid": "025e3700-0047-42e9-80ff-ec17b26bfc59", "comment": "Malware payload", "value": "837e2f25b8e8d4c5f994de112169a5e1155dc4c4c855d02b8866e4c9287cadfb43ce3df482d0a3c70e8f40fa98566b1a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131970, "uuid": "5fa4459c-4095-4922-8ad8-57ed518ed1c8", "value": "T11CB58ECA5DBA44AF40C41DE3C362A445E8F6DE4A05EA1DC4B3ECB09159AC96C42FCDBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131970, "uuid": "32de1178-18a3-46fc-b920-40f520b83dd8", "value": "24576:Pk91ShQDJovVndlwL6b4GAV2FuOvefCxMO5toDMIcCaK6cW/BRfwetPXBy2cXjJ:lztwWbsQuIptVJlFXF6jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131970, "uuid": "9c8c0424-3596-4b57-9a5c-1ebc1b5d731a", "value": 2316327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131970, "uuid": "ac0d0ce7-7a2d-421d-8eac-2b12cbad66c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131970, "uuid": "55f3fd50-6ea8-48de-b979-1f9aac5c5cff", "value": "sapodilla.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9044ec8e-00a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770083792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083792, "uuid": "93b54620-79c2-41b1-bad8-e40f5c9b06e2", "comment": "Malware payload (Smoke Loader)", "value": "c76f06cdea5ab7c57fea4df91da5f922", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083792, "uuid": "3b30f9ed-5b02-4bc4-b577-75d9a16d0b79", "comment": "Malware payload (Smoke Loader)", "value": "549624f96e34e4062140376e9aace04eea379b519ebe1efbaff445c00950328b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083792, "uuid": "455dee58-ad97-4ff8-9caf-b447e7aba45c", "comment": "Malware payload (Smoke Loader)", "value": "b1bea3a85d8ce0e94c018ce32966fbdeb6bf5a2b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083792, "uuid": "29f17b42-14c2-4223-ac3a-0fda342bb603", "comment": "Malware payload (Smoke Loader)", "value": "e2b897346a673ce5aa30aa0ec8b89b5f2e3f1a75a01b0038b3f8cf386fbb03573105c8acb63b1ee1f1efbd26cda09c06", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083792, "uuid": "2b7d6a67-ec49-4c5e-a1f4-241ec39ba6de", "value": "T19726E1713E5C60E6FC4F76B29044B03A2BA4F97B468A3470B498B58E4C47A953F3F466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083792, "uuid": "98a84ec6-d9bd-41dc-ba82-3770f8624c62", "value": "a73f8fb0372b492212e34f67d8f52dba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083792, "uuid": "74891cca-b459-4e4d-9f5f-91465caa6185", "value": "49152:XHW9gDWWYSUc/3ZGstobnSpEKtwD8BqYPU/1Y43qj8HBOIQiti9phks18rbVJ:XH0NW5BGoobx4YYPUJbHcL9phL18rbVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770083792, "uuid": "f07ce63c-0a79-4f8d-b6c8-334cf5bd2bba", "value": 4829664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770083792, "uuid": "a5a6cf68-0d43-420d-93ee-415c7863bb39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083792, "uuid": "e67103a4-954d-4857-8424-21f57225e2b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185a35fe-010c-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128688, "uuid": "649ee846-0ef8-470d-830e-6c8fa90c43c1", "comment": "Malware payload (CoinMiner)", "value": "261138e0855f96d60a67c3eaacb24f69", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128688, "uuid": "ca9cfebf-6b63-48b5-bc88-e0c9910c344a", "comment": "Malware payload (CoinMiner)", "value": "54c35f926229e2c661de324728e65a6b8e7c3c892f2d8cade4a3651f00f44c57", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128688, "uuid": "78cfcf6a-6812-49b2-a04f-ef1703144956", "comment": "Malware payload (CoinMiner)", "value": "75aa16a70b9a1580f837b7d674f1feaae89b79fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128688, "uuid": "3902d322-a7a2-44c8-b568-f491c2b423d6", "comment": "Malware payload (CoinMiner)", "value": "0017ec8391d57210ed3698b9c5ca4c8993dfbf3d136c7988387ac985a239ff07083440ce49898ec20833b91612a12009", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128688, "uuid": "a4041f70-b5b8-41b1-b167-6ef0f09d4d05", "value": "T1B47623AA114D335CC05EC7748023BD0AB2BB561D1DFA45AA31CAFBE077DB835D94AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128688, "uuid": "1d478fe4-1b6e-447e-a5a1-3bebd98941c8", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128688, "uuid": "3529de89-a5c8-4119-8f03-cfe7bd96eb55", "value": "196608:P9+a/dMVXXmB5K/CHLeY8fPlyYmiCqRSk9dGXsf:V+aSHk5/HLe1gYmCSk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128688, "uuid": "80ed6fd5-a364-44c4-a85c-d6ad5ee8ac07", "value": 7757824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128688, "uuid": "8ff2959e-fc16-4992-932c-5b4ba63a3b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128688, "uuid": "65ff214d-c9f1-4515-a8f9-175156338554", "value": "SecuriteInfo.com.Win64.Evo-gen.76891746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87491747-00df-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770109547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109547, "uuid": "051c74b8-98f5-48a2-8ae0-b8b824310df0", "comment": "Malware payload (Mirai)", "value": "3375daf6a901a035e6defa2888e4a56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109547, "uuid": "7277b25d-cb6e-49dd-ae9b-cd3c4ab65650", "comment": "Malware payload (Mirai)", "value": "559de91af33137d196085cabebdc09387e7ac80157babb765b62993a5ce0a6ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109547, "uuid": "efa614ac-9826-42c6-a6d8-ed8fdf960148", "comment": "Malware payload (Mirai)", "value": "ae3f08c42316d84a8ee72518f581880946d572db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109547, "uuid": "a6561a50-08fa-4db8-869a-7c16aea951a6", "comment": "Malware payload (Mirai)", "value": "2663d4dc169ed94f9557d71d773ba766dcd776088212fd93e86c2e0c1b115f8b131ac45de9229428c4814d8102cd1637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109547, "uuid": "7f287721-9b8a-45ea-8d85-472a171ccdbb", "value": "T118144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109547, "uuid": "e543502b-4d37-4058-982b-d3bb94cf9083", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstkOUat:o5H5BT48rYq1wjY2oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109547, "uuid": "a77e4626-9550-44a0-a34e-ef1ebfeb9db5", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109547, "uuid": "3a30e4f1-cd83-4908-88d3-06c3aab3693d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109547, "uuid": "61436082-83dd-4a47-8f69-a7d0198aa621", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb85bdf-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770143491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143491, "uuid": "1ecbad8d-cf93-47b3-b836-90c49b95edc7", "comment": "Malware payload (Mirai)", "value": "a07b87751472727a01539cdebdb8183b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143491, "uuid": "58cd8350-470b-418a-b592-111681fb7fc6", "comment": "Malware payload (Mirai)", "value": "55cbfc2d22759a97b8884843133e9ecb2821f2dfd676d2196777dcbe015b9e92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143491, "uuid": "7a3db3c8-93ac-4d8a-9fc8-232962b710e0", "comment": "Malware payload (Mirai)", "value": "91e94ccf43babe67a1c976a4e24039122b676e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143491, "uuid": "ed494e44-82c5-4663-9c66-0d3547ece36a", "comment": "Malware payload (Mirai)", "value": "958a2b4dba51f847ac972b71b34f217552d10f3be74668059e87e5aaac3b61c3f8c54bbc405e47a5e2fd202b2798fc42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143491, "uuid": "1b06ef19-6f79-4db2-863f-08eecf9b4c71", "value": "T136D3A52ABE12AFBFE1A8823107F75F70879521E237919381E16CD7581EB128D1C5FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143491, "uuid": "153a23b6-5de3-42fe-a6b4-4c9fcb1b4b55", "value": "3072:6tcKSErCS17zmT9YSkTKi4Fi2vRBfecgs7WnrcJffN3XNSFOiaPF2uB5sMOPamkY:P7jtaMOPamkrIFsFswr+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143491, "uuid": "d51611c0-c00e-41f8-af57-8a9ef701db8c", "value": 137859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143491, "uuid": "e5bd56bf-514f-49dc-8cf0-e6a5a1cab44b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143491, "uuid": "d0e0e7c1-0c65-426a-a107-42c02aae0486", "value": "pXdN91.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113cad27-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770101618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101618, "uuid": "968539f8-ae5e-4515-aede-324890de6456", "comment": "Malware payload (Formbook)", "value": "d09741a5ad74dc363c312646924348f4", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101618, "uuid": "979f2465-48b7-4d20-b238-73b93f4fe602", "comment": "Malware payload (Formbook)", "value": "5762f2a4287e3015b2264f5b59c2e34caffa9ce95e1f282f48b72250b6abc435", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101618, "uuid": "96b4da7f-2ac4-4096-be33-e24789fa84ca", "comment": "Malware payload (Formbook)", "value": "1c1ff4837525510e7c60635b6495fcab47e1ff3f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101618, "uuid": "57b8e0ff-2ecb-4214-a39e-81c79673bcb3", "comment": "Malware payload (Formbook)", "value": "ec3dacc4194cd99967c52c5e5995405d35511412e112be7b17aff01e4ad99e1d2f4f2edb556b0593425b5348b4800f5f", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101618, "uuid": "9c0f57eb-cd20-4233-802c-08f4e163e4f1", "value": "T1EFC401B30EDE3C3AC82D40FBA087747239556D86B6B63A05102663EDED1179E66061FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101618, "uuid": "5e387cfd-2169-4570-8026-5e4d2fb6c759", "value": "12288:4uHgnDhA4F9WKLo4mgFJDQPw611ykXr5qpVVftUY/xcM6T6O:42gdrFt1mwuukrsBfeYqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101618, "uuid": "657517a1-5d72-49f9-9335-5d6ffa52629e", "value": 595568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101618, "uuid": "f7be3bab-7a37-46f1-8bc9-8b1a5030cd94", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101618, "uuid": "e1c28d33-5385-4c6e-817c-4cfd3df5233c", "value": "Payment Advise REF A4p2bqoCL7YR.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222584c6-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139012, "uuid": "a882aeac-50f7-4a63-8953-0b63040c50b6", "comment": "Malware payload (Mirai)", "value": "aa3c7d3b3988f115946eb308b8f101e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139012, "uuid": "cd029cd3-7799-4fbb-a53c-7dca976e96b1", "comment": "Malware payload (Mirai)", "value": "57f572f14b487d7af262492e37545a41b6a4c9845dae8a7cd6365450add85fc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139012, "uuid": "8dc2836c-8329-482f-b46b-e76c91f44610", "comment": "Malware payload (Mirai)", "value": "2be49257c8fc8734347ff3c4387d553594213b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139012, "uuid": "7f022baa-a0ed-47cd-a258-ab59d5aca1c4", "comment": "Malware payload (Mirai)", "value": "72fdcaa597c375e91fc77499ce0bdf424900768566828520049cfea10b9f1af28bc6e0c7d7560e7e2b82e256af334617", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139012, "uuid": "27a651c1-6da3-4944-9bf1-760fc2a8edf7", "value": "T1E383A61E6E219FBDFA68C23047B74A21979C33D627E1D685D29CD6001E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139012, "uuid": "a7e5347f-1672-422c-98f2-8ca4e62fa1e5", "value": "1536:rYM+VffRbU4hnVviHdy9BeBcwCcTgee8ns5RSld641Ri:rD+fpbU4hVedEeawz2zEd64y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139012, "uuid": "72c915f6-9e12-43da-8a7f-6f67dc1c53f1", "value": 85188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139012, "uuid": "00326294-2cdf-45d5-a42d-3b3637d58cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139012, "uuid": "8c390806-bc61-4fd1-9aaf-73fd0b66ae2b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a55c89-0130-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144223, "uuid": "16c7ba83-06ff-4891-acef-a07fe38b7944", "comment": "Malware payload (Mirai)", "value": "827ae518cf992527ac374ba257871833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144223, "uuid": "a6134d17-9780-4c6d-9c56-898320e7a408", "comment": "Malware payload (Mirai)", "value": "58c9220ae7d6e5e39d2fe77cb2a3d9df5929572ba2f8cab82e2b0e2f2ab5b13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144223, "uuid": "ad65fed0-5ad6-43b6-a6f4-88f32a65cae2", "comment": "Malware payload (Mirai)", "value": "e83e4155598d2ab61af3a0b17225162d392e34bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144223, "uuid": "69efee45-93ea-4c57-97a2-039de86378a0", "comment": "Malware payload (Mirai)", "value": "a7127a14d63172d724b62467768b60bfcfa22b386226f81a7f9fbb6e643683c6427ff59830a1ee33235edf1b0c359202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144223, "uuid": "fcb18015-dc38-429c-8e1f-a06a4a1de7d2", "value": "T18B631AC5F98B81F6C90B893051A7F23FCB31D9B951708A6DEF4AAF35DB339019216149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144223, "uuid": "69ebca76-593f-496d-bdb0-7d15bd9bf78f", "value": "1536:GzhWSucr4I51a8RzbiPs1begAgbPnZFjT:shW+L5A8ZbiP0egBPnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144223, "uuid": "932cb0aa-cf81-47e8-955b-59e97b2a42ed", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144223, "uuid": "5389883b-3594-45b3-a22a-c4198c6bd704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144223, "uuid": "de9c78dc-e845-4f5d-9602-98c48a336618", "value": "mao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1ead09-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101770, "uuid": "f440e523-830f-45fe-828d-c21870c9e4ec", "comment": "Malware payload (Coper)", "value": "d65298935943264e671fcb19090a42e0", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101770, "uuid": "8933596d-23e8-40d3-892a-15784e1eef1e", "comment": "Malware payload (Coper)", "value": "5a2306804771a975f692d6cc1cbaf06af1b86273301b3af8069f4d36a27d3866", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101770, "uuid": "6c53dbd7-a298-4b7e-9144-30b1aba27d0a", "comment": "Malware payload (Coper)", "value": "93e8a4c7e22e115b4f1900e41e63b7756fd94ddf", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101770, "uuid": "f53a7a71-7b4c-4084-95ca-202ba1365dc7", "comment": "Malware payload (Coper)", "value": "43c3d8e245661c80ddcff05a82dd524ec2117dfed86781339ca24b8bb152303a74f087cceddda25ca9e6d3f6396975b1", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101770, "uuid": "e7b81536-c72f-46be-bc61-11ed13046a69", "value": "T167451242B79A8A13F4BF9A748C1682E46A713D48CF53425B7982770C5D723C98F53F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101770, "uuid": "8a4d43f7-449c-4f38-8d51-40ad776173cf", "value": "24576:xVLQn405DSCmMEp7OYMkkzOf+3H6V85h532hDXwF6HumDcB4pD1mN+eZL:xVlaDMMEpOXz++36V85h58Xq6tDvD1md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101770, "uuid": "07279916-a7d7-45dc-9c9a-0628ed57b01c", "value": 1176811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101770, "uuid": "86d8bc49-8677-483d-bebb-228fd8e67f8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101770, "uuid": "30ac7533-d316-40df-b295-271e0198d33a", "value": "8959532_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b654ff71-00cb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770101036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101036, "uuid": "4d1ffbd4-5018-4d27-bc82-86f6097c8b9b", "comment": "Malware payload", "value": "82789cc43853cddbde66739b575ece39", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101036, "uuid": "110cc3ba-ad45-4cfb-80b3-18f5fd8f04ab", "comment": "Malware payload", "value": "5cd8c1ba1aa32cafe3768037135b45a6da584f1994820c535f6f9189529b0e7a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101036, "uuid": "2d2f14a5-567c-4e0b-9c5e-6213257b03fb", "comment": "Malware payload", "value": "b9276ce605ce2ed67410ba35b3bdebec4349f693", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101036, "uuid": "64f15c05-a66b-45c5-984b-7d9a5dbd6fde", "comment": "Malware payload", "value": "7e8631dd91a5a69eb6c95a1a2518e80b0902bceaff2ef7de02dbaf394049b8d618edb52c036eff48b05e991b42853bb4", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101036, "uuid": "d783fb42-4631-4967-818e-721b507627fa", "value": "T1E157333D01C63169E5EA99F6446FC720E0AACED681BA6C37C20DD848DE33D3497157B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101036, "uuid": "9be36b21-85ac-431e-ac37-fab142da3520", "value": "8b3d27e9f277981c09c4d320e549e654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101036, "uuid": "076b0166-1913-443b-ab7e-1c6c3b343543", "value": "786432:PgyZgubOKWMoIvcmquSBc5KSxJiTewL/Mp9+5M:PBZgubOZMoIYuukkewLKiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101036, "uuid": "b3457a14-1bb1-4f16-9233-bcc3c7729f42", "value": 28000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101036, "uuid": "f0201f7b-9741-4fca-8448-31a1e516db37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101036, "uuid": "209749bf-7946-45b5-93ae-c7aa92609c7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a2ddc8-00cc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770101202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101202, "uuid": "4583713f-c69d-4fc6-8746-49cb59e480f5", "comment": "Malware payload (Mirai)", "value": "85ee8f9f40f64dec5cc14555dad14ec4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101202, "uuid": "55b21fa7-b662-47d5-80af-318dd70d4a84", "comment": "Malware payload (Mirai)", "value": "5d31f67616ce67b53705b25954d0cedfe9e5cfce35d408455f3202d235284fc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101202, "uuid": "494dc6fc-1f15-460c-a9d2-d383977792e0", "comment": "Malware payload (Mirai)", "value": "55ebae1d1359e825232b6163a27fcc3ad35d26b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101202, "uuid": "9eb0a004-9c27-4abc-944e-18a9b8b8bad1", "comment": "Malware payload (Mirai)", "value": "8f8c581f5740a3df448204ff1687956fcbd8b22358c90038456b8e6e65ed0004b808c312487bac856d75b7fe8679d4af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101202, "uuid": "27cf2b7b-671c-4b61-8131-74612ae05202", "value": "T18334B70E6E228F7DF7B8863547B78E20A35C33D626E1D584D1ACD2115E6029E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101202, "uuid": "4185ae29-cd91-4e3e-8fa3-e567d1fb6824", "value": "3072:UUohIBHXvk9XCeeUehsUPWDbsBGrPY3WWzJv7dlFVvXIBs+6/Gy2CcxTUwcwbZni:p3s9CehehCskY3WWzJpysfJ2r1UtwRmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101202, "uuid": "9b1a89b0-ba9d-4633-b3ba-beb44e8d1f95", "value": 235060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101202, "uuid": "cb5bef8c-c27f-495e-baec-4c24ae77a0e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101202, "uuid": "ecde06a9-8bfd-4b40-ac39-9ca533e6e124", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548f3c28-010f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770130078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130078, "uuid": "88c3d295-d514-4617-8363-a49a72a2f152", "comment": "Malware payload (AsyncRAT)", "value": "69f60dc057d4d78ffafcd41269af8028", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130078, "uuid": "f1bfa4e5-55e3-4e00-8ecf-d7bde431e99b", "comment": "Malware payload (AsyncRAT)", "value": "5d855db5b62fc0f2e6128da7e9dc014646691314670cda80e50c98360aff85c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130078, "uuid": "01a69f91-f27e-4293-9101-67c0ab8bf4ee", "comment": "Malware payload (AsyncRAT)", "value": "45018bd9d74380f408857240bfbbb53bcb83bb7f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130078, "uuid": "5633e49e-2daf-4531-a615-79e0220f432e", "comment": "Malware payload (AsyncRAT)", "value": "0de1b9826c178b33454461b0b30857baa2389ba6d0eccbe7e098712cbfe02526f1a149ead27e42be5a484e674cc69952", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130078, "uuid": "d01f85a0-db28-483b-996b-28a90381b55a", "value": "T1DBD23A08B3D88562E1FD57B94D7293048771EA5BA563DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130078, "uuid": "f2094360-1abf-45ab-a3d5-11d3a948ffc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130078, "uuid": "a1b3006b-520f-48c3-b5cf-01f088058fde", "value": "768:jRitRXZ3p4UAMg/cIRGqoe/Rb7fB/dT+/+:jctRXNp4UAt1iQRbN/U/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130078, "uuid": "2a527514-89bc-475f-bafc-246e1da8f48f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130078, "uuid": "7d9e0dbd-2e67-4867-abdf-33b8a6f99f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130078, "uuid": "1253827c-d9c3-4528-add7-bed6f9f8e805", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f1052d-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130972, "uuid": "378c0d0c-cb33-4cfe-9ac6-45e9af7e4ef8", "comment": "Malware payload", "value": "c90faaf4352fcad3d97df5e52ac29ec1", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130972, "uuid": "62b22863-3826-4213-90e4-e49aba332148", "comment": "Malware payload", "value": "5e423a57aaae2439aedf053e0c421d2681f7c89942bdc88c0daa7e5ac83f236a", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130972, "uuid": "bfd3ab77-6236-4667-a9a0-4911ed048706", "comment": "Malware payload", "value": "14799fca2b402912d146a352529c5f1217cf701a", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130972, "uuid": "6f923db0-4724-43a6-951c-161b40af584a", "comment": "Malware payload", "value": "18666286d3d2bd98f75c63cad5032f06bd8b1fb2c645951319a01e3fd23bbdea3fd1349d3bac83c88159a4cccfefc4e8", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130972, "uuid": "3f9101af-fac3-4852-9785-a677d21a7b73", "value": "T1F14733DA446957C0F118963960802732AD0E943BBC5BBE27F879DCB082D7EFACD51668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130972, "uuid": "eb341cf8-6b10-4eea-9f69-1ea5a041e298", "value": "786432:E9PlcTfUjmY2Hk0Nk360/Co7FWNTAqN82Jg1Hhl:+cAjmf5NC6qCw6SSOHhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130972, "uuid": "f650d761-3670-4cc3-850c-8dcf65103140", "value": 27033377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130972, "uuid": "585f3098-d13d-42f0-91fa-a9983629852c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130972, "uuid": "41f06306-616e-48f5-b770-62a19f9dd1d6", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbdd497-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770087952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087952, "uuid": "c913a974-c339-4f5d-9b89-c789769c42a0", "comment": "Malware payload (Mirai)", "value": "9f709373241be4362086a79f9305e672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087952, "uuid": "45e044ce-cbd7-4529-9c63-e50989498e88", "comment": "Malware payload (Mirai)", "value": "5e74a50c9255cda93e51e37903260477800d9aac1301e8447a8793a83529c07a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087952, "uuid": "66ab84ab-dd20-4323-988b-eda66cf66c11", "comment": "Malware payload (Mirai)", "value": "0baddb21be1479f1967eda9ec8f2e96635853644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087952, "uuid": "a70097a7-818a-45de-9de4-dcc8576d2eb6", "comment": "Malware payload (Mirai)", "value": "a7edfdda89d179c995b060c5c33f1bb7d2cdb9c7ce3212f5d71fb06a420180dea949e83372ec669796dec794e565dc4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087952, "uuid": "c4b8b6ed-ab21-43f0-9725-f42f1e7aefad", "value": "T1AED2D1B52A0B4ACBDE6BD8F5C3E413E009794E129903FD4671E8838797279C0909BADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087952, "uuid": "60c69399-85fb-4820-a336-c85449103778", "value": "768:XxMWBhAHuLegF1aF4NscfOl8liVvkJgGlzDpjcy:XxdBGuLea19acfjli9cV1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087952, "uuid": "2b3abb6f-4b4f-4ca4-8250-7d99fba59c8e", "value": 29676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087952, "uuid": "cef5d27d-a338-4b1f-b27c-60b5c525af6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087952, "uuid": "ba47e245-52ff-4e70-9419-4f49fff04316", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d551710-0144-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770152936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152936, "uuid": "99a80a35-3840-4453-926d-3408ff30c2ff", "comment": "Malware payload (Mirai)", "value": "046dba55a9f9c6b3b22343bd99b1835f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152936, "uuid": "4216353a-7e81-4217-bb07-e41e2d6472fc", "comment": "Malware payload (Mirai)", "value": "5f10d5dd16f2b97d2f89f763373e7bbf26a1adab73addc9363547788610751fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152936, "uuid": "074bd5b6-934b-494e-a444-daca95bd2a3a", "comment": "Malware payload (Mirai)", "value": "0b79a802065554c91c9b90444f47e812ace44bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152936, "uuid": "f3765dc6-d1bc-4174-b395-018d3be798a8", "comment": "Malware payload (Mirai)", "value": "fa79d766002d28a8ef06445c963095a84812a5bcf5152e3b4f769da592cff9dfd25b84538cc4ceb0e64f22697430a2df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152936, "uuid": "bd3b8c53-1b9c-405f-bfa1-42a5a44f0949", "value": "T182F219C0A943ECF4EC1A06B01137F7769776F4352128EA93D769D973BC81A01EA47399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152936, "uuid": "bf3129ef-5de9-4412-a5b2-839f6da2102a", "value": "768:eKlCwPeNe/9EmoWKEHw2anpHSA0A210nSA+BOyYj/:fCwPeNe/9ERWKEH5gHfd80nSA+oyYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770152936, "uuid": "f0d2ac26-1a3e-4a77-9c9f-9ee21046ea37", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770152936, "uuid": "d6311210-cfdd-43cc-a26d-88c5638f1657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152936, "uuid": "9ea37c18-525c-4d1f-884b-7f70d4addba4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4019a3-0104-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770125505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125505, "uuid": "beb8f849-052a-4124-afb3-bf250f268ece", "comment": "Malware payload", "value": "8b8903b0e7b7a1a7f501277624bc7e6b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125505, "uuid": "9ebd6693-4ed0-4664-904e-473356cea0cf", "comment": "Malware payload", "value": "5f397327aeb20718e364bef61e8bad507772708a7d1bf55d8b845170c69f3de0", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125505, "uuid": "b73febf4-3209-4765-a96b-ebfa699d0086", "comment": "Malware payload", "value": "858e841b91f16d3567b133b3c90d01e0499d5169", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125505, "uuid": "9653542f-1228-4e7f-af7f-22867e8b51a8", "comment": "Malware payload", "value": "af6222e96eb3fb78ebe6ada14b3a3ab851cceb7363293acf36c69f0b9ce23c5a9b8f78ac7673e4a51559196a1efd69b1", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125505, "uuid": "e23e4f75-1684-428b-9c46-07d00ab8a5ad", "value": "T12FB15E7870C64CB5F6E7C004289F7D2040F1F1DBDAC54AA063BCE630B9E5A9A5F49488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125505, "uuid": "81de1bf5-38e5-4d83-99ec-65632316071a", "value": "24:PKfzxds4Up/wVEZaxxUiUHEETlKCWlhvanHRvXDpRKbjfjY:IvYnOgEEAt3yxvTpRKXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770125505, "uuid": "d9fde77f-d874-4ccb-8738-0452d78aec48", "value": 5543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770125505, "uuid": "ab64b65b-2dd7-491f-8ef6-f7841f92f531", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125505, "uuid": "c067d71e-9ef8-4384-9390-525777e53aac", "value": "Shell.Explorer.1-auto.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f052058-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101775, "uuid": "c66124a6-2c1e-4805-9d18-eb9a741d6e3f", "comment": "Malware payload (Coper)", "value": "883779f870878233f418122c26efc39e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101775, "uuid": "2d5d3a1e-d6e5-4abf-b83d-33e68fa5f0f0", "comment": "Malware payload (Coper)", "value": "5f6016b9bcaf98d2276187b7ef74a1662bd7e21e610ebed2b2ce5a7aea799600", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101775, "uuid": "32978fdc-a469-420e-ba08-c429aa12ebcd", "comment": "Malware payload (Coper)", "value": "27815d7922751cad17011466166122c9835eb81a", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101775, "uuid": "ffeb3548-2a3c-4a34-b2e0-b679e6b9ae04", "comment": "Malware payload (Coper)", "value": "84d25a1f23a160506e0b4356aa1ec50921363e15a78ced6f74c5a2316302f520b9bdd8af77e6638cc0e054b4e4ce58af", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101775, "uuid": "3aa78004-febb-438e-a90b-ba9c9c80efd5", "value": "T1E4451342F7E9C613E4BE1B348AF683A59120BE90CF8143176E45731D0E73395CF6AA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101775, "uuid": "b626413b-706b-4558-b8ba-11f41280f893", "value": "24576:Nx+n9I0cYBt183k+Bs6X7MlHUlrFxqO1zrexkqO2nCnAtC:NxBfYtq3kVEwilJxqwzreek+AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101775, "uuid": "0e0e88dc-379e-4df3-8556-5c3b7d294928", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101775, "uuid": "5ba83b6e-3cad-4bc4-80dc-676fefbad68f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101775, "uuid": "f9152d45-d7db-46a7-8b04-755ed06c1804", "value": "a9e8baf_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fee554-012a-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770141893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141893, "uuid": "50679597-4cc0-4736-9cda-1e4e298b0ce4", "comment": "Malware payload (njrat)", "value": "c92f891e6605e41eedec950d6cd78af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141893, "uuid": "f2344006-7c09-47d6-bfc5-bf3f4e028185", "comment": "Malware payload (njrat)", "value": "5f988a5f586cfcfb878d300e1b0d7b25fba8954aa821d5d8a6799c607c65bda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141893, "uuid": "5091b244-652e-43b7-8196-9a53eb0426d3", "comment": "Malware payload (njrat)", "value": "7068fe1c594229019a8d6a7bd329f28b5717bbc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141893, "uuid": "e4742a20-cabf-4849-b71a-9cbc12642640", "comment": "Malware payload (njrat)", "value": "0a05b6eafafa0b1c5bbe258b90fe9e5c79fb6fe33dc3ccf83f0373d217c3d94109a80c61195672f3e783d4b40ff2b4d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141893, "uuid": "4bd2d23c-9063-4cd1-9508-12d3b454ee1f", "value": "T18D133A0477E98625D6FEAB74A87262434AB5F8275912DB0E08D0849E3B37ED48D41BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141893, "uuid": "106199c2-1f07-444a-96dd-03903df97b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141893, "uuid": "a9dbd318-1e1f-4f64-a3da-a0da05de4fee", "value": "768:0MkShX7KwE8yI2qJp6QjP0G8PC5PN+IFym9MX43inpoO/hyyv2d:NX7KwEZI2cH5jFt9MX43ipoO/Eq2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770141893, "uuid": "5a94ef1e-7500-47d3-afc9-b76978354da8", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770141893, "uuid": "168d12f2-5127-40cf-a537-ad5365533ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141893, "uuid": "fdca2d62-710a-47e7-99bf-b87f1d6c96d3", "value": "5f988a5f586cfcfb878d300e1b0d7b25fba8954aa821d5d8a6799c607c65bda8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9686902a-013f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770150804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150804, "uuid": "ac5bf22c-aa68-4e1e-a3ef-1104656eb823", "comment": "Malware payload (Mirai)", "value": "02fcb3da3f920c52c4b2d7e575f406f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150804, "uuid": "7d0b4c1e-1bdf-43a8-a071-a1dce00af54c", "comment": "Malware payload (Mirai)", "value": "5fadceb1fe58ee218bcf8a098dc6fd4848ca8e49f2456e29e4cfcf62d095a4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150804, "uuid": "b614fbcf-49a1-45e8-9130-8048c8986d3b", "comment": "Malware payload (Mirai)", "value": "52c9d0df2e8090e35aafb93df18595e6524502a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770150804, "uuid": "bb6e7fad-d32b-4ba9-a391-ee5f6ea88e95", "comment": "Malware payload (Mirai)", "value": "9df08972f7d1330ee6e61f31c1ebb0f99cff4611329045997a955865a4d8546370625c442376e9d354b69f5685cb90c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150804, "uuid": "47102eee-001c-49a8-b884-bdc7c447909f", "value": "T101A309C9BC859B11D5D535BAFE0E518933138B78E3FA7113DE189B2E638A85B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150804, "uuid": "d6d3a557-01fe-4842-accc-af9b6a179364", "value": "3072:6RCsv1r+67AHERqfpu1y0uek71lCnXSeSWDsT7eNJJ9X:N6lQu1y00RlCnXSeXDsT7IJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770150804, "uuid": "73b3520e-7b6b-4f91-9e99-414ab12cbb80", "value": 104248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770150804, "uuid": "9a503011-8101-45e0-8ad4-0b4452639e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770150804, "uuid": "143ac389-b1ff-483f-a52c-ce494996c9f9", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d477610-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770139031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139031, "uuid": "598a92b8-584d-4bc3-b625-6595d805d520", "comment": "Malware payload (Vidar)", "value": "5623c53fdd01cdedc7f007586a4826fe", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139031, "uuid": "89e2702f-edc9-454e-8644-300a97447502", "comment": "Malware payload (Vidar)", "value": "619e9874637399d80d9e09d0a9ee4328f6e2305765ef915cb787ef9526d267f4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139031, "uuid": "b14426ec-088d-4081-9245-b60a8d259638", "comment": "Malware payload (Vidar)", "value": "26d6792da6779c33a8881eadd78f534df5d7fc5c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139031, "uuid": "bc4e89ea-ba1f-47b3-83dd-a0eacd532bf9", "comment": "Malware payload (Vidar)", "value": "6a7bdad0b0c06d0e658ef4d9620743164f7a380d6fcdde1d2a5e952db84c5d133303951e7503455d02733a99a1f30cca", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139031, "uuid": "ffe07ee5-8f52-4597-b271-ef7e80c3f4a2", "value": "T1D286197F729592A8C25D853FC0A7CF40F5F372761B33C6E712A007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139031, "uuid": "36481fa6-a5fa-49aa-8b6b-20eb7d36555b", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139031, "uuid": "a9cb0432-f0bb-460c-928b-c678c753bc8b", "value": "49152:9Nmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgfQ49dp3MB0MvFTPB:9z7Vp7rQ49dg0uFTP7+Zzao0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139031, "uuid": "90339904-813a-4cf7-b4b9-f7977cbe29be", "value": 8492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139031, "uuid": "fe24d838-8b88-48fb-8f9b-199d2024b8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139031, "uuid": "8eb95ee1-c711-4360-afb1-1b8889c5c47c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851a8b51-00ef-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770116415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116415, "uuid": "5a45a148-c7ae-46fa-aefe-fa00b8ba4025", "comment": "Malware payload (QuasarRAT)", "value": "733ed829c1e32c9b6fbc815e7fdebdb6", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116415, "uuid": "6a4076d2-74dd-4f18-b8c2-839fe6ca3ee2", "comment": "Malware payload (QuasarRAT)", "value": "61ce0eabdc3d24838d1dcd24c43aa47ad295555cace247bb158b18966caa2d7e", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116415, "uuid": "32bf92d6-9c1c-45e7-91e2-a765dcebd56a", "comment": "Malware payload (QuasarRAT)", "value": "56b32f914e69adf62b0d23666e55bfb53145837d", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770116415, "uuid": "9d67d12d-ff92-40ba-82a8-b8aa49be81f0", "comment": "Malware payload (QuasarRAT)", "value": "059beed7683e7890ec6c3c31d695a54159a1209892d2ce266a243f34cda3524574055b37b67290c678808e1d3d3cbaec", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116415, "uuid": "1b3679b9-ae56-40fd-a300-16432600f288", "value": "T1E8E55B1437F85F33E5BAE673D5B0401667F0E82AB3A3EB1B2191677E1C53B4058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116415, "uuid": "5c3a705e-c171-4552-9d5d-7f066165419c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116415, "uuid": "b577c856-0200-494a-bd81-268fc2e1c275", "value": "49152:NvSrdR2AMaI8aIP+ld7fB2ZL/IUNZfUEw0Wk/KmOoGdrSTHHB72eh2NT:NvAdR2AMaI8aIP+ld7f4ZL/IUNZfQfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770116415, "uuid": "a26e28ba-2f70-4388-a694-caccb3a5e4bc", "value": 3275776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770116415, "uuid": "ebfbf20c-4128-48ea-b604-617b220bc171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770116415, "uuid": "f643f086-7dea-40f3-afa2-d72da4324c7b", "value": "ArcStake Engine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02298fd9-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128651, "uuid": "1b9b6f77-ed67-4440-859e-29d856243bea", "comment": "Malware payload", "value": "4730a5cce508e5d16af27d8cdda18480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128651, "uuid": "10dc6cf3-4ed2-46b9-92f1-7bce5558b40a", "comment": "Malware payload", "value": "627ccb29a8bd1a86f475ec28082285277007aee23fa447116a7adcc490a205ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128651, "uuid": "9495893d-93f6-4fc6-b75b-97fb989675af", "comment": "Malware payload", "value": "da86d31d42f3e0e20e795443b31adbfaadad7895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128651, "uuid": "19c09aff-be75-4242-b86d-364787ac14ed", "comment": "Malware payload", "value": "127b5358aa9c8c5ccf93354b329340da2b0320eef47db30c1b57aae9420919da7fea78e800ffff7801afc51030aad5b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128651, "uuid": "beeed04e-8af9-4f06-ae4c-73fff17942d7", "value": "T10B7623FA214C33A8D01DCB745423BC0472FE661D1EE959AA76DBBAD02B9B424D907F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128651, "uuid": "ab0df08b-41d7-4e62-90f7-88c688244d64", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128651, "uuid": "7ddd57ee-762f-4a93-b8cc-4c65d4c00bde", "value": "196608:ocb9VPcFffn+3ENM2gyQLwbZ4F0VYS/mysNr41U8T:oC9tcFff+3ENunwbzVn/mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128651, "uuid": "8bae3e96-36d0-4baa-b0c5-3a313cc131d1", "value": 7773184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128651, "uuid": "4d6b40bf-927a-4c6d-9695-aa0257a7e26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128651, "uuid": "57adce5f-39c6-4504-9d22-f9644c0c34bc", "value": "SecuriteInfo.com.Win64.Evo-gen.17995527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b6d08-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128690, "uuid": "fe18fd86-2549-4277-b8f7-4bcb6837a224", "comment": "Malware payload", "value": "8630d67edbb4a4f07fefa4fd74e922bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128690, "uuid": "1ddc3d4b-58c5-4fae-8486-e76cc26eb473", "comment": "Malware payload", "value": "62f8e12fbedd6dbc9c273abdb8ced06f909d55af14b497957419860ba358c0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128690, "uuid": "e122f234-cfd8-497a-a140-687df3843258", "comment": "Malware payload", "value": "4e14d6f4b88120a682caf9b9fe994b5b1fef27af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128690, "uuid": "3ddb6d3d-f206-4017-a1b1-485e5c93f780", "comment": "Malware payload", "value": "7947e0d72ece1e11f0765eec30dec9f99bada64043817e381907b5c1dc0a76a93a282b8d0302de3a1f8ee6f871287495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128690, "uuid": "76ce7a67-e8e4-47eb-951d-0b9e233c285c", "value": "T1E77623FA604C37ACD01ECB348423E90572FA515D4EF96A667ADBBBC03B4B920D913B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128690, "uuid": "cd82a471-fb17-4930-abf5-40046b1f193c", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128690, "uuid": "c80d65b2-c727-4e69-99ba-b6743c8c879a", "value": "196608:NWk1nWM1acH0FdK2Jowpi2TiLTA2YLwYgiE1mv:3R9Qct2ewpi2TEA2Y0TiCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128690, "uuid": "ff531870-a351-40c0-a652-4eead3d73c2b", "value": 7770112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128690, "uuid": "830238e9-4d8f-4398-b191-e832dc3444e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128690, "uuid": "cd6d8940-939e-4531-ab0f-3790535a9a48", "value": "SecuriteInfo.com.Win64.Evo-gen.52758591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdadd18-0094-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770077371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077371, "uuid": "ba9b13b5-e8fa-45ca-b1cc-d9e77e0d813a", "comment": "Malware payload (Mirai)", "value": "d50d05910bedc961171e1b79adb69b3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077371, "uuid": "fa755abe-014c-4fe5-acd9-911bdfd3a963", "comment": "Malware payload (Mirai)", "value": "630619802db282745e2a0b1386f4ce63e009f3cf9471bb90c57f31afa052bd50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077371, "uuid": "7c78f64a-e64a-4d19-95fe-c1d854a36420", "comment": "Malware payload (Mirai)", "value": "e9fac3a4de37e0e617e93a3c1e8d9920dcf0de04", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077371, "uuid": "e76f5d5c-56aa-4eda-b363-707305ce4ee5", "comment": "Malware payload (Mirai)", "value": "1b96cdd7712683a18547e662b1c9be026c5b1c4d3735fad01b4c2038b9d4d1abfcd988232f1b19479171bca7c6c0f380", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077371, "uuid": "6176c465-960f-499a-85ff-d5dbda689c2d", "value": "T1B191A3E57478577A2DA0ED7377D6C582F18032AAE1C94C0AE2D6F0E4485CF61FC94A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077371, "uuid": "2a7af3e7-de99-4966-943a-58b1525cd32a", "value": "48:vnuMV4k2nt1V4dnrsrWV4hnCoV4DnEWEEV4EOLn2kV4DJnt1V4BnpZV4hnASV4xP:vr0nW16/QENEpOLN2ryjaBqTkrS7x3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770077371, "uuid": "7e9319c7-fd38-4005-8b6b-2c7cccb7f6b9", "value": 4409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770077371, "uuid": "0fd8a6f6-8d3e-4a88-81c9-1cf3b2454a64", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077371, "uuid": "e8ee3652-d9b8-47be-b272-14a6bfdb3789", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6bbb79-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128671, "uuid": "0b593d50-d1cf-48ce-8590-e0ffb61be370", "comment": "Malware payload", "value": "f41f0fd6231e14e1a42c5d0ddbab7929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128671, "uuid": "2945ce7f-9d5d-4938-bdf5-ef8833ac1e69", "comment": "Malware payload", "value": "631b997806a324ee2230e1971adcb7827e5483c06c77d5d8f14b9800861c3e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128671, "uuid": "d929b213-4970-4470-b6b8-140f241a0465", "comment": "Malware payload", "value": "1963bf16ff9288ef8fe32c300691ad1f01194095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128671, "uuid": "75b29777-86df-4f97-9c95-58cab39f1d62", "comment": "Malware payload", "value": "c660fed6f7678b7abbfca3b430b1c17192466a8943de4a363c50995ea880f9ebe0661c271cfcaa2aadc635e28593bcc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128671, "uuid": "8390f831-eb67-4fca-b673-eabf8237afba", "value": "T1237623AA654C336CC01DC73494337C45A2FA551D1AF896AAB7DBFFC033AB810D94AB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128671, "uuid": "424b7d76-0d9e-4f45-8707-e1c06e2e9557", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128671, "uuid": "41745c8c-e3ce-407c-9aa7-9816dc604c53", "value": "196608:sTlF+1kSClkGkunyQl9KH9ARVhxP9Y5YPqG8Vz85:alokSgkGkcl9Q9IflY5GqXz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128671, "uuid": "35b868bd-6bfd-4351-b3a9-ca502dc49905", "value": 7777792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128671, "uuid": "1a6bed2e-c240-426f-8c8b-bad4a3036de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128671, "uuid": "47e406d9-bdf7-41f2-a99d-eb33f984c521", "value": "SecuriteInfo.com.Win64.Evo-gen.72228548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6062bc8d-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101751, "uuid": "43990fe3-f406-4217-9d15-62a2da1319c5", "comment": "Malware payload (Coper)", "value": "8bb9298bb9096623701985eaf19a8e7f", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101751, "uuid": "e0ebe487-1128-44fd-b57b-07e3f3bea960", "comment": "Malware payload (Coper)", "value": "6406d67b9abef51ee7058c77f886e5828e23c1bf8f31373f8ca2df65abb5b431", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101751, "uuid": "e258ca6d-70db-4a8a-a8a3-40628d696ac2", "comment": "Malware payload (Coper)", "value": "040e61ae5cb648b2a2ef49909739710db673aed1", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101751, "uuid": "3170ae5e-740c-43aa-9a0e-b0bc8296e717", "comment": "Malware payload (Coper)", "value": "838e33afb5cbbb79c04bb88b21b6dc4f89a87da243f722dcb9d0daf60e6c23cb092ea282ab3decc9f7b02341b88624fc", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101751, "uuid": "9a28042e-ad3b-407b-b47a-3e4eba738ffb", "value": "T1CD452383E7488937F8D5643C99C78354F232B0A962B2A7E74F80DE491E53398C653E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101751, "uuid": "a8112795-a2bc-4420-b3d6-7b214599b462", "value": "24576:Tx+U2sfAlwIZl17DiEYly8hR1/1riszHnp1LLUskSVSdnTqP:TxN2sfmf/FiUy/1riszHp1HAqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101751, "uuid": "be362015-4e11-4d84-a3e2-8d0634fd1bbe", "value": 1164507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101751, "uuid": "0e734228-ea9d-4191-971d-3ccee62c1d44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101751, "uuid": "652be265-0fd0-43fb-be16-49668466e89e", "value": "34c1fbb_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9b3a56-0133-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770145742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145742, "uuid": "607a38ad-2bfb-45af-89df-32c79bf634ec", "comment": "Malware payload", "value": "7b5f3973a2d479d674baa51ab400e01d", "object_relation": "md5", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145742, "uuid": "e720f644-875e-4bc8-b2c5-89a1e11341d0", "comment": "Malware payload", "value": "642993f67f16b6c920ce88c59f2fe596495ebe76973766a81998139fcad4d092", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145742, "uuid": "46b1ac47-8196-4809-b69c-ef88dcd4a588", "comment": "Malware payload", "value": "842c5bebca7f15597bbb22e6f5d29f6d3cfd231f", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145742, "uuid": "b9271bfd-50f6-441f-9649-ad9901782ed2", "comment": "Malware payload", "value": "08acdd55537e43c2aaf97707b039426e2cd4b05df73e23289ffd7a78343931ae239b72d5bbacb794f2f382f264f554e9", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145742, "uuid": "ac45747e-3e1c-4043-8834-ec5a464d5591", "value": "T164C02B322108237150D4AC037833C542A33618CA051F3C700B057449E4C23E07C29094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145742, "uuid": "326261d4-3138-4252-8a10-e8071ba5e010", "value": "3:vTqdLLLQ6DFVkidrAITH3x8ovOAIiW/HNdy8EyOGoZympln:7qZFvk4AILh8sOAIi0td4z9tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145742, "uuid": "d6f68527-2d24-4a88-91ad-d641841f9498", "value": 136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145742, "uuid": "16666913-0c8c-4aa0-98d5-b33daa6ce432", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145742, "uuid": "996e5e5c-8e5f-4095-b165-b3b9216c1059", "value": "sso.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dd19d8-0120-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770137626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137626, "uuid": "7a8a3fd6-20eb-4ec9-b305-3d28c5a2a38d", "comment": "Malware payload", "value": "e39b4962a6951563f1b605ff63b0ed1b", "object_relation": "md5", "Tag": [ { "name": "Crypter", "colour": "#C156F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xerinfuscator", "colour": "#8EF489", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137626, "uuid": "60bc7120-58b5-495d-abde-a24cca15273a", "comment": "Malware payload", "value": "642ab66a276f22e7d127c7b24dbc7e5c38c4d81e7f034af7ba642ed9c105a7f9", "object_relation": "sha256", "Tag": [ { "name": "Crypter", "colour": "#C156F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xerinfuscator", "colour": "#8EF489", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137626, "uuid": "ae7203e3-cfe8-4779-b187-6e17b6f3be02", "comment": "Malware payload", "value": "c41669b8f1b23848ebbd6f360be65af967706b5a", "object_relation": "sha1", "Tag": [ { "name": "Crypter", "colour": "#C156F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xerinfuscator", "colour": "#8EF489", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137626, "uuid": "7d26873c-b50b-4c3b-8db8-9b567aed2a1e", "comment": "Malware payload", "value": "93c97f06e3ebfc73773e478df8a571e505f4faa4fbeca5b50eb2fa88ccf79f67e4bdd937d03ae123fa8c31cad425e072", "object_relation": "sha3-384", "Tag": [ { "name": "Crypter", "colour": "#C156F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xerinfuscator", "colour": "#8EF489", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137626, "uuid": "9876373d-6d77-48c3-86fd-549d1c29c1f0", "value": "T192E53B023380DD54D5F6F9BE549993C8C81DEE4C498BBA2BD171149F2ADD96F8C0ECA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137626, "uuid": "24864cf1-f283-45ce-be51-b3f12ea5106c", "value": "49152:IXaKTzTc2q4bU/O3cuKXb1+eD030Zj8geZbv7C3stVuUpejsoSLl4O1:W23/OMuooeDtpU6j1SLlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137626, "uuid": "d41ddb4c-f78a-4483-ab30-4defe63a3718", "value": 3190784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137626, "uuid": "831a9a5e-2ea7-44fa-9e1c-dcb7e016600a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137626, "uuid": "d4de3253-1c25-4e4a-b1bc-f398e55509c0", "value": "642ab66a276f22e7d127c7b24dbc7e5c38c4d81e7f034af7ba642ed9c105a7f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9960a8e0-0113-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131911, "uuid": "536378d0-804a-4836-8197-e8469ef64325", "comment": "Malware payload", "value": "76b031b8b51d3db4c14c93ba8aeee38e", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131911, "uuid": "25c04e1d-850e-4008-823b-a8d92aa85919", "comment": "Malware payload", "value": "657b2b7ae184db3d939c2e89ec276a01d225618684a814722522e356dab37df5", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131911, "uuid": "e1a2ea81-1bac-425d-a904-68e28c16ac93", "comment": "Malware payload", "value": "32b114510fab6a6424127a96b1a4742334474053", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131911, "uuid": "71171de2-ac49-418f-b81f-115dd7f7edda", "comment": "Malware payload", "value": "b9f9d960bc9cc752915b901b3d49e825e1e52bb35380fa84055d3bca758d97be69a24647f393627e999385ae6acf3bce", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131911, "uuid": "7f0bdd82-ce6c-48ce-b3f2-221467a8dae3", "value": "T10095AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131911, "uuid": "0a22763f-c62d-4907-be5a-df30e9955e86", "value": "5fb75b2a87c1fa7cc3d7904a0b97084a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131911, "uuid": "cc2f66f2-41bc-4595-8a3d-709f1cf6be2c", "value": "24576:6UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBX:6566l2u45BiNYFrz31Cv3D29kd6kED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131911, "uuid": "869ada9c-e0d5-452a-932a-527a8ba2710d", "value": 1998168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131911, "uuid": "b404da0e-0482-4726-8e3d-bedd6debda0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131911, "uuid": "814b819b-3de4-4eba-bd7e-5c5b0de23bfb", "value": "d3dx9_43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b0eec6-0130-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144224, "uuid": "b11731af-dc5f-4c81-85a3-cc015112084c", "comment": "Malware payload (Mirai)", "value": "c61101c0b87387d7e6ebdcefb6fa11fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144224, "uuid": "8ccde596-b8e9-4585-87a4-96c7fbc12005", "comment": "Malware payload (Mirai)", "value": "65c1b5a4909e6f0bad16e48d4005f68d453936b72256564900537445582b0591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144224, "uuid": "764e8d0d-6ae1-4057-9814-cda0fac530f2", "comment": "Malware payload (Mirai)", "value": "bba23f1c44b8bce1a556d4f0480b4056363c49f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144224, "uuid": "7c243a41-0eaf-4184-93ac-ecb672edfa2e", "comment": "Malware payload (Mirai)", "value": "8838450040224e8df67c972c8acf638334f952faaae998ea2a733f0702b9e02dd484e9ad3a12917840715868696ddc9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144224, "uuid": "66984240-a807-4d60-a6c1-9325d1158910", "value": "T1EF730985FC818E11C9C91376BA2E118E33036369F2DEB367DE116F10778A92F0A7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144224, "uuid": "c7a16264-89fe-471e-9b51-1178767c832c", "value": "1536:LonSxRq3iPQRmtv9juMhCkmLI58Xwz1IUiRtFnAyLFp:FxUYQRC1jdOcAFnAyLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144224, "uuid": "162e5527-17c6-4723-b45a-cde7068e8361", "value": 75252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144224, "uuid": "847229b9-ce8b-43e3-9826-9d1543f2c594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144224, "uuid": "106ff8c2-4b8d-4979-863b-0aa05c5b5175", "value": "mao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb3e28f-0117-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770133425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133425, "uuid": "9f719b7a-243f-496c-97e8-6647394e0e02", "comment": "Malware payload", "value": "cb2e069e1a755acb1cf27ed78e029c3f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133425, "uuid": "c9933e94-db2b-4fa7-9342-930f5d338450", "comment": "Malware payload", "value": "65ee2ef8073cd071cba79b4b2fa72a94b2912ab692360eabf32e6e4e9e2165b8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133425, "uuid": "4186c916-ff85-456f-bdbe-f5a0a3786d53", "comment": "Malware payload", "value": "becc805bfef5793167787beb23f54d8139f4fb64", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133425, "uuid": "d038a9bd-8ed0-4c3f-a536-354cdf08e92a", "comment": "Malware payload", "value": "49bfa3eb1d99bf623fee1bdda4cf4f187a20fd25891cbfadd94512480bfd1eb45620184f367f09ea2fe816ce0536ab68", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133425, "uuid": "b1dcb041-adb9-45d8-bdc0-221a4c4ce00e", "value": "T1C1F502C4C8432870AB3D5811CA6F962D201F70B356266E286E59B2F87D9D4F7CDA52FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133425, "uuid": "8489fdeb-e8a5-4769-a155-580d8c818fdb", "value": "49152:kkBWscrzrUhMf2FVLdNXQg0dIAp2VNv6Yr0G6ioFiMBpdY2NXLeAB3y1wzhtgKNH:kkB16PG6nkM9Y2BeANKQVNRo+yW+EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133425, "uuid": "77f97147-4296-47d0-b102-8c1e21fec4b7", "value": 3566648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133425, "uuid": "d0c9bb9d-fe49-4e36-88a8-3a3b7ab4d117", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133425, "uuid": "c94a1a66-aef6-427b-9de0-8888ab48eb94", "value": "Invoice.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d0bb76-011a-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770135015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135015, "uuid": "afd4c47c-f7b6-40b8-8617-0c0b5ebc49a6", "comment": "Malware payload (ValleyRAT)", "value": "c635acc81450b3c47bae36ec02762a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135015, "uuid": "ba0c80a8-e3df-4e8e-abaa-9cb2b51dd0ca", "comment": "Malware payload (ValleyRAT)", "value": "6600e79da01251789f8cfd6599d9f22edf1a6c4e3e8fb8a4123757bdcc26de57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135015, "uuid": "13351893-fc18-45dc-a8fa-703cce29dc58", "comment": "Malware payload (ValleyRAT)", "value": "afde7e557e21ee0c85613d6a9b85f760920fd135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135015, "uuid": "b095d7af-86b6-473f-9061-7f858cbc3ae1", "comment": "Malware payload (ValleyRAT)", "value": "ba98b8dc35d674c73f2d9485d14d0d5b2631cca6aa8a1bee9bc186245aa254d92839598f1e37ce25b2488d6f57dcaeed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135015, "uuid": "d34c6503-5afb-47a1-943b-c69c32a2403e", "value": "T12FB56EDAA70D41E5CDDB32B8DB564A73AA84A924077486CFFBAEC91FF00F81540F1916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135015, "uuid": "a201fd8a-4504-46e7-8d7d-84ad75bc779d", "value": "58df836f6788615dd5d90fd175be31c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135015, "uuid": "4edf996e-a550-431b-b423-bcda640e6db8", "value": "24576:1yIaYPJBicbZabh2bXHrJdJ677eTxywgy:oIaYP7L9z6neTxywz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770135015, "uuid": "ab6c1de5-ed9c-4e66-b057-97f09f0492b1", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770135015, "uuid": "ef5097a7-4175-4c76-b84e-b3039f6c9b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135015, "uuid": "8148c031-18ad-4ee0-a9f9-09ee792dc694", "value": "e57e1361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d27aba-00c4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770098082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098082, "uuid": "bdfd00b0-a991-4aae-8484-c3cc20aa9e2b", "comment": "Malware payload", "value": "a379c42c3d7dc5ea8779ff863bc2f0ce", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098082, "uuid": "6e56c365-d6b5-4014-ac91-1d227a1740b6", "comment": "Malware payload", "value": "6651210296c02f468f0fecdadcaa06824f9222f0bfd794b78653ff298a84ad34", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098082, "uuid": "7d7694cf-1a27-432b-bd11-195a6474bb24", "comment": "Malware payload", "value": "8f6cada8b62984d73f0cb0dd7f5babf69764680f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098082, "uuid": "4af6b86f-ca7d-48f3-beff-9afe724aea43", "comment": "Malware payload", "value": "4711ddc2bfb881ce5d780f4d6317e9b704764dcc916eb70a1abeaa820ab08161ae4920270dad1ec8b3619962f9281130", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098082, "uuid": "60ec24f9-5e45-4c3a-a3d0-f0ff6699344d", "value": "T1A4D59D11B697C136C97E45711A79EB2A10BE7FA51F7448EB27E85A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098082, "uuid": "3c1bb1c9-cd04-48ad-9308-201d39c5ffd6", "value": "49152:knoYS9MftgkfA7VqVZ9Rw4YP/BD/vTCPduTRUhfwE3B6zDojOwfFlApqLOSGRevT:XYIwABqNPdFBqwUpqLNTz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770098082, "uuid": "1e4033d0-0513-4993-a424-5412d17cd0ca", "value": 2885632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770098082, "uuid": "d1af1c53-ebcf-47d5-bdec-95004b24d32e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098082, "uuid": "04b6b44f-2acb-4e24-8492-081f129a52e4", "value": "372643341.fpx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c823faf7-0110-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130701, "uuid": "83c7ea4d-4594-4335-ba81-be5ba997de20", "comment": "Malware payload", "value": "290e68ee95d6dc63ae074c506abe1213", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130701, "uuid": "54717dcc-caef-4b33-8d52-3f25c5893220", "comment": "Malware payload", "value": "668870d4b49087af6c9b8ab3efbec03f69d538e716c833a17201607aad7ddf40", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130701, "uuid": "5392e098-195a-4c74-829e-353688dc7b2f", "comment": "Malware payload", "value": "a0dc49ee635c950c78bf3767a783f6678a31fa74", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130701, "uuid": "9a54f9f0-354a-4134-8e75-65901b482e10", "comment": "Malware payload", "value": "aaf7577ba1123cedf748d617d66ba0f49b8cca56d0fd47d28f1f6df548de1f51720a199e08fbae97629bc2578383af13", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130701, "uuid": "761d7f6a-a276-4626-a17b-b7fb51b98af4", "value": "T1EFE63395B9E90187E07FB6FC4EB8E677A244D1AC2F1F419200E4F75D3A5EF802970A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130701, "uuid": "825e1edb-dfc8-4756-bd37-a771d2d8348b", "value": "393216:IJE46gLp+gGisJXejOgCpKzQEDvA6oQ+Rx5DEH4hjdR:0E46FgMlej9CpcQEjA6n+EHIj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130701, "uuid": "f89ecd38-17dd-462a-a4f6-c80b2558d5c7", "value": 15070262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130701, "uuid": "806aaa49-ceed-4736-a197-7345e1a2728d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130701, "uuid": "aaa0cd66-16af-43ad-96da-39d6104360e3", "value": "\ud835\ude82\ud835\ude8e\ud835\ude9d\ud835\ude9e\ud835\ude99__\ud835\ude77\ud835\ude8e\ud835\ude9b\ud835\ude8e#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffedfc84-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128647, "uuid": "db269fe0-f9cd-4895-8d7e-3a7d21fedd08", "comment": "Malware payload (CoinMiner)", "value": "ec0aea5d69fe043faa0ae967fa236a1d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128647, "uuid": "8a066815-a0ca-4718-9495-39c23d9c2cdd", "comment": "Malware payload (CoinMiner)", "value": "66e4cdaf05819c01d405a2e8b346ec7faa8cdf5ef361992775a46491ad2b53a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128647, "uuid": "f947b23e-60c9-42ce-ab14-f0f7314f2774", "comment": "Malware payload (CoinMiner)", "value": "dc6d8f8e5d9f576def40f3277c1f9404fdffda8c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128647, "uuid": "16933588-da9a-4aa3-a6a0-087c2303fb41", "comment": "Malware payload (CoinMiner)", "value": "17e5ad8e300733613de2c750d33a98ed8f22d26f40c6ec75c04ca43fd74dece3ae89c558aea3422194ace2d8befd03bb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128647, "uuid": "ce043d51-042e-4aa9-ab9b-285a68f8e34c", "value": "T1807623BE354C33A8C01ECB395523AD09E1BB512D5DF8D5BA32CBB780776B411D90AB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128647, "uuid": "0c7715da-6756-4330-8d62-4bc4d845c670", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128647, "uuid": "4ee06444-2000-42e4-8c74-9554df7fea9e", "value": "196608:LNcyYmZ+x/NtVjV3ET2HnTPOR0AoYjzFg1ZLbtn3d:RcyG/fVFlHyR0xvfx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128647, "uuid": "6849c0cf-ade8-401b-a278-e85e6b7f03e5", "value": 7755264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128647, "uuid": "5fd921b8-af9f-415a-9973-897c25cc2ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128647, "uuid": "9165af87-f87b-4889-ac9f-f5b7276fd610", "value": "SecuriteInfo.com.Win64.Evo-gen.27964224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f8297-009a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770079765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079765, "uuid": "aa461a2f-6e67-4aa9-8d63-1299b1c6124d", "comment": "Malware payload (Mirai)", "value": "93f2d0450f1f9eb144f01fba7e758feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079765, "uuid": "7e64fcad-8f56-4a74-8e62-d9326f6f57c0", "comment": "Malware payload (Mirai)", "value": "66f72cbb5e897cf599c06737d13284a0f73c76eba35370e1f48c4702893eab3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079765, "uuid": "b35460c5-601c-441d-a472-f8866a2e73b6", "comment": "Malware payload (Mirai)", "value": "016c04652a38ff9e434188a3d21784b4e719b638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079765, "uuid": "be5b0a34-08a5-4b22-b3d0-38e1697430ca", "comment": "Malware payload (Mirai)", "value": "ddf78f7d9fbafaf7b2b0be16c1f821b3dda34dca3623069cdfbaa32145b09c703cfb453e6d377e69806da9b1a837a294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079765, "uuid": "80b0f4ea-e798-4a37-9c85-fc801e5b2428", "value": "T120C2E1928F8ABE73FC5BA5F1E190130121FC26DC7C6E22462AF57A6077E18C2EC451D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079765, "uuid": "79e024cd-0cda-4f52-8bb3-806ac44489fa", "value": "384:LSm7f4/saazgem15nM+0xhqNDDtJU0nmmQVkKxNQvD1+X32Z2NwZ/gcVt9yAa:1Vg515nM+mmJU4HQVkwNQ02Wrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770079765, "uuid": "e448f0a2-2c81-4cd8-bab9-75b34b9c4294", "value": 26017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770079765, "uuid": "719a92f5-8445-4972-9fa3-a8529f6df382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079765, "uuid": "a41c882c-589b-4dfe-8534-34b74486630c", "value": "xans.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f736a397-0097-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770078811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078811, "uuid": "f1c110d5-1f99-4311-a76b-915ee4044c2d", "comment": "Malware payload (Mirai)", "value": "d5710d71d0ca614ef502228074e8d830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078811, "uuid": "ffeb3b67-911c-4f28-8631-ac893eb29ae5", "comment": "Malware payload (Mirai)", "value": "6799b0003e82bd78691083c0c921223031d22587e48b568baadb0c2fdc26a3b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078811, "uuid": "46577236-cc78-4fe4-b1dc-44e8b5247098", "comment": "Malware payload (Mirai)", "value": "20f831aee2ec003f3d1c904b6cb6e51253d0af58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078811, "uuid": "085befc7-65f7-45f8-a2fb-1cf221fc3d16", "comment": "Malware payload (Mirai)", "value": "bd3b94e3a6a677b9fe27bd2253cd3aedcf2a47eff9785548715552bf7fe5929ab8ffd173c1929e88a15fb1089f853c14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078811, "uuid": "55e2c0c0-16ee-4b49-a0ca-679f2ee1cb6b", "value": "T13A042946BC918E12C6D523BBFB5E41CD371A23A8D2EA3203DD156F2437CA95A0E7B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078811, "uuid": "7b9bbebd-0a4d-4f20-8d9c-4d500ddb40c1", "value": "3072:2QNfgk5FOB8MNWq4p+aUJ3BMBn4p+aIHJxv31n7D4wbZnB1:2QNfg7ntzd2Bn4psHJxN7MwRB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770078811, "uuid": "5d331283-da91-4339-b9f5-0ee3a4dedd85", "value": 177536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770078811, "uuid": "f5504326-5067-47dd-9fe0-2a2cd330241c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078811, "uuid": "c1438266-a070-4159-be5f-556bd133924e", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164cb2cc-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128685, "uuid": "e12bbad5-8ceb-4e23-b750-c6537d31aa5c", "comment": "Malware payload", "value": "4bc610c612f0d3b629dfb9cfc6c2e504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128685, "uuid": "12f20097-47c0-4ea2-8178-584cb427e996", "comment": "Malware payload", "value": "67ab2b3f9260d334df0dc66c824d512db92f55bfe1a3d19e930a1062ebadfa50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128685, "uuid": "7934c7df-f86f-41cc-a913-26e1be916603", "comment": "Malware payload", "value": "a7882e79bb0119d5a51da324ffef3c60163cffbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128685, "uuid": "fbff8712-a663-41ad-868a-dcdd5dfe7b9b", "comment": "Malware payload", "value": "2003b49e64533ec81f9df5cc4f3579061c50b7e038164126d771c345daee3f2d90817af4fe5f877f1278889409a53315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128685, "uuid": "9718a6ed-103a-4bb1-b30d-09b811ca9012", "value": "T19E76239A644D23ACD02EC3349533BC09F27A501D1BE9D52B72CBEFA07366871DA46F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128685, "uuid": "bb775398-fa15-446b-8e47-5ea9bae0e629", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128685, "uuid": "c398bbba-3acc-4392-819a-ecf395285448", "value": "196608:dLlYzm4542KBfg9TWrTOPlgQLmy9QbBJi70XR7UQ4dH:dh+mR31YPiQKy9Q1zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128685, "uuid": "8d1292de-d5b8-4b02-ab90-fd8f1ae34e60", "value": 7751168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128685, "uuid": "9c6c66eb-9f5e-429b-ba76-4db94823924a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128685, "uuid": "4aa839f8-fa98-4e85-9231-1cf9f92e3a1b", "value": "SecuriteInfo.com.Win64.Evo-gen.45979335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f90921-010d-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770129226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129226, "uuid": "45b89812-8d80-4582-8389-b4d374c6d53a", "comment": "Malware payload (Formbook)", "value": "fa790669a2aaab8ebf1b9b8462e1655d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129226, "uuid": "9b7e231d-d9c7-4e54-8755-c374c33106b5", "comment": "Malware payload (Formbook)", "value": "680a803030b7631f1a8bef5628a7819563c04b98b644ea603aa1b6a2bf21234b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129226, "uuid": "6077891b-9da8-4afd-9442-e0077625437e", "comment": "Malware payload (Formbook)", "value": "115578bdcce6c510e0c94d86809e32965a262dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129226, "uuid": "418e5f17-0f6a-4ead-be2a-2ced65799f84", "comment": "Malware payload (Formbook)", "value": "b45a33f5d94bba415005e70c93ecee833a49b94a3756f66ddb0a19a7510e77383fbef876d4a53651a28807f09513ff4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129226, "uuid": "c5f709eb-ea11-4c81-b03f-e3e00bcce9c1", "value": "T1202686A45DA06B11E6D683DAB05AB5C0FD2E3C2378D9CFC8B77FD49424E5C20EE05A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129226, "uuid": "660194d5-af57-40a4-9c20-b29594bf056f", "value": "24576:15DnyOOCzV7Iplm0lzgLw9Nr25i4+e5yWJm3OyZzBuxD:ZzV7Iplm0lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770129226, "uuid": "58171493-57cc-4ea4-affb-ee2be1325969", "value": 4642836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770129226, "uuid": "adf30b08-6b04-4849-bf53-1742960d4278", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129226, "uuid": "3d4f68ff-4ccd-432f-83b8-6a963319f36a", "value": "Vancou.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cc1eec-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136811, "uuid": "b11fcb72-2dba-412f-bc51-e02789951e2e", "comment": "Malware payload (Mirai)", "value": "2b4c59f058b42f1c84ebd372b990c903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136811, "uuid": "4ffdc3be-37a7-4289-9344-03609e69cfad", "comment": "Malware payload (Mirai)", "value": "681c788f1f1c6beb7f7ef7dce47c3971dbb506c5ce58a0caedbb7999efb9bd66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136811, "uuid": "0b62b9ba-03d8-4547-a157-6e15f4a5037f", "comment": "Malware payload (Mirai)", "value": "bcffed04338e4281df9a5c41641840d60445ac1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136811, "uuid": "aecae95e-8648-4eaf-a1b3-ce943eb3fe10", "comment": "Malware payload (Mirai)", "value": "9681517af06e4eb7bc311bf14f69fd90a893cf67212d86ec6da2510360ec314f907b2171200ef16a190639058029966d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136811, "uuid": "d4bf72e2-8e82-477a-9cb8-ffd3b72bd0a8", "value": "T10943F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136811, "uuid": "cad0905f-e81d-439b-8d18-9f419b71992f", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136811, "uuid": "772f802b-0abf-4ece-813c-2b4433c13e42", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136811, "uuid": "263045e0-b2b1-4a02-95d0-eefd2499d0d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136811, "uuid": "ad9b69b0-ace8-49df-99bb-dd41b76859c7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27494ca-0126-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770140167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140167, "uuid": "ff0ddb99-1972-4dff-a21f-2f0dc6520709", "comment": "Malware payload", "value": "f4406cd10aa719b452370feaa6a77688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140167, "uuid": "4dc3d6dd-7be1-40c8-b5de-96d97b7ce068", "comment": "Malware payload", "value": "682cf5e0f3142d3c993780f5cb50c313b4b353021e5f9eeaf43d97b77120d476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140167, "uuid": "3e89d446-52c5-46b3-a856-bdd2d600a5d9", "comment": "Malware payload", "value": "02781d646115cea395a34fe7f8431024b7716192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140167, "uuid": "a05d5ce1-749c-4add-9e98-c1c042b56bd1", "comment": "Malware payload", "value": "d03c0ac3a588d7d66c219e903c886f7af79f7b7fbdc1396a7066a25e0d6424139c49e7fc03fe9dba6f13956db8855663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140167, "uuid": "e348fcd8-6d29-4208-8f75-55551e017bde", "value": "T1D4B63313D57BCCF4CB234678D6E10A46BB4A018A9C5AB8D4E584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140167, "uuid": "7820eceb-fb84-402f-b057-cab191c184b7", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140167, "uuid": "87629d7d-162c-4faa-bc86-51e5de0c672e", "value": "196608:/aZk+wF0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8p:3nF04RT9R4PkE7Ap84p29qIT0Z6rXr8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140167, "uuid": "f54db398-c438-44a1-b33c-fe0ca5fc61f4", "value": 11055720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140167, "uuid": "7c9e14f7-70b2-4b53-925f-43f2e6bf7dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140167, "uuid": "972d0474-2424-40a5-9dd3-d26c925dd518", "value": "RSVP_ECARD_INVITATION_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69264003-0113-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131830, "uuid": "28bf67db-6817-43dd-91a8-6f03cabc674c", "comment": "Malware payload", "value": "10c621072b59ffed6c9b405c6b15823c", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131830, "uuid": "45b84218-427f-4af0-93c8-3252385f240b", "comment": "Malware payload", "value": "689be8e10a1e850a62de80bf6c2038c1de09d41bb14a2e1a299b1a0d47e88900", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131830, "uuid": "31379e9c-39a0-46dc-af4d-4ecaa5bda7d1", "comment": "Malware payload", "value": "1547ee301eb803254a215f6755375642944ce9af", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131830, "uuid": "849e103d-1861-4c76-90e1-1cec7508f9d7", "comment": "Malware payload", "value": "f710d281af3b616e1145b133f3baca824e8fad6753bcc33d2b0389d2d7d258b8824defc17595b3108b652a5c2fe82eea", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131830, "uuid": "faff6873-b367-4c58-ab0a-198b0103d052", "value": "T18C66E021F5568076E9A70230055C72B751ACAB301B3093CF67D81EAEAFB46C2DEB5793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131830, "uuid": "c3c85f23-1aa1-4e22-9a2f-45959584e210", "value": "196608:V6w2u45UNSwvz1JEaVFFk1TPV6az4DwY9Pwk4stI:V6w2cNB1JXFQTtttY9PwkJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131830, "uuid": "fe94dbba-1b9f-48e6-a943-29bd30ee85c4", "value": 6823453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131830, "uuid": "e0d7200b-d46d-41bb-bd76-29b6fe59bf0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131830, "uuid": "5f88abc4-619e-4904-ab34-418e2dfaee56", "value": "Package.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a477c78-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143509, "uuid": "4d40e6f2-ab99-43cd-a797-11e0b881fb0a", "comment": "Malware payload", "value": "9dc4803f42b4007726faa2023efb3163", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143509, "uuid": "dbbc9d9a-5f10-4c3b-a470-1d3b306d7ba6", "comment": "Malware payload", "value": "68e3594b43bbde6e828727df2f6644d47efb75540c41e5644a73015a1d75f6d0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143509, "uuid": "2d72ed63-3a75-4b77-a5bb-53e15903b69f", "comment": "Malware payload", "value": "b691ac1cdbe18df6eb8d0968ee71486738372356", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143509, "uuid": "9c7afd01-c367-4cea-9804-357ad13c95f5", "comment": "Malware payload", "value": "05382fbad98cfad15bcfbc32939957d707dcc635d0617089ff664b8fc395f1dead15109b3b66ce9e31a5aae4edfb2ca5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143509, "uuid": "cad4ef7e-e051-43b9-b1f4-f23ff35af7ab", "value": "T1CCF0825FF308C9FAE93A058E3A983DCC61AE526CCE6E1A151E341E56A48585C64C1037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143509, "uuid": "e8581e00-1caf-4f9e-84df-6f14d6324976", "value": "12:4AeVMI8b8zuXMuDuGutjAYbDy4gQesFrFBEGgcu+yfuT+JF8EpASLye:EVoQyXliTiSBRrTBEG6TuyLpvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143509, "uuid": "ec5550e7-9b4a-40a8-b954-3ebe2edcb932", "value": 470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143509, "uuid": "54ff152d-5335-4d12-8b51-4107b98d4f56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143509, "uuid": "6de5c56f-3e41-4920-bee0-f3d0e7e4bca3", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a448f95-00ab-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1770087057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087057, "uuid": "1384b5f7-4015-4c8f-8f51-ba676b584fec", "comment": "Malware payload (Amadey)", "value": "71ef09a49e261a2b513baee7eedecd30", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087057, "uuid": "930d78cd-ca9d-40ed-94de-7df758203da2", "comment": "Malware payload (Amadey)", "value": "6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087057, "uuid": "c7fe6847-bd5d-466c-a5ee-d2df7ec5e87b", "comment": "Malware payload (Amadey)", "value": "edcda622671c521295846f604f9cba0063d14df2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087057, "uuid": "7edddab6-43ed-4e75-a18d-431791ce6f0a", "comment": "Malware payload (Amadey)", "value": "269963e34e71dd658d90aaeca22c977344021a1407f4de833fa60bcf6849b727cbe6c0ad3135c8b03f08ffc6f45b5d16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087057, "uuid": "d3ed0d96-219b-4580-a8c0-3c502901473a", "value": "T17D662312BA838135D99A2E30343D86B5963EFF349F34B5DFEB84351D5E302D06A71A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087057, "uuid": "6493fa58-524e-4f4e-88a5-82da6704f3e1", "value": "98304:n+UJgsMOyVEUMo7Pcwq0kiOBOLT5lNUxh5Hup4SLQPLpGKWT4UX2Zo9HPD+PEJ8L:+4gtOyfPJe4LxUxCAFvtsHPr8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087057, "uuid": "348ea478-8375-443d-8b26-b82255874240", "value": 6733824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087057, "uuid": "8f3c7af3-9986-428a-acf1-0a1c9aacbba1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087057, "uuid": "b1dab44e-a050-44be-a312-3ecda9212234", "value": "action1_agent(My_Organization).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b162db1f-009b-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770080412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770080412, "uuid": "ccad4660-2cff-4171-b287-fb6c2043529b", "comment": "Malware payload (ValleyRAT)", "value": "662b5ce37b3e1f271dc24973a0c4fc4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770080412, "uuid": "e64d5a6d-34f9-4a07-bece-33bbe649ca4b", "comment": "Malware payload (ValleyRAT)", "value": "6a25cf8ca25379e296985987ab0836301ee6e255868ef013276ba8e360cceb33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770080412, "uuid": "14c4c70b-17e9-485b-a207-71c3fa372cb2", "comment": "Malware payload (ValleyRAT)", "value": "2d3769a8db9e187765c690c6070c9a37343f31e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770080412, "uuid": "5099f335-42fc-4596-80b0-b395b4ef4a57", "comment": "Malware payload (ValleyRAT)", "value": "d1e15036ca12aa1c6eb3f7b8cda8598e1b9449ce50ac99536f3350f86a2b7693d645d299bc1a4fa12f72c2081beaac61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770080412, "uuid": "22c86c32-3b13-44cd-b736-4b202d837208", "value": "T1A4757D06B6A814F5E1B38379C8A38A46E6757C469360E3CF1399165B2F376D08E3F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770080412, "uuid": "b17aad17-0ef6-4d1d-b9a1-b877d545e4b1", "value": "487c7f5429c773e1f4085ee06226b9a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770080412, "uuid": "f4bc5bc9-26a6-4a7d-b5dd-8a0d189ece88", "value": "24576:cIl7OVj8lbr2dqo/SisiLUl9yUX2nUvNX4:91yjOmzsP2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770080412, "uuid": "1e841d63-8700-47a7-b034-ec8cc6e70448", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770080412, "uuid": "92c9839c-ab15-4e6b-8678-5ebfce6d09bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770080412, "uuid": "e96c17c3-4f23-4cc3-83d3-cae65cbc5a99", "value": "E-Invoice.rar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5930e55-0100-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770123825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123825, "uuid": "9e2ceb44-32c4-42df-bfb2-8341fe31c746", "comment": "Malware payload (AgentTesla)", "value": "186c0eadbca8bd5e34a5611a8ea05835", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123825, "uuid": "4ca2ca09-5e97-4bf7-a0b8-ab2b01e8abb8", "comment": "Malware payload (AgentTesla)", "value": "6a25f522e77861d5b056f546af23b90ceb4035daf9071509e7b8eb11b3c58097", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123825, "uuid": "559c252a-7ba3-45fe-93f1-e0de6151e445", "comment": "Malware payload (AgentTesla)", "value": "bc3296e82e4e38c5979895dfa8918b75b8d1b1e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123825, "uuid": "30c26896-4337-4b7f-93ee-0c4662c808e7", "comment": "Malware payload (AgentTesla)", "value": "cc733f05ddf7efd97f0ac7aeeb20b894be7323d7ee7d6a64ec8d102a226bfd6e098ee6d81986213c29304c1ca6b67e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123825, "uuid": "fdded8e6-8c13-4167-a565-8c254d94b029", "value": "T1B245553BE518DFF4CB2E21F4109B3D0160A4AB56753689BDB89EC1587F267408FA64EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123825, "uuid": "ca58eac0-8bb1-4bdf-8878-4b5732d65c3c", "value": "384:a81FWdRs4Gs8hlJcAPhrObmsKg/1h9xuBoCHiQJPxj+mH:/TWc4FiMTa+jCRdVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123825, "uuid": "5c7f0c43-3436-488e-9fca-ac056a9b5f58", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123825, "uuid": "95c22e56-010f-4474-9bd3-21d741bbce84", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123825, "uuid": "083d766c-0227-4f81-b66c-d5299305bbe1", "value": "Booking_580_322.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b377f35-00fc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770121928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121928, "uuid": "5038d288-0e20-4041-a35f-248c283d81ac", "comment": "Malware payload (Mirai)", "value": "7275724684ad715f2fdf1f4184be233f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121928, "uuid": "352f5301-6f4c-4d19-846d-be9f97eeb719", "comment": "Malware payload (Mirai)", "value": "6b0db4e232c1e07659f209a1609c8110ce9ccd554c5fed6500abbd16655e735b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121928, "uuid": "55c39be3-4329-4d9a-aae9-e466ae18a94d", "comment": "Malware payload (Mirai)", "value": "c7d42f1812148cd70979a0f2ad73bb4de0baad81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121928, "uuid": "5e76fc6a-f00e-450b-b1d6-191648b4d1c6", "comment": "Malware payload (Mirai)", "value": "e39c9c4bca4d8db6d3ffbc1143504213a1f3269bbee7a51423808abaaf4fe9670bbc7d21240f02bcbc01322ad4c51f5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121928, "uuid": "28219c7e-b872-42cd-9ebb-2a230e959b2d", "value": "T17F33E795BCD1DA1ACAD0137BFE0E428D372A6798E2DE3213DD252F5037CA52F096B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121928, "uuid": "fb0366d1-3d4f-4e5c-9a65-bbe79c063a3f", "value": "1536:pbJBzPSFXn2rHPsLP/b1cJlvFNXjJEjJJ6:pJwF38HP41cJnk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121928, "uuid": "8d7fd4d8-cf73-465d-a39e-64f2118b381a", "value": 51569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121928, "uuid": "3160d8e5-1f16-4126-af52-19aecf604872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121928, "uuid": "cba34f33-27ec-49d7-800d-dca18820f909", "value": "Hilix.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174a23bb-011c-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770135558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135558, "uuid": "441900af-f256-4e03-8708-2a5124729c3b", "comment": "Malware payload (DarkTortilla)", "value": "b2269124e8874b203e340722e60e6ec7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135558, "uuid": "0c6cc925-bf7a-47d9-bf40-212a2231fc97", "comment": "Malware payload (DarkTortilla)", "value": "6bb2a5678ada801137ea6f5f6b032ca4154de5df7d8f240ee4d7ed2febe5ddcd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135558, "uuid": "2dffe241-1180-4902-8a1d-134e42ce9188", "comment": "Malware payload (DarkTortilla)", "value": "daf7a7cd64d1b92c2aa62ad2c15be247f964ca53", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135558, "uuid": "14d7c69d-914e-4895-a8e1-b39b698711fb", "comment": "Malware payload (DarkTortilla)", "value": "200306daeb213df3513d568410caacf211f817acfc18c7bd923504e01b957b92b4267280a425444397cb5ab713b270b2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135558, "uuid": "f0384ee3-896e-461e-867c-54aa53d6c2f0", "value": "T1F3F4BE1553E86B68F9BF9B3C5779001447F1F816CB36EA2E798980DD1822F83D9A1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135558, "uuid": "acd0a1db-02ff-4692-aac5-68117db526a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135558, "uuid": "52b4b4cd-59ad-46f8-a255-7d9424023de0", "value": "12288:IFoHzjsmOpdnleO5RrGpv/ffL6cEwT8UT6JoexMIdBHgNWa:IFo3st1d5R43L6c/rHYHfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770135558, "uuid": "4568812f-d706-4368-8cb2-f81ab9b5247c", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770135558, "uuid": "9b2770d6-e4d8-4514-9046-2dbc7f2efe49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135558, "uuid": "598231b5-8017-4189-a2bc-ef73073b3cc4", "value": "6bb2a5678ada801137ea6f5f6b032ca4154de5df7d8f240ee4d7ed2febe5ddcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7618abaf-013c-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770149461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149461, "uuid": "ba4aae1f-1c53-4518-8fff-fe224c1a2a4a", "comment": "Malware payload (RemcosRAT)", "value": "ff22092ff3b293cc3cfab42962c9ff33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149461, "uuid": "0e2bab8d-a971-4919-9fa5-2a0658ed0cfa", "comment": "Malware payload (RemcosRAT)", "value": "6d39183d762f275fd57a809d1556a83cf3cf825485a5ea00bada4c39dfecb514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149461, "uuid": "3454d82f-9c63-4ed6-afd5-2731680ee427", "comment": "Malware payload (RemcosRAT)", "value": "f3bd7bddac3a3b6d3be6429181a6ec7dd84d20d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149461, "uuid": "5e25f38c-6d3c-4452-b4ef-ba23a4f14150", "comment": "Malware payload (RemcosRAT)", "value": "3b07409ae818f1f287866cf7194dbbe3910d1782e00d27e738521767ba674651730cc2e479c25d219994b4e9f65657ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149461, "uuid": "50ebcf1e-7396-4228-b2f1-5c2f3960d459", "value": "T18EB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149461, "uuid": "7de0b13b-deb1-422a-a5f8-733d2925e144", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149461, "uuid": "9f5ddcff-167b-4e90-86b7-558a95dcfa07", "value": "12288:y6pxxGI8gvGOHJpAbDYGxLhZ+sPZtpmPFNZ:y6pxxx8U+bDYGxLhZtZ6PF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149461, "uuid": "1290f935-f8c4-49d5-a1f2-420033a5799f", "value": 504636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149461, "uuid": "2239f254-dc12-453d-9a8a-318fd8ea80e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149461, "uuid": "11a7924f-2fef-4f34-80de-d2541e65afc5", "value": "6d39183d762f275fd57a809d1556a83cf3cf825485a5ea00bada4c39dfecb514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d6e59c-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101788, "uuid": "cd87036d-3ffd-43a0-afae-0642d96a9857", "comment": "Malware payload (Coper)", "value": "2041ab20010bf162bb5619cce06f324e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101788, "uuid": "0dce9914-ba2f-4245-9436-4082423036ae", "comment": "Malware payload (Coper)", "value": "6ec479136b4fb6809638e874d9d606f6d4b1f44a686f61954bb6883d548333fa", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101788, "uuid": "27f0319c-1ad5-4598-92e6-7304c8b9789f", "comment": "Malware payload (Coper)", "value": "2177f38ea94616dcfc8bba07f0652b33d45a2103", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101788, "uuid": "7b6923d6-5fdb-4390-95c4-f39bdc511b48", "comment": "Malware payload (Coper)", "value": "db279626534afad4050883bbc499c6a9bbdca7de11205817f2d95d324663176b00c9ee04d729340b84dc4af4493fbe39", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101788, "uuid": "cc3bc9cf-7a26-4236-a390-f4561373c346", "value": "T14F4512C4F699CA23E4EB2B344E6783A46A307D41DF1152177D8977AD0D723C4DE22A2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101788, "uuid": "b62e5deb-8f3b-454e-a4f6-9a1a80b87417", "value": "24576:kAnlNFgYUY+g+NtxxEMuyIURWNwLAV0QKPtycVS5kqZMMFrQmkvn5:kUNFgLY+jxxDvI6WeLAOPtyp+IM1mSn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101788, "uuid": "43a3db0b-5e43-40c5-bc7c-09dad0f4390e", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101788, "uuid": "f74fff60-db6c-4504-8a6a-e441c1aa949a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101788, "uuid": "2879a9ab-c2bb-41ac-a0bc-0ed493919f39", "value": "cc3fe1e_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ce722b-013b-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770149194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149194, "uuid": "16974caa-75b8-4e0a-8362-826ee0834be0", "comment": "Malware payload (ConnectWise)", "value": "bea27d2c038bc1f21a34d61ca1f15f39", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149194, "uuid": "684dc438-5ca9-4a9e-8f4a-aa6a7360aa87", "comment": "Malware payload (ConnectWise)", "value": "6f28d581df7fb9982c0df00c24734ce77f824e45b4356b443923706bf0157d45", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149194, "uuid": "3fa1b7c7-066b-4985-814b-1f8d5db6d438", "comment": "Malware payload (ConnectWise)", "value": "58f6178ea0da5ade81fbd81c84c00b53a39549a8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149194, "uuid": "fdba0d8a-fb26-4f30-9166-890f4e5000d3", "comment": "Malware payload (ConnectWise)", "value": "dc6f40f2a5c8528099213f01d6280d8a23eaba90f82c2e0343d3c4359509ba6af955468b47e5b3adcb3f986ea3d3e5af", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149194, "uuid": "72cde3c6-34c1-4565-9999-a7640bb9ea7e", "value": "T185A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149194, "uuid": "1b72d045-ee7e-4d7b-8a25-cf9441a99f30", "value": "196608:qKaLNkbg4i4QvKaLNkbgRKaLNkbglKaLNkbg:8Wg4iHHWg1WgZWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149194, "uuid": "58e0b903-902f-45e4-8ed3-175b82cdc11d", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149194, "uuid": "17958f26-1863-4c54-93d8-ef10eed0bc5c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149194, "uuid": "c0cace45-e4f3-46d0-afd9-6462e838dfa6", "value": "6f28d581df7fb9982c0df00c24734ce77f824e45b4356b443923706bf0157d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1f1ce1-00c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770099062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099062, "uuid": "08ef5601-4b2a-46ea-bac0-87eea2f27211", "comment": "Malware payload (Smoke Loader)", "value": "f6b9eefe4cb9b85a269155104063c583", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099062, "uuid": "2978331b-3047-4404-ad36-2ad5979e51f3", "comment": "Malware payload (Smoke Loader)", "value": "6f7e92f5a8ba51936e4427c7a31b6f38f431c1547fba55c78001fd88ef041a4f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099062, "uuid": "da050f50-0af6-4b35-ab16-4cd83799729a", "comment": "Malware payload (Smoke Loader)", "value": "ba6df01bde8bf6f597a370de880b8af4d6f186db", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099062, "uuid": "c4d84231-aba1-4604-a372-a844de1948d6", "comment": "Malware payload (Smoke Loader)", "value": "f36d084778fd4f782ae1224a749a1f3b910c73053c98e73eccb23d7998d2b3c5f8d556cc57bdcdd1b0c2dd98a24947fb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099062, "uuid": "61457ce5-54a7-4178-8605-fcb0f5f17b98", "value": "T10726F121396DB0F7F88D62B39144701A2AA8FEB58AC7047C689875990D37D933F1F16E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099062, "uuid": "8addb633-d45f-4b7d-9efc-ab7ec5a74ff9", "value": "64906e468e77ee6c0a5b5f7d1038d7af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099062, "uuid": "edb7b6da-f474-4cf9-915d-65d25af633e8", "value": "49152:IyZ8ImXjJxqznwfl/yUi/wjlGV2O2OL0jEV/JtMgkj/2PyxNmZASeiK4KVErDUud:eImXjDsEDi00/JtMRj/jftVErDU4rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770099062, "uuid": "fd0edb03-298c-426d-9709-48dd8fbac022", "value": 4830232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770099062, "uuid": "81b28dee-4789-4369-9938-f9d7f3dfbc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099062, "uuid": "d8f2397a-09c8-401b-b2a0-2126564339e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01014c46-00cc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770101161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101161, "uuid": "49a1918c-4eb6-4887-be5a-641600e4cefb", "comment": "Malware payload (Mirai)", "value": "4b7c0b2a64c3ba82ba5812212a41266f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101161, "uuid": "2d1628b5-0c88-4dbd-86b6-2e1e25d82ed3", "comment": "Malware payload (Mirai)", "value": "6fdc6ce2869152411d2627f85f98756ec7ed4594230191a489263b494ff66361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101161, "uuid": "bb69fc81-6e82-4bb7-977f-8fb856e93453", "comment": "Malware payload (Mirai)", "value": "f3663ae6a0dc6d1d7fc3fb9ce2b3ff6b6dedb19e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101161, "uuid": "3ad77372-ecc0-4fde-80cb-b96724efb49a", "comment": "Malware payload (Mirai)", "value": "eca3fe19dc44e44b421be370ff8774f4fc5a04927d1986edca78e82f345a07d66c2ccc3cd1a03d6e8ee9e470b45903f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101161, "uuid": "63bf8520-b60e-4027-a4b7-c2ac29daf376", "value": "T1B86302795B42B8D5F121B678154A57612D300EB7CAB0EC9A4BC6FB715AE30E2780BF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101161, "uuid": "2d916a18-15b0-4512-900b-12129f5e2581", "value": "1536:hjkZro6GXws6agG93O7UgywsFnp1hmf73Qh+q7T5lfeOZlyTKVqYJ:hoJo6DaN+byXFnnhIq7TXfRyeVqYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101161, "uuid": "a350ab19-7930-415a-aa0d-bcfbc8f34b8b", "value": 69200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101161, "uuid": "25bc162a-850e-4b42-95a6-e1135bc8d571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101161, "uuid": "e75746b0-1aaa-48ae-92e6-6ebdd3fe5abc", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446461f1-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139070, "uuid": "628e2630-8103-4620-a6ca-c9ecca11efaa", "comment": "Malware payload (Mirai)", "value": "8114f96f1dc35f0d0054c794f5277f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139070, "uuid": "80fbf0b9-0410-4c69-8f27-16b5082f7f77", "comment": "Malware payload (Mirai)", "value": "7022beefdfa3e9125bd1f12aaec1577d6076f2c0519a23551d13b14c4de47b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139070, "uuid": "397c18f1-ce27-4fbe-953d-ace4e4bb97f6", "comment": "Malware payload (Mirai)", "value": "34c933ba8770eb9c754fe27f966e6d21d55a22e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139070, "uuid": "33721d54-53d6-4f17-b936-6bd6f711c442", "comment": "Malware payload (Mirai)", "value": "45a41139f8a1f5a8cfb1fe5b8d078c201fed592f5b497ea9885df529caa5c058842022e5805023e3dde7529f0302c7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139070, "uuid": "9934b154-0ea4-4a9a-9400-015d071917d6", "value": "T14D43C64A2E318FEDF76C863487B74E31979923C622E1C684D16CF9011F7424EA45FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139070, "uuid": "4cda71be-48ee-459a-b814-05782728dde1", "value": "1536:F2125L5EuLgTsJN7TDWrBcUdgI89w7biHAna:kuLgTsJNgbiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139070, "uuid": "9b6b08b7-d480-4850-8c14-9049acff33a6", "value": 55428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139070, "uuid": "ef409ac1-240a-4839-bd6d-6a9f1e8081cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139070, "uuid": "f73cf4df-6a48-4e0b-9a8e-4f530952a68a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045a6d5b-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136815, "uuid": "c0609e76-9db6-4a4c-a159-72017600f77a", "comment": "Malware payload (Mirai)", "value": "a41c6f31f99c8012bf364d002c4162a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136815, "uuid": "25c1f9be-ea0b-4944-af3a-48cb0eafcb51", "comment": "Malware payload (Mirai)", "value": "703e6648cdd35350068ce9c678bb5d9475aa9f6acfa3bac952ae22d233ad5817", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136815, "uuid": "d9786fb2-7e9b-4be2-aec7-c51a117ff26a", "comment": "Malware payload (Mirai)", "value": "abdd7ddc02d45b84e96fad643678c7a38653ff31", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136815, "uuid": "bed61507-bec1-45d7-a8d9-9dde7d4bd8db", "comment": "Malware payload (Mirai)", "value": "0d415babcd1384049c906f6d5cd4235a205ce2b9f14027a478ecadc044bc99120c6f759210be9e5753d222b97524ce13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136815, "uuid": "687b1817-b422-4078-bc2a-ca7a8a8582d8", "value": "T122518CC972204BB4BFB159D2B6F5801570C9E0D1AAC74EC9E2FC64FE014CF097C916A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136815, "uuid": "f19e55a9-ea2a-46ac-b6a1-9742dc966236", "value": "48:vzyuaz3Uaz58azHwazBwazdudzEazoCazR8azKuazLMazH+az7x7UfazAuazjWd:vzyuaz3Uaz58azHwazBwazM9EazoCazq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136815, "uuid": "3fcab690-3aaf-4848-8188-10e4c9beb34b", "value": 2807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136815, "uuid": "df7bbcb8-a09e-45f5-9507-5622dfbb4829", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136815, "uuid": "9a217cce-318f-4358-90eb-3f139a8c1b25", "value": "aws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f029cf8-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101748, "uuid": "3c5bb764-d7bc-44e2-b8b8-98d8df84c532", "comment": "Malware payload (Coper)", "value": "f0bb09a2b9a9269e6322f392bf5d086e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101748, "uuid": "9a793fe4-8023-4528-b9e0-5f6c2f043835", "comment": "Malware payload (Coper)", "value": "7063baf053aa3faf308f1b3205dcb7495f74a1621d472b151ecc4f5fadccd369", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101748, "uuid": "63c79e54-39dc-4cdb-b427-7ff3c2c58531", "comment": "Malware payload (Coper)", "value": "43b9a633bc89b8b89e2d759486c57cd70b875458", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101748, "uuid": "1bfca108-1513-4a09-b0b2-dab444257d51", "comment": "Malware payload (Coper)", "value": "502555771105398cf2b86a5c92876b32836c1b5e31da66d2e60edb31c27eefa9332b4961e590ae790cbb1ff130e5df56", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101748, "uuid": "54cff4a4-e8c3-471d-9fea-e93a2253cc43", "value": "T1CD451252F3CDCA13E8AF6678485A81A467247F94EF15479F3682732C1CB23958F23E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101748, "uuid": "694ccf06-4274-412c-bee1-86314dd39467", "value": "24576:OdJedaY1suqafBMOYhTxBiynaXIo26jvxkPVEZ7qEK2BTnZrSh8qY:OdJedaY1suqafz664+vxki7qEK27rA8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101748, "uuid": "58d26c26-9841-4783-a2e1-f20e04d9d3ce", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101748, "uuid": "304a7e98-b053-4466-861d-ca8f2d637da8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101748, "uuid": "e762af2a-bbfd-47f5-abb6-c4d5ceaf9ec5", "value": "27d858c_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9250d42-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134165, "uuid": "8db64d49-edcb-4977-848c-557952fb9ce6", "comment": "Malware payload", "value": "8628746e06b09268f6e6f9e985a44eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134165, "uuid": "855ecde4-3d1a-459d-86c6-eb5a2419b958", "comment": "Malware payload", "value": "71326f93aebd14d337244f84530dbb29ffc0fcce9f57ab41a2ecfd4f719c2dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134165, "uuid": "9c4af0b8-3409-4a3b-9330-af6186528ba8", "comment": "Malware payload", "value": "ce16d93472dbd215e122d472302912a332080d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134165, "uuid": "23744484-30c5-4ecd-a0ce-9578f847beec", "comment": "Malware payload", "value": "3fca0d22c35943554a38cdef8c0f9c150f8cb3fcbce74345beb69e896988151f648bf693c5326af12cd4831beff533ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134165, "uuid": "64df04cb-90e2-475d-a191-578b07f64391", "value": "T1D904F10ABE615FDBC45FCE72061B036B18A889DE8292D32B51BC9D8876DC795C6D3C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134165, "uuid": "c4e82b4b-50f0-4722-bc6c-5388182a4331", "value": "3072:oDTIzc663gmG2mLwZEvd9FtdFSYHhx9GAd4/9QFadfj61EYdeBSMS6hvSvi5p7Yt:rzR63rG2msEv1tdftGAdA8XgSAhvR5to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134165, "uuid": "c34ba45c-5958-4c96-8926-dc5926ea67ef", "value": 180237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134165, "uuid": "f09b3726-6795-46a2-822c-eae372033140", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134165, "uuid": "80d09fde-e4ae-4af5-b393-0d222875a214", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2547c9db-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770101651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101651, "uuid": "3fc3602b-27c5-48b5-8864-60f5fdb0ed7c", "comment": "Malware payload (VIPKeylogger)", "value": "0b0b12522e2f5ccd5f52aef4f62d17eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101651, "uuid": "f5966311-7498-41e4-aaf8-b174287e2b91", "comment": "Malware payload (VIPKeylogger)", "value": "7280c5b1fd509a236bd4c4a4f43a06eaed94793dc8662c4ed0196a81e9164414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101651, "uuid": "e538fb3b-d003-4823-a8f4-980d98b8fdba", "comment": "Malware payload (VIPKeylogger)", "value": "3ed7d800f1e7155616fcf8d9c563bb1999ed7f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101651, "uuid": "0ac85c0e-975b-40b6-8477-59b2bc5a91f1", "comment": "Malware payload (VIPKeylogger)", "value": "04f96cf34b5a7f8f92ef42aeefebd10109c6156a08c034d6d64aa76512530466d5c7fb9457d3f7754b0e57413e292b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101651, "uuid": "ec43d155-9a45-4dda-958a-14c19bce8d38", "value": "T18894F1157B14E1A7DC1664B18DB3D3CBB3F4ED205A964A13322ABF2E9C352124E1E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101651, "uuid": "531cf6c4-1e30-4e70-ac44-3eb4dce5bf33", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101651, "uuid": "b85a4bbb-2ef6-4d47-8268-befad9eba63c", "value": "6144:OIw3idCURpOvh/lCMMkyYEpO1g8uUT/zsrhHPMl7Emb2Rz/W1LdC+A+2ZZ:/RUtsMMk31g8uJGl76/W1B/L2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101651, "uuid": "c3333b32-9787-45ce-bd74-fc46d41244b2", "value": 446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101651, "uuid": "dd32eddb-5296-4b7f-8e02-f018a0d7ef5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101651, "uuid": "ceac0185-b2df-4f0b-9225-8a6b9b4e58da", "value": "Advance shipping notice (00060343).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119cf2a0-00e1-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770110208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110208, "uuid": "cf77c434-218e-48f1-9aa3-bf595ce7bf88", "comment": "Malware payload (Gafgyt)", "value": "7c0f23f4852e03d5faf4a10ea1e6ddee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110208, "uuid": "e8a428c9-606d-4294-9859-145689f892f2", "comment": "Malware payload (Gafgyt)", "value": "730b0bd0fe9953213d89d8d819c3ea08ad67740d21685be62a12e8b024ef1367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110208, "uuid": "ce9d191a-a028-4479-a141-4d2fad40f837", "comment": "Malware payload (Gafgyt)", "value": "d666a3ad3755c7eda9510103a9d4b7a09f8e0170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110208, "uuid": "5185e706-6fc4-4a52-b065-4dd5ddafb87d", "comment": "Malware payload (Gafgyt)", "value": "8fbb5757339a2ee805dc1675cb033adb6056559f6f5a46e1e1896a5db4cbdc6946c7718bb107386042464d1b936b73d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110208, "uuid": "094a84d5-2f68-42cd-a9f6-168fa48381f2", "value": "T157F33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110208, "uuid": "3f3ed9a7-c0c4-4afc-9e68-b8127950c08c", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3nQfau:oFJMZBtqCnFCtE1R1WpvDiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110208, "uuid": "4366c6a5-8e23-46b3-b4e1-d9dad691087e", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110208, "uuid": "4737dd47-9758-4c56-bb5d-f40b6befa93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110208, "uuid": "1c689e24-5f6d-4ceb-8e41-f0225a959823", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6696cda1-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101761, "uuid": "a391aa99-91bc-4350-a2df-c857fd74a3e4", "comment": "Malware payload (Coper)", "value": "9410b46d078de66e8c5d968a67835d21", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101761, "uuid": "585db69f-7c0c-4995-9a1d-21895bf64dec", "comment": "Malware payload (Coper)", "value": "734b154c74808cac4726650bd8648be1ed42282aba70f69be763ba42ff602bf7", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101761, "uuid": "e3cf1062-f5c2-46a5-96fd-f159f3ab282e", "comment": "Malware payload (Coper)", "value": "70657700e452091829924319dfc2731afa03f1ea", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101761, "uuid": "3553b0c5-15d9-46d1-bf71-2058f88035ee", "comment": "Malware payload (Coper)", "value": "23f4642ee3f6c1f0000b6f76aef5ad4f364cd962f14369dd3d091b10f585ae2eeff4902e5823437fbabdf68111c13202", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101761, "uuid": "8945789a-9ecf-4d6c-92e8-b920c3c504c1", "value": "T114451242F789D517E8EE5B384867CEC4E1667E04DF42526B6A41B30C1DB3389CE22B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101761, "uuid": "1f471dfe-f520-40d6-8033-db595341724a", "value": "24576:gTnOSh8FTURtx6n8YVxaejEDzumlCt386MfQeXZy9xsUXkdb/bmA96lDh:gyA8FTOYn8wxaqEuduYyyTsUXkdil1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101761, "uuid": "2d427ce3-722d-4a6b-bbdb-d71a7cf7f1cd", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101761, "uuid": "494c8ca0-1965-4705-b899-e8b41295a80d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101761, "uuid": "1d393e18-602f-4bfe-8501-47d9eb9bc122", "value": "6e0f7a7_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be16c97-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101797, "uuid": "052c9026-b96e-476c-82e4-a12804c54a8b", "comment": "Malware payload (Coper)", "value": "2d0dce185e3087c39aa27fcc00ffebd7", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101797, "uuid": "571a8cfb-a7fe-4fc5-b1f0-57b713ea1be4", "comment": "Malware payload (Coper)", "value": "73aef1d852c9c4001b1a7db673e03417d30f489e56db5813a8757866c2641028", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101797, "uuid": "d5dd614a-0058-48a6-adab-a3d616bde329", "comment": "Malware payload (Coper)", "value": "fdff289f62de775f7a07542ef0c5c7f0f444c1fd", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101797, "uuid": "c34f8ab5-46a7-4879-acfd-7c6298e84fd9", "comment": "Malware payload (Coper)", "value": "ed276fd784e0898124cfd3a2463b131ef1eb98dfcacdd2717c15c2148607abb137525d32e04f0b587e3c936b947904e1", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101797, "uuid": "b80ee3e7-6699-405c-9a55-fe75ca1d3801", "value": "T104451241B7C9C526D8BA5A388D47D7906220BE41CF12639BB688771D0DB27C9DE32F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101797, "uuid": "4a1adfc6-9615-48bf-b8d1-b0e5ebdc642e", "value": "24576:vYPbnCPYsewUKj7Aq2Op1WdtKNr7jnlTcke4uv+LppoPupWBD5FSCPskwqZO5fJ:vYPOPLewvIq5phpckd2KpuWpWN1XwqQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101797, "uuid": "cec9e224-17c0-4fc2-96ab-12887000d44d", "value": 1176795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101797, "uuid": "665e14d7-afc6-41f7-8436-a3bfe0b48ddd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101797, "uuid": "7797612d-3b35-426d-b554-efa6715e1ad9", "value": "fbcb539_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243e2ece-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130855, "uuid": "36f922f8-2540-4708-a36a-4fa4a164e28b", "comment": "Malware payload", "value": "81ee169ebf2faa4a67d991631f8ae571", "object_relation": "md5", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130855, "uuid": "5ae0589d-e942-41e4-a59b-edd41540064c", "comment": "Malware payload", "value": "742772656a8a6fc68159f9fdfb63168c518fdf16e11276880da5ab302841a5a6", "object_relation": "sha256", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130855, "uuid": "fbffccbb-0f3d-4f11-be18-0a343c4d03e4", "comment": "Malware payload", "value": "e97dc109cc632af60dca7a980f1b6cc7139e16fe", "object_relation": "sha1", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130855, "uuid": "d0e3b5ee-458e-406c-bca7-18e15abf998e", "comment": "Malware payload", "value": "388d73f661f5c01a35a02fa2e44da4f4553259dc6393af248c25e5a54a8ec018a12cd9498a5bfcc35bd4215e5bcb8a3b", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130855, "uuid": "a0a93a0d-e1f1-43fc-8519-d90800e10ff2", "value": "T18E8733DD947614E5C5763777E6B801A78A702A35EFC2AE39D56E90BA0FEC30213C8871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130855, "uuid": "1bfa2a9d-5e88-4a83-8538-2d7539bad5de", "value": "786432:br9Ue8t2SvJWUip1e8Z8inUeQpUn2T6XTZazbKCxMJ3/gRQ:Vp+2Qtip1N/nPQUTYz+C2J3/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130855, "uuid": "c150d30e-5e23-40a4-a9d1-527f7c8c7f61", "value": 38405931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130855, "uuid": "9ba7318f-158b-4af7-aa17-f6e057c24e3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130855, "uuid": "83e6987e-9a77-4a95-bf33-abfe16515ca8", "value": "Setup_1770108883467.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cea5b1-00cb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770100854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100854, "uuid": "b1728380-04dd-408c-9613-525a7b3966df", "comment": "Malware payload (Mirai)", "value": "c863395b8284254ef1ee6b7962ddc4c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100854, "uuid": "dc78de8a-7175-4106-946c-60706fb501fe", "comment": "Malware payload (Mirai)", "value": "74c4ad799b5847fc5447a8c707d6bc173468469f0245a240c6804fd100f1711a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100854, "uuid": "787bf3c2-5ec5-4030-8781-15ed9a85660c", "comment": "Malware payload (Mirai)", "value": "7c92e1628b52fd6ab3e47c1c0ade80cdbe7a7a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100854, "uuid": "91d74fcc-1f43-4746-853c-d0dbca570d67", "comment": "Malware payload (Mirai)", "value": "79a39c862162eb2194c785fc83ecf487d493d992ef598c915f56eed4fd7a903688722d75a6a7293bae8b9227cf8b7f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100854, "uuid": "45636292-089c-4373-a0a6-79263309d685", "value": "T1538312F2F259E572C6594833476D680FD2FE69C1F2ED20973758EFA08D84421B6F244A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100854, "uuid": "8fb522b7-96d0-404c-ab25-ff52cc8f3bab", "value": "1536:Fnbeh4bY4BzMmeOJxsON3MEhyp22eWxnn9Spw7gsUt31xHJ/LxWS3F:IEYmMmeWqtneCIw7WN5xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770100854, "uuid": "5fee2aac-8a33-4618-9dd5-684acfd4a9f2", "value": 82648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770100854, "uuid": "3a09e7a0-44f5-47ee-93b9-0ec7279a16ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100854, "uuid": "04a1ca7f-0d14-4fd7-9d8a-fb170672bece", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087d7fa3-0094-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770077122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077122, "uuid": "094b99e0-b640-457b-a836-dca2f77d74fc", "comment": "Malware payload (Formbook)", "value": "99c0992338796dc80d99a0fba3797b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077122, "uuid": "959fd9d5-91b1-48c9-9332-e2cad47a4383", "comment": "Malware payload (Formbook)", "value": "750d0ef6eaaac00190a10d38493cf765fcb9a9076ecf4d52ca356af4a650585f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077122, "uuid": "8d24ce2a-9986-4d64-bb59-608410761713", "comment": "Malware payload (Formbook)", "value": "d8add360140a9ba5355bd6eff68035569b7e3c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077122, "uuid": "c383c152-e842-4804-afac-f3ec1b81451c", "comment": "Malware payload (Formbook)", "value": "0c65dfaa6ee6a683e6ae4ddb2c2f2620fe0670dcf7526b7033fca40dbb0e9ddfff3befe7ff570374dfde5260f027c08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077122, "uuid": "94e68865-49d3-4a1f-9d77-87f05c9619d4", "value": "T16E45CF027381C062FFAB92334B9AF6515BBC69260523E61F13981DBDBD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077122, "uuid": "ef069c8c-9575-4f29-931f-443798c95546", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077122, "uuid": "0414f027-71ca-43e8-9b2e-5dc9e426c610", "value": "24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aoLxNnPqDGgs:DTvC/MTQYxsWR7aoDqDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770077122, "uuid": "b7edf6c3-f7c3-4204-9956-d506d62b5321", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770077122, "uuid": "6dcebcf2-7260-466d-8ff1-e6e08e302383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077122, "uuid": "5880901c-2afe-49d3-971a-e6831fc10ec3", "value": "Inquiry ES75502262N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6297c721-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770136543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136543, "uuid": "e4740299-410b-4c47-9729-ce5b9579d917", "comment": "Malware payload (SnakeKeylogger)", "value": "4a76f4cfe9aae6ece05a15816d56b6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136543, "uuid": "a942aa0a-6326-4084-871e-9cde15a1e6fe", "comment": "Malware payload (SnakeKeylogger)", "value": "7516a2c38161d81247ae0b24808252f1a28b8fad712b59362573ff9810b1f423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136543, "uuid": "f314e954-9a09-42f2-99f9-702c5f10a575", "comment": "Malware payload (SnakeKeylogger)", "value": "1bd7e92addfe7997631b8f557c89f6a90a8f4072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136543, "uuid": "d8106514-df53-462b-9187-2f14f7d847bd", "comment": "Malware payload (SnakeKeylogger)", "value": "a092b51c9045056ccad45aeee7fa5f7201e35599d1bf29c382abae4a43ad3371d14d4262d68caac791fcc12410df49ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136543, "uuid": "b0d065d5-05cd-4876-bbe0-0c94970b6f7d", "value": "T1E6251239221AC612E4EA57790272D33543B28E8DF812E7528FFEDCD774066B1B918793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136543, "uuid": "97be6d6f-a372-4c0a-b8ca-d9ba1a4547d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136543, "uuid": "3a5ed8a1-d0e5-4525-a03c-591d01d9e187", "value": "24576:wddWU72SEl5hkvpfHj17oMN9w6on4ERueOmAMPGqb4Cctz8:22FihbhVN9JonFRuebR9MCcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136543, "uuid": "4ad2b656-e7eb-4c9e-8743-83522cf05e94", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136543, "uuid": "3cd38474-8010-4474-8159-e5f30beb17b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136543, "uuid": "c0ef2029-6dd4-40f9-b1fa-7111bdb82358", "value": "Request for Quotation \u2013 CT-2501 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a5ffb3-00f8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120437, "uuid": "fdacf62a-ffdd-4eff-a041-92de97a1f91c", "comment": "Malware payload (Mirai)", "value": "df3bcf8586a6eeb388b5b62543f7ff19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120437, "uuid": "ed8ffc3e-8ea5-490a-b674-e188811b3523", "comment": "Malware payload (Mirai)", "value": "7575a248e59f4cc82d111b2098c64ee7cfe04f2b6c29f30972b40adef8c724ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120437, "uuid": "5eaffea6-50f7-47fe-8ae7-d175b29d5eb6", "comment": "Malware payload (Mirai)", "value": "b5aa9acd967938df14886736e53b292df1d7c0bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120437, "uuid": "2561f0c3-dc4c-4270-8086-e9ed55431c60", "comment": "Malware payload (Mirai)", "value": "f6dde89338f676a77a9777f09c45d352e9ec8436acd0a211b3ea056dc5dfc5227a66486a5e854466bbf47d4bbc9c4788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120437, "uuid": "902458fb-f0c2-497b-962e-573e29a0b4a0", "value": "T161538EBBC4A959E0C64481747528C9B90723E404A6A67FF68683CE53444BFFCFA167F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120437, "uuid": "8ed3494d-cc21-4c18-abbc-40e9f98863ed", "value": "768:h//XTTI9Wa4kcaemdOLqOYex+cUZMJ9qYkRFoiKZol2CfmYFn79:h/fXWWa4I2+M2YkkiF2CfVF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120437, "uuid": "a97859cb-116a-4b1e-b58e-533627de1489", "value": 62968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120437, "uuid": "f9b66757-4d4b-4a99-ae13-080c0de663c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120437, "uuid": "a11ddf15-e01c-4b37-8813-6541368d63a8", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d5e38f-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101783, "uuid": "5649b7a5-8f5f-4a9f-9b8c-5dfae07e418b", "comment": "Malware payload (Coper)", "value": "ca7cab7ce1c236de4911c1867478d1fc", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101783, "uuid": "2170822c-3dcc-4535-82a7-20e8311d651c", "comment": "Malware payload (Coper)", "value": "76798397118c81edf2ef4588a60578a8700017afb98b040657b39cccdbe30009", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101783, "uuid": "68fbee94-0762-413c-8394-37649da4e060", "comment": "Malware payload (Coper)", "value": "7f9a8ff6f4aa26da07d943cdedb9b23174434132", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101783, "uuid": "bdb057fc-eb9d-4b1a-92e6-586bb970864f", "comment": "Malware payload (Coper)", "value": "c802be12e65b03872e934b4df0ca0bcd5964cfb1b1d496e29b2918726069f3891775729cb0f086fc0224f1e59c71787f", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101783, "uuid": "5390244b-e980-4494-b9cd-26ed9b731768", "value": "T1DD451201F7D88613E8AA2E38494BC7E8A6317DA4DF12171B69167B1E0DB03C5CF52B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101783, "uuid": "8b8019b2-92c5-481e-adea-155db8aa9a15", "value": "24576:9TevxnNtcvpaLXwK8pngGkbR/jaNKC9adqMHW8jT9OVsE1a2giUp:96vjtjwT1T0bmz5P8jMVskNgZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101783, "uuid": "6388adea-6bc8-4f16-8fb7-3d5d47400f94", "value": 1176803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101783, "uuid": "747ba997-afc7-417f-8238-0040060340bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101783, "uuid": "278a142c-41cb-4599-afa1-d636a08d8ce1", "value": "babcc7c_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef58bfa7-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128619, "uuid": "584cade7-0578-4905-8fe4-4cd8b7917d33", "comment": "Malware payload (CoinMiner)", "value": "5d044372c13142eaa0d25357a0ff6e23", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128619, "uuid": "6bc2b526-6d5a-434d-b080-3bce58e9da7b", "comment": "Malware payload (CoinMiner)", "value": "76dacca013a35aa6d8d301c45697f564aa979ae7aee3ad4569c4a4e6cf501b0a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128619, "uuid": "f6a9c7f7-6f23-4b86-9a83-6ff5f82af16c", "comment": "Malware payload (CoinMiner)", "value": "2219f6066841026e5317b0d35d31c3a8ee45983f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128619, "uuid": "daa41f94-e620-4732-b455-03962994feed", "comment": "Malware payload (CoinMiner)", "value": "84f3ffe6ee3d6a70503e21e33aa09ef45c1004817f3b98c363de7aa6a780ff80bdc5d787b908c7c00eec7278608f3004", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128619, "uuid": "017c4eeb-35af-4c64-adc5-bf6d2e68ff37", "value": "T18B76235E225C73ACD40E8734A033BD44F1BA152E5AE9DA9933DB9BC07776420D94BB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128619, "uuid": "d7dde930-ac74-4bea-bc5e-221f1bf57a3a", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128619, "uuid": "da7b8d0e-7869-4f4d-a855-d526eaeba828", "value": "196608:D3Qmn1G1IB0e5TMMLMYXd9ixvWpG68aRfM:D30IBNiMLMgi4wdkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128619, "uuid": "21f6bb49-3837-4337-9d47-af213c8995ea", "value": 7762432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128619, "uuid": "b0d51836-d988-405b-afa7-9a71cde5e1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128619, "uuid": "1ac7bd31-8f8b-416b-91e1-a63c3e36a2c6", "value": "SecuriteInfo.com.Win64.Evo-gen.27652842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43f27f0-00e1-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770110454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110454, "uuid": "1d848bb5-5acf-49c7-bd39-3bb7b4f48739", "comment": "Malware payload (Gafgyt)", "value": "7a7946fe98866937fd761d693a6b3058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110454, "uuid": "fbe71c63-db80-42a4-907a-ba496910bd07", "comment": "Malware payload (Gafgyt)", "value": "76fac44e449de88e1bbc9fe2f7e30898421ff2eef1229229c1d1899139f1e8f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110454, "uuid": "0334e9ff-4acb-4fb4-9851-db42320e9b27", "comment": "Malware payload (Gafgyt)", "value": "ae87fed4f6376134b422770f3ad38465352b5aea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110454, "uuid": "218babfd-479e-45c4-bedf-78123b8953fc", "comment": "Malware payload (Gafgyt)", "value": "45b0917a775e0d1e7758e50cf394359aa7f05b85fe4ad8208ff6f8a5f9b1c3ddce99b7ac39ec129fc83433134c1ec499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110454, "uuid": "825bf787-a3c4-409c-ad0e-8f61ff6bd80c", "value": "T1A6C35B82E6A2D0F1E68701B00557E3E68935EA305416CEC6FFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110454, "uuid": "706ce956-5dc1-4ca4-8611-d69e8395962e", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNioSw:VoRNjmj1VGc3rRiol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110454, "uuid": "2caed1cd-4c74-43c4-ae28-890289823bb7", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110454, "uuid": "cca05729-ec6f-4b1f-9f02-23d5f9e0d456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110454, "uuid": "d4ff2141-079c-458d-86a1-31041c354f13", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a79860d-00d7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770105982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105982, "uuid": "14a114b5-e2c8-47af-86cc-095c846d65fa", "comment": "Malware payload (RemcosRAT)", "value": "a1a32d741ce37d937efc08409da90c14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105982, "uuid": "b30d486d-7165-49ce-8e76-c452504357d1", "comment": "Malware payload (RemcosRAT)", "value": "77b015bc671a8973f4860bd55352b39c681ecdad4ac48a7348c6bb6fee204898", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105982, "uuid": "ee215289-4d13-4c01-b26b-b600c31ee337", "comment": "Malware payload (RemcosRAT)", "value": "5ffaa90dd2f45ac84bb1702a0789794e2c4c30fa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770105982, "uuid": "5a68e0f8-de24-4ad6-926c-2d3f076cd9b1", "comment": "Malware payload (RemcosRAT)", "value": "d555938fe3d42ed8f53deda65ffa157262b1ac128662da8ce2a5ae049a8f6059b5b185140914d17d5432f12d87924d35", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105982, "uuid": "c301898a-4801-4072-8c2e-91bfcb589add", "value": "T1F6168D1EBA6D40E5C2BEC13C829BD90BEA7178514326D6CB65E48E190F67BF05B3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105982, "uuid": "960d3f8a-e912-4f14-94da-cf535015e4eb", "value": "d90e501a64bb3d4b1653a821eaaa3d82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105982, "uuid": "0b198cf6-d1a2-4626-a5cb-dbc6a2e88255", "value": "49152:aFoQ5hd8Mmbg6zz1JtiCECh7JpIoBOctvRDN80g9/GgFZXahtPtMtGKeCEdMd5Nx:aFs31fpAIvRDN80g9/GToWPhzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770105982, "uuid": "3090fcd0-9f52-456c-8fc7-9c4d9080b5d7", "value": 4102144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770105982, "uuid": "c4d81576-a3ea-47da-9968-1908fd3dc673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770105982, "uuid": "304d1d54-2025-4ad8-9728-800e507c1d97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02ea39b-00d3-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770104488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104488, "uuid": "fb36b817-58f0-4ff2-9427-3bcbeba1aedd", "comment": "Malware payload (XWorm)", "value": "21b69132bdfe139dea182dc0b6e02f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104488, "uuid": "c2c4a208-4eec-4792-9fe4-2e37710e9ab8", "comment": "Malware payload (XWorm)", "value": "77e10fce419cf22127e04f301914bf28f0511a23380221059522d06d15007d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104488, "uuid": "0109030e-5b0f-4ccb-9ad0-1f568e608452", "comment": "Malware payload (XWorm)", "value": "c5ae82d0c760e1df9b2339296565e807b4fb42da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104488, "uuid": "97bfe677-a467-4b0e-8e35-bf42bbe451a0", "comment": "Malware payload (XWorm)", "value": "60effaab6366d2b9eb8506f1d54a9c6a0d8b0fa7f1d9a914b934e472f0d22d55336c06e34cc7bf7f1ea82f2999a12c8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104488, "uuid": "6977ab48-8600-4ddd-90d7-7430503d8a59", "value": "T19AF412692319C913C9EB13301AB2D33923794EDEA522D782CFFDDCE7B9012943658392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104488, "uuid": "5d23ebca-6c8c-4ae8-8d79-eb3cf9459d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104488, "uuid": "90d00b1b-222e-4db0-9742-39ea8f1a5fac", "value": "12288:NddxyqD13ACqc9AJn7N/6HZbBc67IjwSc7sTDUkz4rv1kGlFxZeTTGYwBgZvsNK:NddUqDeCnAJnp65Bt7EDxz4jq4xZQCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770104488, "uuid": "34bffe16-16f7-4f91-98b8-901f51153284", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770104488, "uuid": "38e2a309-0a13-42e3-9472-0c77bd093602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104488, "uuid": "d49c68db-361b-4644-a231-8c8bb391a545", "value": "Shipping Order_SO#5600 (\u5efa\u8fea) MINNEAPOLIS 0203 - HTN26020005.xls.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3457fd-00d1-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770103517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103517, "uuid": "f4ff8d9a-1ee2-46e1-be19-f6c12604f4cc", "comment": "Malware payload (Vidar)", "value": "ba12e88cd6578facdf3a279cc1d59384", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103517, "uuid": "7bb9beae-5538-4690-863d-f9f882ff8e6a", "comment": "Malware payload (Vidar)", "value": "786c4530405f7dec893e7111e2e9cdfdff553ca6af83f7e304c31872db16e67d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103517, "uuid": "353ceb75-6bdd-4605-a989-bb3e24e4cfa2", "comment": "Malware payload (Vidar)", "value": "db6fa4dc5673cc65bfb9c8c35ac90568ec9b1b48", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103517, "uuid": "83603c14-f5d6-41fa-ab57-66af02ad1d5f", "comment": "Malware payload (Vidar)", "value": "905a997cc60521d1fb5286c875fa8c1f182a0c2120d0554a20b464dfdfe7cb35ea1d82c3cbe6f1346bbc9333aabae129", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103517, "uuid": "d3fb88b6-2585-42e6-9abb-342bad289f59", "value": "T10286297F729592A8C29D853FC0A3CF40F5F372761B33C6E7129107A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103517, "uuid": "4c8bc813-1d84-4b82-80d2-baf07ee89727", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103517, "uuid": "86b21038-f9f0-46ef-a8d1-c17afe5ed040", "value": "49152:0Nmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgkQ49dp+MEFtUePtZ:0z7Vp7wQ49dq3LlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770103517, "uuid": "1ec9da9f-75fb-4cc6-9b44-e64b46ba7990", "value": 8538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770103517, "uuid": "ca81bc94-a699-4ae4-bec2-9f3123b2c5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103517, "uuid": "274a700d-4d0a-406d-812d-eb56acf3bfd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf728cd8-0120-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770137558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137558, "uuid": "b5481a3e-e087-43ac-abc6-fa3009cd8425", "comment": "Malware payload (Mirai)", "value": "9a37a17e038d9ce2ab8b5c77723caf6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137558, "uuid": "c9f34fb8-6bd6-4112-a7ac-ea8ebe2902d1", "comment": "Malware payload (Mirai)", "value": "78b40249bad0b543f9d1b70c7c8b19cf2242002dbcfa507464b8649db9dce14b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137558, "uuid": "439c2dbd-cdca-4a8d-b2ce-9342eecd3eb4", "comment": "Malware payload (Mirai)", "value": "9adf218c87af3d537963d8a4622d656b55fce003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137558, "uuid": "bed28891-5289-4e1b-be59-16b8f2fd72c9", "comment": "Malware payload (Mirai)", "value": "3372f755a073f2c4e6dfcad2ba5c4cfecfb8e3ef7f37d1ef5b0a614074922531a7e19e5ae1937285f5cb33be60aae391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137558, "uuid": "39da8fcc-8803-406d-8d2f-dbff30c13cf0", "value": "T1FC263943F85191A9C1AED130C6669293BA717C981B3023D33B50FBB92F76BD46EB9314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137558, "uuid": "2b6bf655-d760-4dde-980a-48a0a8dafaa4", "value": "49152:QQMPrb/TfvO90dL3BmAFd4A64nsfJLiPLbd9MDnwZZZ/6bhDubDf6b2NlJX72f4y:WEG/xibOx7Z/Yf7O94EvLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137558, "uuid": "b3161698-a258-4405-b566-e19d68f90321", "value": 4640768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137558, "uuid": "7bc1f82f-e6fb-4717-9602-27ce9ddc019d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137558, "uuid": "3f66ffca-c14d-4d48-94c7-cef5a8518cae", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968ac02d-0117-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770133624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133624, "uuid": "25e306af-b789-45c5-97fd-303dd19fde4d", "comment": "Malware payload (XWorm)", "value": "7654e634792f690b4e2beff3cdef8951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133624, "uuid": "ecd71942-743f-400c-bd39-2d60c3a95d00", "comment": "Malware payload (XWorm)", "value": "795f6bd5e49e7ecec92f61b4892aa002ad4e4e0d23b57cc435e84bf88fdfcc4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133624, "uuid": "65914d35-f6d9-4e0d-8e0d-b5aa989cd642", "comment": "Malware payload (XWorm)", "value": "447a96ac6e1b8fc89dfa3ab156de5a3c1dd1aa03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133624, "uuid": "2db60760-70dc-4083-8c62-3b08aa36194e", "comment": "Malware payload (XWorm)", "value": "19c90691379677e611572a85d34e928472842d41fdebaca0bb94370f2d7e5e0dd4c331b290f928385df5c6ca3cbff8b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xbinder", "colour": "#872F9F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133624, "uuid": "553e2dd5-4261-46ee-8afc-32f4ea082419", "value": "T1B604558D2504E3F3D5C861BAE006B7F652B45C04EB5AE1BBB10C7F457178622FAE9E60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133624, "uuid": "c8ef7bb8-b88a-4d80-98b0-4e585bd361f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133624, "uuid": "211a852f-e44a-49e4-ae28-85e4fcb8f519", "value": "3072:M184mqYF8uTUHJeT03birwJqQw0Htc9Tpt:M1F8F8YeeTEirwJ/xHtc9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133624, "uuid": "f6f5316e-06f9-40cb-80c7-4f26ec1474a9", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133624, "uuid": "eff154ac-afa4-44d5-a424-a632fb9ae528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133624, "uuid": "0c716fb2-35b8-4ff8-8d0d-174cbf030ea3", "value": "795f6bd5e49e7ecec92f61b4892aa002ad4e4e0d23b57cc435e84bf88fdfcc4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de7c54c-0121-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770137744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137744, "uuid": "b17af877-7300-4258-8455-43f86a3ce7ec", "comment": "Malware payload (SalatStealer)", "value": "742fdecd101ab35b6d134688d1e66b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137744, "uuid": "cf5d9572-fc83-4f75-a44d-e3740e52200c", "comment": "Malware payload (SalatStealer)", "value": "79c6abe8b18b23eb9ddb8ebcdc1faa3f5df6651201856209f58ff7f488fc2060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137744, "uuid": "855ffb62-e5b4-45e3-9c4b-3dffb5fb55f0", "comment": "Malware payload (SalatStealer)", "value": "7c8d192d2e49aa892f83f7bd7057ee77b3a21ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137744, "uuid": "f4a2187a-d2c1-4c5a-ae80-d3af2fed6cbe", "comment": "Malware payload (SalatStealer)", "value": "5955f18369452b0815b4c2566a8dda2d9d01cf1b6f94c8c48ad6ace8c0cdd226a86aaa75b2ad1a0ba5942816553343aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137744, "uuid": "38e03471-8f81-468b-abe9-71f0fc578457", "value": "T1AFC65B11FA8B94F5E9031831416BB23F63355D049B28DBEBFB543F6AFC7B6811926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137744, "uuid": "b0877a09-557a-47fd-beee-128e76c73338", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137744, "uuid": "da592f8c-ec3a-4956-ac26-6c511c16aa9f", "value": "49152:Jr17MPeSbbgPViBQNgw0d6bBAJEdQq3OJ8dzQYKgNua+HyeR9RsRS0geK86KFYrP:xlMPerVZa6QY4a+TRP0T6vz1IcXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137744, "uuid": "8a04702f-8d02-453c-85eb-3d6e77aac352", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137744, "uuid": "62ae150e-07c3-42af-9562-e22caea6b1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137744, "uuid": "45bc3d39-15a1-4e63-9836-eaa9595a0f71", "value": "fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4994ccaf-00a6-11f1-a129-42010a9c0007", "comment": "Malware payload (XoriumStealer)", "timestamp": 1770084962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084962, "uuid": "1bf766a4-a7cd-4f19-aff6-8e36149dd9e4", "comment": "Malware payload (XoriumStealer)", "value": "23d91a4a4fea36f78bb73793b20b71e5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084962, "uuid": "2a03b420-3ad8-418e-9d18-6d72d3b3ae11", "comment": "Malware payload (XoriumStealer)", "value": "7a24023adcb3ea06c47f23d97a301b348b9067f50c2229ad770a390c7ca76cdd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084962, "uuid": "6d8d0226-a739-49f0-8561-73128a5d8203", "comment": "Malware payload (XoriumStealer)", "value": "14c0e10309ad5dd51ea11606d7c5a4288b6de2de", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770084962, "uuid": "df478c4f-9ad5-4831-a8d6-8026a9abbdab", "comment": "Malware payload (XoriumStealer)", "value": "92dfd78b1d95a0a47a8af94da419325e003cc7b44bb6795d606517679560f63a89b28be9c833c0a8de9f4ab51f125f8a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084962, "uuid": "67a9f1b4-c68e-498d-9d90-775eff13bb17", "value": "T1F43111AD87969CC545EEF0E48D463F05119C3B33C2A169B4D54428E2763026CDF7BAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084962, "uuid": "ec7e5617-95b7-427f-bada-66682613292b", "value": "24:6kL9Yfxlf20DmHNkuN0l339a/hYsfsYrGlZgiwcDWII6k2ERzr2xjSi:TSG0Kt30N390BE/lZRZfk9iSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770084962, "uuid": "61795192-a827-4c1a-9c74-053ef509c54a", "value": 1578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770084962, "uuid": "45c5f0fc-78d5-47fb-9764-999971bdfcef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770084962, "uuid": "ae4adeb4-a63e-4404-a9e6-46a05e34a073", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d58ba-0144-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770152934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152934, "uuid": "c5d95fd9-0e02-4bf3-bba1-1c7a4adc276d", "comment": "Malware payload (Mirai)", "value": "aa5fa12e352512eed52153eca29b85e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152934, "uuid": "5c91c3bd-72c6-4227-8cd0-8faaaceaee06", "comment": "Malware payload (Mirai)", "value": "7a793df0a54a8e866f9eae27d506ab41bdadceb3a1f09b1a79a1a50be6cdd8eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152934, "uuid": "6416ce0e-635a-455a-a144-a993efc4270f", "comment": "Malware payload (Mirai)", "value": "beea19a3639de97898ba2ecabe81eefefff150a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152934, "uuid": "4a5948b5-d96e-4fe7-ae7f-3e543f5c4bd6", "comment": "Malware payload (Mirai)", "value": "48b49816bd85181b4b24c0b441d62ef69a2a624ea688cf58491856f3829128bae0e02316059b1a64696d24623bf43b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152934, "uuid": "7e547799-274d-4df9-910c-e80f11cb99b4", "value": "T12A130881B8809627C6E4237AF56E01CD332567A8E2DF731BDD222F50778682F0D77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152934, "uuid": "ac3774fd-65b0-45f6-8e94-3ac76cb67298", "value": "768:ikw5zGYkJdEZi5jdbV38yYYa92gF9RX1/K/NM7dUmL12:G5zGYkdEITlYlFXl/Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770152934, "uuid": "9a021726-cba1-48f9-9946-09706c5567a4", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770152934, "uuid": "f0110154-5403-4ca0-af5a-19bc373f1a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152934, "uuid": "55bf66d1-cb9b-4a3d-afbe-23968a063f36", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff0ae4e-00a8-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770085966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770085966, "uuid": "abc1713e-c827-43da-8e36-d3dedba42898", "comment": "Malware payload (Vidar)", "value": "157bd36c247c1fc8ab05685b5e331568", "object_relation": "md5", "Tag": [ { "name": "130-12-180-43", "colour": "#45A20C", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770085966, "uuid": "ce5e5848-3ad5-40fa-aa48-2771cd4b379c", "comment": "Malware payload (Vidar)", "value": "7aab4e6bd5c3c606fcce52d1dedf257f08bf7dbda4d66c751b6d0ee859bb9248", "object_relation": "sha256", "Tag": [ { "name": "130-12-180-43", "colour": "#45A20C", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770085966, "uuid": "4395fd24-9c21-43fd-bd65-6f7488a7815c", "comment": "Malware payload (Vidar)", "value": "9f61ca57c90f15c61bc6ba26759b605dd7b911dc", "object_relation": "sha1", "Tag": [ { "name": "130-12-180-43", "colour": "#45A20C", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770085966, "uuid": "77b7245f-1b09-42f6-89de-87255611d963", "comment": "Malware payload (Vidar)", "value": "32c82396d5f8500199af95ac26cee9e0e67dcef5bae5f67f503d1a8879895e52bf699b6e492f44402d3c1c43085372cc", "object_relation": "sha3-384", "Tag": [ { "name": "130-12-180-43", "colour": "#45A20C", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770085966, "uuid": "1575476e-ba1e-4b21-8668-b145c111f1ba", "value": "T13B8512513ACAC43AD29E053788629B75356EBC760B30D4CB7F917D6C9D703D2A87A322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770085966, "uuid": "afaee48e-6a7f-403e-b5b2-9bef3b5f7eb1", "value": "49152:ipxxnKyitSpxpjd//lOPaQVk7sKxQ1MBQnA:ipayaSpXjdXCaQVkY4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770085966, "uuid": "7355331e-d9c4-425f-813c-4b21227811df", "value": 1802240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770085966, "uuid": "298f7b7c-1875-4046-bb64-9311cde72b36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770085966, "uuid": "09f78f0b-b975-4c62-a169-c685098828ff", "value": "X5P2hQO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1d5849-0100-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770123834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123834, "uuid": "922f0653-22c2-47a3-8c32-e5669e004492", "comment": "Malware payload", "value": "a3bd92f64aeef373bfae9ec3b26713e4", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123834, "uuid": "77510182-099e-42d3-b8d6-df63eda8e01a", "comment": "Malware payload", "value": "7ad8c7ce47de42609d110ced2fd8c54f00cab3a34d501368a47cd8139f27b582", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123834, "uuid": "970ea201-c575-4697-a280-72c463f346d4", "comment": "Malware payload", "value": "a5a95ea77f6ea654ab33546db3f83879a8d76e4e", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123834, "uuid": "1d9273f5-31b5-4fe2-917e-0806eb3bf8bb", "comment": "Malware payload", "value": "84425d1c3dd0801bda905e085fe00b85a354e76d927f390e3d5f95e2e27e0ae8a89c0f57ea699c35086fef66de0c093a", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123834, "uuid": "70e293e2-d227-497d-ab94-f99b67332a73", "value": "T177A53399D7B855A7DD2AB462BBA9924CDDE74F1DF8C34A04FB3209774783E318304A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123834, "uuid": "3ad97def-45c4-4e91-b16c-c784f73dcaf1", "value": "49152:7jXC6jA71dB28QVu2WLIFjjCr34nknwO6PEycjffkRu09ZHa1TGf:/j21zb2HRjCrSwePGau0PaF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123834, "uuid": "c936e0db-cf66-4adc-946c-d3cc30e29030", "value": 2181604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123834, "uuid": "d08c64a5-6a7d-43b2-a5a4-e6484a288183", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123834, "uuid": "0b69f6f5-572c-422e-9472-4c438b73d4d8", "value": "Payment_0000484444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449b7832-00b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770089249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089249, "uuid": "fe930b0a-7c69-4152-9929-2373f4c118cf", "comment": "Malware payload", "value": "5acb813363d34ea6d496ac1bbb5bb884", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089249, "uuid": "12f07138-f7f3-4012-ba09-36ceae1fb382", "comment": "Malware payload", "value": "7b68c8446305f550064e6290b401fb6c0d00a11bca223bd3f5021e669e8195b3", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089249, "uuid": "77fd97e0-5f68-491c-b5b6-2998501d5fa2", "comment": "Malware payload", "value": "8fb8e21e1af1d62aedca1db93cb85a31c1e45488", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089249, "uuid": "ce4776ef-5ca2-4135-80c0-eb16db498d4d", "comment": "Malware payload", "value": "b6c30f7a8df2fb8bcae8ef85375a608cb74523b21e450a91b03e1aa2bbfdaa401d5a9a2986c50d2d214fb9867c5521fb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089249, "uuid": "b502647a-795e-4610-9777-26f30bbe0d00", "value": "T1B5573324813393CCC9BED973CE5303B3DD614492EAE14E71CB8162925B5DA1E4B94BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089249, "uuid": "a2fece0c-9fc5-4f91-9e7a-65d0c951fb9d", "value": "59abb8065fba041b744be3ce82fc9af0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089249, "uuid": "377e9115-cbe0-4384-b730-e21211ee303d", "value": "393216:a3KpyNDvwBv6tO1Kse7ZfHM0c8M3QpHAtXmbkD+UuIm9J9E2JPNKfMI9zjR5x:aKz1DQZftNAtXmYD89J9jPUkItx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770089249, "uuid": "a6f3f9e2-f3a1-4326-a72f-17fe21078589", "value": 28000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770089249, "uuid": "297dd1ab-bafb-4d8b-925e-ff5150524799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089249, "uuid": "9f869da0-ad03-4353-a60c-ebd0855c2a01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34938a0-0140-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151389, "uuid": "2858be20-8eff-4bac-8992-98fb61b21549", "comment": "Malware payload", "value": "ce0948158173966495468ae127738d14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151389, "uuid": "5ed58978-66d5-486a-948a-cbc478d91648", "comment": "Malware payload", "value": "7bbeb2885d1782e58d7fb4184372d94003aa90747ba74aa9a7f39e784b89c0f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151389, "uuid": "ef2105e0-5003-4d94-af5a-077ffc12dfab", "comment": "Malware payload", "value": "4d25109e0800d3d2e36b25c6265da162f5f48b7f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151389, "uuid": "c3d659f7-bc96-45a8-8ea2-96545f9c86f6", "comment": "Malware payload", "value": "80b3efd4dff90b1a8f307438d2486c2356ab8a62c764c8e58ab96246b7d00f69c4c5041a35462bc84995867998b12477", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151389, "uuid": "aa702660-318a-40e9-9df7-367eb67f19c0", "value": "T18444231697190876C3653F37E8CB9E9FA4283224E9570231985C3041FE25BBAFE28D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151389, "uuid": "66a9cc03-feda-44cb-877a-b6dc5c7509e6", "value": "cb6cec7f27008387172e48250cd60295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151389, "uuid": "625b4316-0015-4bb3-a5f1-33867fac6ff7", "value": "6144:OtPwmQJWgG3syAB9O3wxdlsftwA4gd/5CgBg0KwgX:OtPwygG3sBB9OAxa4ghdjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151389, "uuid": "6f9e66a2-e4d5-4d4b-be3a-717f54ea2632", "value": 264872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151389, "uuid": "e19e4f87-774e-407b-8a1e-8f7c83ce54d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151389, "uuid": "9ec2ba54-d7a6-4c73-99fe-6c85b311872e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a396c9-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143476, "uuid": "82fbf028-13bc-4f63-a3fb-05945c00f0c0", "comment": "Malware payload (Gafgyt)", "value": "7b31d4ffb5febb4edb49606fdbfb9404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143476, "uuid": "3965d645-dd6e-447f-96d2-e60a33a4f1ea", "comment": "Malware payload (Gafgyt)", "value": "7c13102634e6b7b74b6e9620d7d265fa9f736409703c262eb825ef987dcb2652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143476, "uuid": "88f4a5ec-6c62-49f6-9257-8ea972b8a4fb", "comment": "Malware payload (Gafgyt)", "value": "baf1b3e92877b3607be80fa177de6cff7c80a473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143476, "uuid": "3836df3e-3118-4a39-a700-804454ea31ab", "comment": "Malware payload (Gafgyt)", "value": "85d8fe8a3d81765a27edb45fb13f24a1b669bda9a3babec4319ea4cce9f198ece7f64264efa28966a6dff664e614ff57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143476, "uuid": "58ad3310-f8a8-4f7e-b1a4-bfe1ac7e5262", "value": "T19BC32A01F9514727C2D327B6E79E439D7B361694A7D73301AA38BEF42BC6B882E35520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143476, "uuid": "04b29bf6-061b-400c-8ba5-a82d96e1723d", "value": "3072:0wBD/bF8z9tTu2dI9b9uKZ7royutomnfrQpzkp10fj:R/bF8zTTfI9BuemnfrQpzkp10fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143476, "uuid": "8d07e413-4edb-47f3-8303-5d080440326a", "value": 118566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143476, "uuid": "f76116a6-be01-4b24-b9c1-f6b29a400cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143476, "uuid": "7541fbf0-1615-4ec6-af2e-d84b4e9130bd", "value": "pXdN91.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06928ae-013a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770148754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148754, "uuid": "e0ee0acc-2344-4c79-b9a6-d2124acf0067", "comment": "Malware payload (Mirai)", "value": "53f96c4306ea66c0710a40bcfdcfcf3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148754, "uuid": "4bfa633c-f0f1-45f7-bef8-e95026a7e8a9", "comment": "Malware payload (Mirai)", "value": "7d17c2568f3d462292b10d4f73845f70cd4d43f1d0ae94a9e595aee27834324d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148754, "uuid": "2a88d98b-0218-449b-8269-7329c95057a7", "comment": "Malware payload (Mirai)", "value": "ad378a579571c56a9ecb588fb960b48580041a07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148754, "uuid": "26974af2-f337-45b5-93f0-4c0cc7d0efa8", "comment": "Malware payload (Mirai)", "value": "427d2237de23083d917005b4d536f6b2bc1abe9f5e884c8d12eadeb84203a84f2676737e9e36ee2f618d5f389e49e594", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148754, "uuid": "3a8255a3-940f-451c-b341-7c5449e53816", "value": "T1AB217CDF159A37614C8BCF75B1574968B10EA7E22192DE98F98E2863BDC4E403444F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148754, "uuid": "b2646125-15ad-4110-8c91-21c706f6975c", "value": "24:boWBG05pELMk0aptjD0KRURUBP3iIxxKrrFmatkk0:boGGMpzaVuiBP3iIxxnat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770148754, "uuid": "a2a51b21-18b3-4fcb-83df-0994f9235541", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770148754, "uuid": "c491820a-5e35-4815-b0cf-b71dfe3980c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148754, "uuid": "51a994af-af6d-4230-ab6f-f69d07df3ae8", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f354392-00c6-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770098849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098849, "uuid": "48773a02-c7b8-460a-a2b2-df09ec358f92", "comment": "Malware payload (PhantomStealer)", "value": "c5563b207aa5107c6d85eeadf8b5f2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098849, "uuid": "4736863c-f75c-4000-b434-e2a1300da404", "comment": "Malware payload (PhantomStealer)", "value": "7e8ff8227296ccf0c4ebb40ac757789ea923ac80cfc4f667dccde04df7bcc673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098849, "uuid": "96b49e2b-84fd-4117-9595-7b5999753797", "comment": "Malware payload (PhantomStealer)", "value": "b260c8e4cf1e3ced45f1b4498e6c925d43efb5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098849, "uuid": "db5419ab-b64b-4964-9567-139759ead8f9", "comment": "Malware payload (PhantomStealer)", "value": "a366d1dd0419eb85e3cbe9c3f9650faf1c1c4d98067c4621ec5baa0350a9e43d07d18cdc0e7f768676b301168ef950a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098849, "uuid": "7653fbc7-139e-4cdc-83af-4d3f8de1e0bf", "value": "T17975D00273C2C026FF9B91734F5AF6215BBC79660123AA1F13981979BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098849, "uuid": "87f05c1d-f248-46bb-aa68-e02b7afe1648", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098849, "uuid": "025b2cec-91cd-433f-bae0-c0114c7fdae6", "value": "49152:mPVt/LZeJbInQRaRymYVPEjfKKrMU0fM:cTYbInQoYVPETKdUSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770098849, "uuid": "881f2b2c-0a39-409b-aa65-769b055a6955", "value": 1692160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770098849, "uuid": "f60499c9-679d-478b-a16a-2ffad63d0c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098849, "uuid": "57d1b974-ea29-411a-9405-ad929e9a04e3", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c0b5aa-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770128331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128331, "uuid": "1504dd67-2934-4569-84ee-a4acea09c81c", "comment": "Malware payload (AsyncRAT)", "value": "a41eb04ae5621e76fece338e93cf1af2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128331, "uuid": "fb580029-f9fc-4fc7-8af6-dbdb9ca70959", "comment": "Malware payload (AsyncRAT)", "value": "7ea1cf361f17a11e75a121596ec34448d5b07e2fbc474a3a025c99924bd3e5da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128331, "uuid": "203e1bdb-622c-4209-afae-27edc1b49a74", "comment": "Malware payload (AsyncRAT)", "value": "621f8311b4fe9022a30bc0a6614908df8e6a960d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128331, "uuid": "291197e7-24cf-4659-8c4f-097f5b7e346b", "comment": "Malware payload (AsyncRAT)", "value": "cb72f1a30863b20bf2cc6873d3132c7f130ada0339ca41e5c68104f88f477c3661bdc029f0dda6438cbb44a9e30e1303", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128331, "uuid": "f23fd45c-cc2b-4238-8dbe-180b4131267a", "value": "T1D2232B003BE9812BF27E4F786CF26245467AF1673603D65E1CC4519B4B13BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128331, "uuid": "c3efb06a-c49c-47b5-932d-38d2bb97fc3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128331, "uuid": "e540605a-00f3-4413-bcdf-a24fb7e12e46", "value": "768:ou6sdTvER+SWUk6P4mo2qbzUZeDjycBwRrAPIzE2O0bsnxPeehrIscqzrzu9qr6P:ou6sdTv2S2EdQlzE2hbsn5FVLcczpe3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128331, "uuid": "a64bff7a-27c0-4eb7-a861-569a0aefae76", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128331, "uuid": "c8d7078b-7b7a-496c-a432-f1040d649251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128331, "uuid": "0ca42d1e-03c9-45c0-a279-f8ebeb451243", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f807b0d4-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128634, "uuid": "9f0ee855-5812-4608-8a00-bc9d3597f301", "comment": "Malware payload", "value": "7b44156dae48231e2a70306b1824d104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128634, "uuid": "e4987586-c10a-486a-9716-aca62573fca3", "comment": "Malware payload", "value": "7f04c9331e13e2b03d1cb6411529abe522a2deec0a3c9c9d48e8a7450f99d227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128634, "uuid": "62dd6835-8bfd-4c32-8f81-3144047f30f0", "comment": "Malware payload", "value": "600a0169fbd17ab384e5efeadb6f2983b320cf0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128634, "uuid": "3a666531-eb04-412b-a2f7-db8118af010e", "comment": "Malware payload", "value": "7350ceb4609e32c1e613315dd5e8cf27b05479c03242652ffa84747fc0957ba3b959e7312b4cd2f777014971b4ec7b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128634, "uuid": "5c2d5b17-c8f6-4bd5-9080-016ea17a9cbf", "value": "T1D97623AF604D2358D41EC3785423BC49B2BA161E1BE9856E76CEFF9037EB410D906F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128634, "uuid": "4f1846b6-d431-48c5-91ac-ae6a24470191", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128634, "uuid": "504dd497-1400-402d-bcf3-ee8b2016db4b", "value": "196608:xYh3lje582aXGOUie7rK5zabSagkKS3J6KKjkk7qVL:xcZe58vXNe7O4SnklJwkkOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128634, "uuid": "e1cead6d-7306-463c-9a3b-bfd23b8c4a1a", "value": 7760896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128634, "uuid": "6542598a-da2c-415f-a78c-3656ae804eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128634, "uuid": "0c6041d6-f02b-4601-a93b-db6155d2f258", "value": "SecuriteInfo.com.Win64.Evo-gen.92624181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdf3809-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101777, "uuid": "160a5bc3-1eb9-4250-b080-0d4bb3cad404", "comment": "Malware payload (Coper)", "value": "15281d4d68bb7c7e4da61fca74a0d915", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101777, "uuid": "ae6a826a-59d7-4b44-82d7-a8cd8fdac523", "comment": "Malware payload (Coper)", "value": "80448bc12448336f023d890b29ebf2a854f325ad010aa05d2f632870be9c8677", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101777, "uuid": "f4f21e64-b2b5-4ce5-82f2-a9edb90864e8", "comment": "Malware payload (Coper)", "value": "353995c291ab7b884b833de5fa605ec41cd686dd", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101777, "uuid": "25308ced-15f9-420b-99c8-3facc2c2ce6d", "comment": "Malware payload (Coper)", "value": "9b9b776ed11741dba261ea5cbd6c8f135820d54f2ffd814288dd5f5608b7d43c80f0333676426df6296b8a22aa6607bd", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101777, "uuid": "fdfecdd0-be14-41ae-90c0-e8c61a51ba09", "value": "T12445124273D9CB23E4BD1B364DA687E4A6247D90EF0227B72A56730D0E73281CF57A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101777, "uuid": "f97cbff1-fe69-4fe5-9363-b29b52b10e69", "value": "24576:eHW8UxnZvGpsiOfCc2QfpwalQ/w4RSet3czpsWM2bnmFxgi//DWf0nEtr:eHW3veSCy1At30+fFxgiDw0Etr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101777, "uuid": "05349bb2-c4d4-4dd4-99c8-3469b70e4265", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101777, "uuid": "d8f8d70e-c5fd-4a49-a7a0-ad154e2482b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101777, "uuid": "6ffd4bf7-1ed4-4785-ae9f-69a5eebea77c", "value": "aa8017e_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aca317d-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101741, "uuid": "e4593029-d85b-4c51-ba06-9d64e9404cf1", "comment": "Malware payload (Coper)", "value": "72c0816d2fa420c752f916f18d54272c", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101741, "uuid": "d3155be0-0131-48f5-8441-29c3daaac14e", "comment": "Malware payload (Coper)", "value": "809d07b61da605e1eab3aedbc25ed1eba0dfd48f15c8fa7c03d73ab19c95f5ff", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101741, "uuid": "b94667d9-38e3-4faa-b36e-56a4ec7853a7", "comment": "Malware payload (Coper)", "value": "57667062d0470a0a7528c29efb5336ee2e2632dc", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101741, "uuid": "17f4f679-342f-4016-ab41-5a17e079d7d6", "comment": "Malware payload (Coper)", "value": "3f9d5cbae24f72b5e83cc06cf276ee4e6264847d30d99835bd6d68e09742f70cb8e9a7d80302d697dc8da6405bc8397e", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101741, "uuid": "2553c13f-3ed3-4bfb-9b41-f7c5121177b7", "value": "T19E451242B7D98316E4BE6AB40E6A8294A5347E54CF4466AB2E80731C8C727C5CF17F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101741, "uuid": "e935c820-130e-4331-8fc9-abac72d2d64b", "value": "24576:o6nv7a7T1SYj498i5MRCsoLFfqJMua8xPcqn6bBASuMziUU9bp:o2a7oORCPFfqJc8UB9ZU9bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101741, "uuid": "33f565f9-4c37-4aeb-95d1-bca8143748f3", "value": 1172703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101741, "uuid": "744a2d27-8b0f-41bf-aa86-31a00c853c5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101741, "uuid": "809efa44-8af0-4d2c-9d2b-842d610ec897", "value": "13a3e94_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a233e34-00fb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770121416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121416, "uuid": "92ff1c5d-8cd9-41a2-b06f-7612793fc726", "comment": "Malware payload (Mirai)", "value": "36314834efe52a88e0c291e30f7eed37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121416, "uuid": "5dda7efe-05a5-4940-b3c2-ba0d969227a2", "comment": "Malware payload (Mirai)", "value": "80dd7e14890056e8275cd36ec1e86acf6a068d3fa6262faff62b8ba0b5897fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121416, "uuid": "cfb559ad-c8c6-4782-b419-ed2185259ec1", "comment": "Malware payload (Mirai)", "value": "b0fab1f2455245ea9fb487928d52cb511c4a82b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121416, "uuid": "419a1579-4aea-44cf-9c79-04ed4322fa10", "comment": "Malware payload (Mirai)", "value": "35687484ab4d3f4fc2a8e5310e419a3d99f0be41b702ffb51c0425ad5b7e4d2f7578477f005aa873758ee47c22c0ce27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121416, "uuid": "25642667-2f5b-4f8b-8897-3c09e15782b5", "value": "T1E6631782FC81D517CBD4133ABA6E51CE33217399E2DE7207AD126F603ACA91F0D6B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121416, "uuid": "ec9f19c0-32ab-48c3-a3ae-df302078878d", "value": "1536:XxwBk1OrMarWU8XyTBrK1BvRrCeenpmFL:X6y1OrKyN4tzenpmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121416, "uuid": "dc9a995e-6c3c-4e3e-92fb-d65d3ed500ed", "value": 68488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121416, "uuid": "6d7f30ab-f92e-413e-8499-20e6e610b70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121416, "uuid": "4b57fce7-8967-4b02-93a1-dcef1062013e", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3991e989-014b-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770155802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155802, "uuid": "561f7db6-a28b-4fa7-8237-e128d06b13e4", "comment": "Malware payload (GuLoader)", "value": "b385360ae25ad7aa74b77afe49ce2c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155802, "uuid": "b25984d6-618b-4536-aaee-e1707f896f94", "comment": "Malware payload (GuLoader)", "value": "80f0d90ed824fb3229008d61135bbe798b97b93e8b8686173c23db05a4a877a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155802, "uuid": "9ff4b7f9-948d-407c-82a7-077256c01fb7", "comment": "Malware payload (GuLoader)", "value": "4bddc02d76644d4f298771aabd99df9cae83f388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155802, "uuid": "b4eece99-9289-410b-9d85-75cc649cae38", "comment": "Malware payload (GuLoader)", "value": "c1ed3cc2457b812a31fd2449f3aaabc2da6eab59b7f6f30cdc9e7dacb1ec8094a335102ece4b7908b8f20617bd075a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155802, "uuid": "655516cc-8ed0-4b04-b70c-0022195f6c5d", "value": "T1DF94F1113282EA87C9ED05B944BF62EE4E759E7B9582CB47F2C0FB2E7C766C57A15000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155802, "uuid": "dfea2f28-bb27-41ab-b81c-4313b2767c07", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155802, "uuid": "d7ba6be8-4f00-4d36-bcff-19fa8a32ff8e", "value": "6144:fQ606xV8H+lc7SGd7U+lVk8yjijkop/vEJ9xltBVQfjQVBRkzAbTFMIF4tLOIBHL:UecGGRUuk8hjF0xGAKzAbTFMbtiIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770155802, "uuid": "3f8c2fef-2f44-4257-a3e0-04183b7b2eea", "value": 447767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770155802, "uuid": "97883b10-302c-469c-94c4-f88055fa1b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155802, "uuid": "1b3d27ab-78d4-416e-bcd3-c1e24fc41d44", "value": "Purchase Order H6002873doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce366ac-00e2-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770110925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110925, "uuid": "d1706abf-476b-426b-baf7-0812c01fc336", "comment": "Malware payload (Gafgyt)", "value": "6f47114dc7536b724cf983f3ce5d790b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110925, "uuid": "f44646d1-66ae-4f51-89d0-72667fecdd84", "comment": "Malware payload (Gafgyt)", "value": "8134eb3a24a5a9caa15ca0f62a7d2bccd5ab9f45641d29f532b70827bb5854fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110925, "uuid": "8dd6e277-15f6-43de-8988-1dbe47890780", "comment": "Malware payload (Gafgyt)", "value": "8f1385bcec7d1a1d561c41b82d4742675c4795f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110925, "uuid": "3ed609ae-32b8-4dd1-920b-8905750ac302", "comment": "Malware payload (Gafgyt)", "value": "bf5464394bd872d478424076b97affcac9b263872fb4b282ad36558f6071c4c360c468672398d5ae0da305bfdd85edfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110925, "uuid": "6bd155a3-9488-4efa-9d0a-8559ac620cc0", "value": "T115B3AF87B2907ABEF0A49E3FC4135E26A6259F705583173D71BDF9906E3A3503292F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110925, "uuid": "46fdcbee-0827-4fbb-9b49-52bd55a76bee", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzb8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSiUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110925, "uuid": "48c9abc5-ff74-413f-a592-8c81d4948605", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110925, "uuid": "22ce8309-cc0f-4adf-b592-ff65021bc563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110925, "uuid": "3d2cd2bf-c720-49bd-91c1-b730a6fdbd8d", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bd62b9-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136842, "uuid": "69bfcf11-dcdf-42ed-b402-b958c932a368", "comment": "Malware payload (Mirai)", "value": "6d3b02a8b6225bef4b3d5155b3982aa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136842, "uuid": "36a96fc9-9d44-4324-a266-0969b8cdde53", "comment": "Malware payload (Mirai)", "value": "81e025841ea0d9d4a36065459b886dde9de3258d9ba1f80d08527fcefe76eaad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136842, "uuid": "a30f8b6b-c465-401b-a28d-7921d9e191f1", "comment": "Malware payload (Mirai)", "value": "baed44e0ef09e40c630908a8dca0fbea30396f50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136842, "uuid": "dc00721a-9298-4fcf-b56c-20f755cd3e87", "comment": "Malware payload (Mirai)", "value": "72878ee7ced1db038bcddfd3021e1a65ed198bf8555e73f529fd35084d06593804d068e41c4f7c4dd1f15eb8763d1506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136842, "uuid": "dfbb054c-e119-4429-ad3b-0452a71dd7dc", "value": "T191630AC4F5C785F5C81B893860ABF73FCA32E57A80719BADEF8A5E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136842, "uuid": "39409117-bd9a-48b2-8255-bebd536eba57", "value": "1536:99IEpE5HVjXLbHZbVCzpKXwY49cuPbYAeWky81:4EpE5HVjXfHHIKhEcuD9bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136842, "uuid": "6d40590f-5012-48c1-999e-fafab0dc1068", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136842, "uuid": "9b72075b-6ac4-4008-9809-adb91f1db9e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136842, "uuid": "aba3d39d-48c7-46b4-bbc9-dc4dd3182307", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc27a82-00dd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770108806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108806, "uuid": "c5908d62-e5cb-4567-8a30-4a49711917b5", "comment": "Malware payload (Mirai)", "value": "5d7baad0d57f780e9de65a596645f5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108806, "uuid": "f0ef0f51-71cc-42ca-bcfd-b6dfed62e862", "comment": "Malware payload (Mirai)", "value": "81fb17d28dc618d09467ef268e5cfc9452fb46272bdcdf0d4f927cc2f298f3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108806, "uuid": "19b6978e-059e-4ea8-ac52-c6dfb471fe98", "comment": "Malware payload (Mirai)", "value": "03fbeefa18bddd6e1d5a64c4e099e960af43aa4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770108806, "uuid": "161267ed-2201-44cd-b000-ce466db1d062", "comment": "Malware payload (Mirai)", "value": "fcce509637cfedf7c581488c2c3bb65ff51d5f312e8ec437456dc20edb17452ca1efd9334d092b16ba706f64dc440cc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108806, "uuid": "4e4d5aa4-45f4-4f42-80de-87a49e09d3c9", "value": "T156D35B0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108806, "uuid": "dca97e71-9eb9-4cd2-a8ad-a12e4a7938e5", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTV:yssqf/3iPcgrerAl8fEtHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770108806, "uuid": "6e10224f-d01d-4b0d-a55c-c0c90bb1722c", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770108806, "uuid": "702c6e71-ce53-430c-b45a-34132458225f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770108806, "uuid": "a82fd2a7-78da-468d-b069-4655b27acec0", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a092bef2-00fe-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770122904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122904, "uuid": "b40f2ebf-555b-429f-97e1-f727706b8a11", "comment": "Malware payload (Mirai)", "value": "979ac6cd6288de4f614306bd4f38c212", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122904, "uuid": "516f88f8-54be-40c9-be36-ea8ec6f9f414", "comment": "Malware payload (Mirai)", "value": "8261d005bbf69978d5d337c1475603aca6a5e81887b484742dd280582ee30495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122904, "uuid": "f0d8622f-a7eb-4c05-8955-a915525db70f", "comment": "Malware payload (Mirai)", "value": "f107b850e124a14929fb65bead4be62c5fd0e7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122904, "uuid": "aa7592fe-1217-4d97-bf4b-6a33c4e3097d", "comment": "Malware payload (Mirai)", "value": "bcf4ebf48c17e4b3a219501898af402ccf2d8f3008fd773e58aa817e97135114fa9536bdf78be9384f0920bc6ff639e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122904, "uuid": "e04383a5-38ae-4381-b9ed-6371abfe35c1", "value": "T17E73F885FC818D11C9D9137ABA2E11CE33136369F2DEB257DE006F20778A92F0A7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122904, "uuid": "30608718-e2fe-41b5-9c58-863cbafeb97b", "value": "1536:TInnM4IT2ydp/5ucYWyqDRgmKMhCZfeLXbtN/lXzyEI8iRD0AkkFp4:oMH55ulNqDRggpPTwrD0AkkFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770122904, "uuid": "190c8cc4-2697-4183-991c-3222e938c968", "value": 79348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770122904, "uuid": "3cccc5ab-5317-47ad-bcf4-9b88801d2658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122904, "uuid": "3af369d0-c137-4a89-bd42-dad7d75d4ae9", "value": "mao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f59abd-0119-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770134299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134299, "uuid": "cb19105f-f0cb-4b91-8bd8-8bd7b83dbbda", "comment": "Malware payload (Mirai)", "value": "5923ad425b74af2eb8e983e657d0b5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134299, "uuid": "657f4709-094c-44dc-ae78-e22682adfb53", "comment": "Malware payload (Mirai)", "value": "82c37372296a9655d45a98e801669d5b803059f355eeb7342b255e6603933f5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134299, "uuid": "e7e13d62-1b12-4e13-b997-cb1e828035c6", "comment": "Malware payload (Mirai)", "value": "92fa251cf9a5736a0288c2e6daeae76e5500d51e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134299, "uuid": "c62419e6-764a-4aa4-bb86-f707f84e33e7", "comment": "Malware payload (Mirai)", "value": "5179885b8bee496817f50123d762a072c7addd58806ce1a2eb27209c0885c2064829d8206c2e7445fbbe380409573aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134299, "uuid": "00903042-3d11-4253-9281-654560bea44a", "value": "T152D3E026F880CA66DAE1167EF79E1248731307BCE3E572009D188F3537AABA74D35466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134299, "uuid": "03d72dd9-a825-4aa1-9aa3-2edf9f90b83c", "value": "3072:foTTImvmBwlFQMkQemixQCagk568r0eZjTK1zJvSsw:fgIwWwxkQmQr1Fr0gK1d1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134299, "uuid": "90388b50-0a1f-4f44-8133-1c4268222e52", "value": 142184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134299, "uuid": "73adcd41-b45a-4a47-b340-9883ae05555f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134299, "uuid": "3f3ca258-3631-4eb8-b497-99db56180660", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db50a46-0111-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770131059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131059, "uuid": "37120c0b-2f1f-4dcf-bfa9-69af50ad2f5c", "comment": "Malware payload (LummaStealer)", "value": "c68700721230ecd4578dca290a4e176a", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131059, "uuid": "4f0308f9-f83a-4bad-b51d-61cd834c6877", "comment": "Malware payload (LummaStealer)", "value": "82d0a932141757041f855310a818ac577178c7d40cc00acea0c7e503d72862c6", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131059, "uuid": "e8ad8786-c0e4-41a6-ad13-7483b264e4ab", "comment": "Malware payload (LummaStealer)", "value": "a15edac1e533abecb7b6b9062451a9b81ba5ae46", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131059, "uuid": "abf8082b-37d5-4f7d-b83e-4431add4d298", "comment": "Malware payload (LummaStealer)", "value": "9a6add41ff27471058231be5f89c0b07a8663682db3dfadce89917c6b9d6186e2d90091ec263aa29673fbcf827a6b226", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131059, "uuid": "f6d04ac6-3d7e-4da2-91c6-fd59d2451932", "value": "T14E65231A13E11472D1F617B029F3424B5A71F4E24E3A11FF11C589BA8B938E4F97AF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131059, "uuid": "d2da20ee-fcfb-423a-a005-117349c2695f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131059, "uuid": "e4c4a628-c971-4e34-bf77-8fc7acc2ad82", "value": "24576:JLISoMYbOrxRgJT/lavLFmmfeRyj/WsxHuZ1oGjPI1lPtqJ+X/ukRtlnZq+1Ip:26eaEJZavhmtE/tHg6IPI1FtqJ+vJtT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131059, "uuid": "bea5fd79-b59e-47b5-974b-d6f738c1b971", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131059, "uuid": "d7b66d51-bd49-4b12-a46f-0949e4aadd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131059, "uuid": "a41fcb8d-78fc-4962-aaff-c20be1d1e1fd", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca59a68-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143271, "uuid": "18c7f6e4-cb9a-4e23-a60e-f44d8bf5be33", "comment": "Malware payload", "value": "a4ddb169be117a93a9707926be10e975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143271, "uuid": "9cad1cbd-7aaa-45b9-8eca-c0c0ff95232b", "comment": "Malware payload", "value": "82d3246ba05e030a107add2fb2f4638058281325f1ca73606f0beccf7494a25c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143271, "uuid": "d9eacc0f-8405-4e77-95f0-60b3b3f99c90", "comment": "Malware payload", "value": "3c2a0b7d004505faa31591d769a88c3e18b5825d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143271, "uuid": "3e9e271d-a936-4706-84a2-e3a12e9d5d87", "comment": "Malware payload", "value": "64a1c380fab4d754d4ca0515cfef32fe31e78aaf7ba3a00fec8bedb4b9af2bf5153b8e8c3411b1de824149e26cac7dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143271, "uuid": "94318c12-d6c6-4b68-a8d9-ac845a3c0fae", "value": "T1EAC3F142DBE385F6F147813241A7D7DE5B31EF2A4009CB46D3087EA1BC916E7254F68A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143271, "uuid": "05db635c-7ca9-4a9a-a7ae-7bbbd63c9c83", "value": "3072:qa3z5a9yc6D89zIPZD7TzTg62FHbvlmAKDZrGcwWsAAsHNYgfe:qqm1089z+ZDfmHTl7K9lpsjsYgfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143271, "uuid": "2077b6ae-797d-4118-999e-5b92adb7084f", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143271, "uuid": "6a8b39dc-6445-45d2-b352-d0f3400459b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143271, "uuid": "dc054e67-dc60-4f53-8160-a930c8152100", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed9555a-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128645, "uuid": "1a26f791-529c-46fe-be93-f2715ae76571", "comment": "Malware payload", "value": "8b5a669fbc13750af9b6156cf0a8a093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128645, "uuid": "956fbe52-0623-4d7f-9fd8-b2ca8d68e1bc", "comment": "Malware payload", "value": "84022c35babb8e0fb0faf64c5dc2134143d57125aeca8671e4d9e4ffeece8d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128645, "uuid": "dd0f2fc7-0195-44d4-8134-e3e2eed961b6", "comment": "Malware payload", "value": "9baf32935ba48df696aa0060c783f74abd0a4a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128645, "uuid": "3950501e-6ecd-4fcb-9a6a-da6f5bdcb64a", "comment": "Malware payload", "value": "1627dda4ca13ebf0e54a141c138ad7f31fdd09db90296539ad4ce8f5bef83fd8d75d198ed610bf4525f0c91b89eaa6cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128645, "uuid": "7cf0b732-a789-4e2d-aa7f-b9ca036b46ce", "value": "T16B7622A9614C379CC06EC7749433EC54B1BA242E1FF995AAB2DB7BC0379B520C94BB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128645, "uuid": "6e2b507e-02f2-4998-8723-0def37c50eb1", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128645, "uuid": "b74cd0b2-aa9b-4305-a10e-be97aaafcbaa", "value": "196608:f+P5YIv+kJm9xl0Dcn+Enwnqy3eebi75:O1Wl0DCwx3HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128645, "uuid": "88ea9385-8f1c-471a-ae60-0ccdad2bd4cb", "value": 7762432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128645, "uuid": "89d865ef-6883-4598-a66a-0c77841095f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128645, "uuid": "b26f2111-e824-4355-9023-d142b4903747", "value": "SecuriteInfo.com.Win64.Evo-gen.75112627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c963515e-0124-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770139293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139293, "uuid": "81db1588-5902-465f-86d3-8714a5d34ba6", "comment": "Malware payload", "value": "21fcdda547ee851cf6c46447835b7db2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139293, "uuid": "363336b0-f7dc-49a9-a076-5e8c2fb3d41e", "comment": "Malware payload", "value": "84d7077ae5a86be567bf39d94b3cc39a40751958b1692ec17d89d59f97ce3bea", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139293, "uuid": "421a146b-c322-4947-a1df-9d6978ae5548", "comment": "Malware payload", "value": "851137d4767e55df797513c6d06d4f58b9db4eee", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139293, "uuid": "c3919c9f-5ce8-4efe-871c-a4b575ff1c3e", "comment": "Malware payload", "value": "a075c779be213a1a847cc75baa22b132261a069d16f54725678860d545af92fd46ba8143a4ace4d546793a94e3d13bac", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139293, "uuid": "fb8f3830-064c-4a8a-8d7c-3a27b44a4359", "value": "T114B10D09332162699AB52B3CCDC79C1CFF3E903B25610248749C60901FB9DAECBE9F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139293, "uuid": "b4c4c2f4-7e09-4092-95cc-5ab7bc70980c", "value": "96:5838wKxGxebrOY388VYURxw4NQ99hwHg4A39/OlP8l7gdo4LVNfrXkRs:638wKxGxYqY388qURxoDhwHgTxg87gdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139293, "uuid": "cabb3401-776e-4492-93f1-1ceff0ef2aab", "value": 5183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139293, "uuid": "8c7b444d-e42e-4e0c-a3eb-8bb20a985f9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139293, "uuid": "bc1d326b-c28c-4a29-8298-fcb1cd06aa7b", "value": "8263.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2d6704-0127-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140584, "uuid": "70486816-b858-43a7-ac24-3116a8cc4b57", "comment": "Malware payload (ConnectWise)", "value": "46af281d289fd91dde96d37670fc3b06", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140584, "uuid": "151132f3-ff18-4573-b43d-5fc3b50027eb", "comment": "Malware payload (ConnectWise)", "value": "85b7d19ad16bac51df0957a162ddbf6ee29678da61286a4ced3ddad276916e66", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140584, "uuid": "b208f2b4-18d4-4ce2-9abe-065e802617b2", "comment": "Malware payload (ConnectWise)", "value": "bb0077688489bd338b34bb66d61b6f20207eb5a5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140584, "uuid": "07ff608b-5203-497f-9d05-169a94369c72", "comment": "Malware payload (ConnectWise)", "value": "7c42428aa374103bf0651df2a1b01fe068bd78b934b6140c1cd5d80900dba9eb35c9b50f3f1d163518f677be91ee24ec", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140584, "uuid": "ee34eea9-3e9a-4f50-8a49-baaa6f19e834", "value": "T19BD623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140584, "uuid": "de01aa5d-30a4-4c9f-9018-091ed8d70bc8", "value": "196608:wHxcp9ym3nltDUJV/Hxcp9ym37Hxcp9ym3GHxcp9ym35Hxcp9ym3WYHxcp9ym3WI:eGplpsGpFGpUGpLGpWmGpWeGpWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140584, "uuid": "f99223e1-bfed-4d54-abd2-89c7c7f89db7", "value": 13524992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140584, "uuid": "05c061b6-57bf-43e5-a3c8-53eb3f97ee27", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140584, "uuid": "c07aa1a5-4c44-4cd0-a7bd-357c5e013398", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9520eb-0137-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770147353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147353, "uuid": "b6666c5b-7feb-4e68-b247-a0baf037fd13", "comment": "Malware payload", "value": "d8e615b6f613eccc9093f9d054c16897", "object_relation": "md5", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147353, "uuid": "fab46ff9-3d49-46b0-b0ae-6e3bed955ad6", "comment": "Malware payload", "value": "868fe7d34353dd6a8515302b3c993a6d0eb2f3cbdb30c8b083c6852904a1edfa", "object_relation": "sha256", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147353, "uuid": "24febc9b-5409-4f98-b9ea-31a6b997fc4e", "comment": "Malware payload", "value": "49a703b2fc57e4a97bb42e2474c8c5ba5f558299", "object_relation": "sha1", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147353, "uuid": "b800e6aa-2654-418c-9c11-32f0a45684ba", "comment": "Malware payload", "value": "54f740e537c7b3bf52f48a84d231b070aad49ac9b44d780b950e1a050ed36c6d5178fea99123d093fec1a2ceebd09fbe", "object_relation": "sha3-384", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147353, "uuid": "0d64047b-05cd-45d5-ad06-6facdca4890b", "value": "T1DEE5E045E7A4B658FCBE17F984315509C3BBBC02866CC70EDE6430F91FAA3818E156A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147353, "uuid": "f335f191-c8df-49da-9aa2-507d8fd35f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147353, "uuid": "48706f8b-80d1-4b28-8804-5b9965ca8fbb", "value": "49152:X8rYraut1dUHw3SkG570nS4pfVkqgy6r3askqXfd+/9AqYaRQxr40:MrYraudAwBG57K5JEyUaskqXf0FnYeQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147353, "uuid": "f40a2070-d8b2-4715-ab0a-4fc5cf255e0d", "value": 3073024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147353, "uuid": "f91d1e88-d904-4388-81a9-fe7a6b0fe6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147353, "uuid": "c56d098b-300e-4c49-9cee-60a82b8cefea", "value": "868fe7d34353dd6a8515302b3c993a6d0eb2f3cbdb30c8b083c6852904a1edfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe599c7-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770088006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088006, "uuid": "72013e22-b432-482b-94ce-8193d67230ae", "comment": "Malware payload (Stealc)", "value": "6f4b4c68c7559482e0fc2f60fccedf0f", "object_relation": "md5", "Tag": [ { "name": "144-31-166-169", "colour": "#27ED1C", "exportable": true, "hide_tag": false }, { "name": "178-16-53-17", "colour": "#A9137B", "exportable": true, "hide_tag": false }, { "name": "shieldguardvpn-pro", "colour": "#9D27CA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088006, "uuid": "9589ae69-4091-438a-a53b-ee4cd1e641bf", "comment": "Malware payload (Stealc)", "value": "8703b4c09bbbf7a44108c740300e82bb90a0803311fe300584877d6c833f7376", "object_relation": "sha256", "Tag": [ { "name": "144-31-166-169", "colour": "#27ED1C", "exportable": true, "hide_tag": false }, { "name": "178-16-53-17", "colour": "#A9137B", "exportable": true, "hide_tag": false }, { "name": "shieldguardvpn-pro", "colour": "#9D27CA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088006, "uuid": "6e466307-4b14-47be-a4c4-73c6eeb91687", "comment": "Malware payload (Stealc)", "value": "1fb19f7c9f9281329e03c4df9e9b40b4b02f6683", "object_relation": "sha1", "Tag": [ { "name": "144-31-166-169", "colour": "#27ED1C", "exportable": true, "hide_tag": false }, { "name": "178-16-53-17", "colour": "#A9137B", "exportable": true, "hide_tag": false }, { "name": "shieldguardvpn-pro", "colour": "#9D27CA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088006, "uuid": "7644af4c-4965-43b3-a2f4-0f772858c4ea", "comment": "Malware payload (Stealc)", "value": "e130fd3e12b0926a1c5e7d7edd307f07daaff3960a0a83d3c2e3e1d488dd2b4cbd669f86974ce576adb268b397a802fd", "object_relation": "sha3-384", "Tag": [ { "name": "144-31-166-169", "colour": "#27ED1C", "exportable": true, "hide_tag": false }, { "name": "178-16-53-17", "colour": "#A9137B", "exportable": true, "hide_tag": false }, { "name": "shieldguardvpn-pro", "colour": "#9D27CA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088006, "uuid": "131a063d-7ed4-4bb3-9472-83780642f8e1", "value": "T1C56533E15C2CD90448807A6E21BF7D15F3672A7F4A757A33FB9CB5386A4182F8ADC211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088006, "uuid": "0d465d4c-ef71-49b6-a0fa-8344b9aa6de8", "value": "24576:cVz2yQ0ocyjQ6pn/G4zA/EAgG+lJkl0QtSGdB+rbWDKNX0fldCZR:mz2yQtE6pneT/EPZJkq6SGz+rbWKNE9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088006, "uuid": "05fe2c1e-725a-4dd2-9f98-e02770224464", "value": 1517943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088006, "uuid": "08ecfd10-ad26-43ff-9c90-ccd460957808", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088006, "uuid": "3e89f840-c222-4ae9-9af0-eb1c36d2aeaf", "value": "stable.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ef54fc-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128627, "uuid": "9f628aad-b18f-4241-9ee4-a6116d6efc1d", "comment": "Malware payload", "value": "6088306e37b569a12d4bb076675c4896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128627, "uuid": "c9ebf051-8dbb-4127-b9c6-13e23836c1a7", "comment": "Malware payload", "value": "879f08991711abfa8994c4a05992a897d758d38756a8918674d84ccb8ca1a49d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128627, "uuid": "3c9959a6-4830-494f-8dea-70910ba5cdb2", "comment": "Malware payload", "value": "eab2d9403f2710b228e171d0a9707460a906ca75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128627, "uuid": "80c2b913-3588-45e1-a28b-c6d9ee34540a", "comment": "Malware payload", "value": "7dd04865dbc264ad1e0fc32175d78e7ba9adf8b32820b9b15c0309f10a1740b85dc2750d60bcb3dd4621c536f1c3d99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128627, "uuid": "2bd8e44b-96f0-4871-973d-1c99c53523d3", "value": "T17B7623BA604D3398C01ECB358437FC44B1BA502E19F9897B76EFBAD07B56410D94AF4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128627, "uuid": "34d94d57-125f-4a56-b06d-962950c9bd33", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128627, "uuid": "6cb7d65d-0ad6-4162-88da-98e96d8e469e", "value": "196608:mXWhyDPqbH/r8L2YdCyEjKEc1g86SOZSXycJIySAuR:sQbHz+CyEj8j6LQcyXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128627, "uuid": "388ed615-583d-4ae6-886a-2ae768c8614e", "value": 7789568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128627, "uuid": "902adb13-fcf1-46bb-9e24-e8e789b76740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128627, "uuid": "8743f6ae-5ae2-4f74-91eb-356617395858", "value": "SecuriteInfo.com.Win64.Evo-gen.18596335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb94604-011e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770136559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136559, "uuid": "346ecb20-208d-4528-a85d-6d406391a75d", "comment": "Malware payload", "value": "a106a25d2ff63b16fb1fe9d7283d343e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136559, "uuid": "42493a40-87e4-4fb9-b9c5-2ca709d6431f", "comment": "Malware payload", "value": "87c3f5275dabdf772a8c9bf93de3434a8874fc4d479631744b87fd470aa23208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136559, "uuid": "1e4c7ca8-4144-4a68-a212-ac4ebb2f3ba7", "comment": "Malware payload", "value": "a6355e71973789b00bac53f9fb444964a20c3188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136559, "uuid": "97ec6266-477a-452f-aa12-aa3a2b00f21f", "comment": "Malware payload", "value": "97a36b07c84bfb62e785cdfc4650f1bff8d81440d020ab27f99b0c1861caedb24ef67115ae2845efb21e6e69f6a45268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136559, "uuid": "a79b79ee-5429-425e-abf9-7c779b112b09", "value": "T118A41A253FA48E44D580257ECA7E2A09CB16E0F125027347770AF7A25D059EEEE2D3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136559, "uuid": "47729040-0545-4aae-b5b0-7bd9050ce7de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136559, "uuid": "83d0af96-8d6f-4a06-828a-1c5e8d7e73fb", "value": "6144:9PYnrPPMpKd3BpceHwODF3GwfL0iTHU81pcC79QjK3zDkLCMbe3yflnjeUbPYhU4:5GrPPMpI2eHwMnoigbemxeUA1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136559, "uuid": "c9573934-2549-4bf9-b090-ee0c19dee14e", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136559, "uuid": "57191a6d-dc91-4afe-89bb-9d05b44b2c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136559, "uuid": "9760a7d9-2673-49f3-9076-59c8f277dd9a", "value": "87c3f5275dabdf772a8c9bf93de3434a8874fc4d479631744b87fd470aa23208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da156be1-0138-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770147911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147911, "uuid": "604ace68-b1cc-49ed-a946-cd82226b423a", "comment": "Malware payload (SantaStealer)", "value": "1714f39fd092962f71185ed2b2ed6f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147911, "uuid": "5dbb6a4a-714d-4a28-ab44-ce0870ee7efd", "comment": "Malware payload (SantaStealer)", "value": "88a6b0a90955921c56942e09cd9a011f48e65d565463395180269f3a9f460c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147911, "uuid": "ca74a2f8-e345-4a05-9494-513afa8686d6", "comment": "Malware payload (SantaStealer)", "value": "af102d3fc1610e2212471668c8b0273094659c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147911, "uuid": "6bc7883e-69b4-415d-a9a9-1ca7fdc7798e", "comment": "Malware payload (SantaStealer)", "value": "91d4b5807ae2e03b91418fa1676c7320c64b83c230ed32cd4a8d4d20b4dafd16e619d32c19dbd1ad0b3d5573a446f78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147911, "uuid": "c0cd8cc8-6758-456f-8e89-2f8c32b520ff", "value": "T120E52362FB43B6D4C5DAC4B04D9605B3155AAC2306131B7BF5B8B3261EE572A3E32837", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147911, "uuid": "628af9c5-ae60-4b23-ba8b-deb4c3d23c9b", "value": "b29f7bc6c3cf27ba78272829148a5262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147911, "uuid": "6e97dcf2-e08a-44e6-a896-6836927cdf9d", "value": "98304:X8xwVdg89u4xv3KS1YARdGdCdJNQt4qCLFPlAq:X5DSSmAGdCrOt4q6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147911, "uuid": "2bd66cfb-605c-44aa-a75b-9aabd7081ab9", "value": 3286657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147911, "uuid": "dc9f97cc-cff3-4c0c-8d57-2a68655572fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147911, "uuid": "28a53063-0f84-4725-9aa1-4b38ec7fa6af", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f8e3f6-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101787, "uuid": "6df74d7e-bfec-4fe3-a2c6-b0bc6fbd1c18", "comment": "Malware payload (Coper)", "value": "a2e55f7f86d0c224ddc2b0ce0bae8bea", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101787, "uuid": "036068f0-7eda-4bc8-bfb4-9b7676cab1df", "comment": "Malware payload (Coper)", "value": "88d598aa4b9272f14913d42937586992d0a5e35e656ca315e33ecaa81628f04c", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101787, "uuid": "ead9ffd8-e8e0-40af-9239-34032f51ca21", "comment": "Malware payload (Coper)", "value": "9a593ff5b64ebb92a40831f1a389ea54d6a78d4e", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101787, "uuid": "d46b88b2-5bb0-48dd-9cea-e7f5d63b49db", "comment": "Malware payload (Coper)", "value": "da939e5c29eebb760aebcea335d69ea86493d880cf7d78e4275f0afa3d6a4f35dad8644c26f60b682b54c121ce40b6ed", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101787, "uuid": "75cb9cb2-3693-4826-bf83-cffc4e3c31be", "value": "T1C5451242B799CA13E4FEAA348C57D2E1E631BE50CF12925B6A41730D0A733C59E12B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101787, "uuid": "54ed6350-8026-46e0-85ab-10b5180fc0ed", "value": "24576:Gein+UweAK1WQIIq2fUooxM0DD/BiPIvwEilSRpb8YUax:GepeAgIIqdDEGTb8Lax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101787, "uuid": "f5cc7b24-555c-4b56-92b4-103e9c933bdc", "value": 1176807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101787, "uuid": "c1356d09-0e08-48b7-a6f5-bd1754cb56c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101787, "uuid": "a018a5de-68b3-4270-825c-2de9e2e90f66", "value": "cc11763_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a02f7a-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128625, "uuid": "4c75b107-bde3-4c8c-b2c9-9699917d7d05", "comment": "Malware payload", "value": "a5b1de69111ddeb1b1c1192990f2b053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128625, "uuid": "69d64be8-28ed-4af3-bd71-193b49d30a3e", "comment": "Malware payload", "value": "88ede502df2c1f7eb2d26f0452225a61c64f1eafabcbbb3a03aa3086fa44afa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128625, "uuid": "b0038a59-7940-44ce-96f6-81ba76683ee6", "comment": "Malware payload", "value": "03409e49fec13f9e5ee9d726a536165d5209fcd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128625, "uuid": "0a8aa909-1af6-4257-ae41-26daf2ce7645", "comment": "Malware payload", "value": "25271077b036c93a709d0e062d5040eef9ffb94ca426520c12150e0c5284de6d9531386caa532359d28c7745cbec8c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128625, "uuid": "caabd8f3-b1a6-42b1-a975-475a98549a09", "value": "T1D97623AE204D33A8C01AC7795033F905B1FA155E4DE8D6EA77DFA7C037AA810D946F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128625, "uuid": "1f22dd97-39e9-4e4f-991e-1aaf9f289f73", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128625, "uuid": "3cbd3af1-5399-414f-a4ec-0fb8d971cd42", "value": "196608:r0nGdc8A6kDY45sGieZdeaCKoa0V9+sQTnNaN5G9Md:4GdLsNpCDusQZaHG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128625, "uuid": "b59751ad-3c7a-4151-963c-78a3e50013c3", "value": 7778304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128625, "uuid": "7772ec5e-51ac-4828-8079-cbbd1569b377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128625, "uuid": "7258a1f6-82af-4c5e-a9dc-8a244bb41302", "value": "SecuriteInfo.com.Win64.Evo-gen.26767336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca7eac5-00c9-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770100295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100295, "uuid": "e0499ec0-6d13-4798-9730-10e4c8ee1d39", "comment": "Malware payload (AsyncRAT)", "value": "0f783607986ccda8fb9e39c1136f8012", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100295, "uuid": "7d1c90fb-4c0b-46fd-9cda-14deaeef9522", "comment": "Malware payload (AsyncRAT)", "value": "88f20e70c092cf96d04211015985c6e89eec8856839463f6c46acac669ded043", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100295, "uuid": "4fd50af0-38e8-4b1a-a093-a71ce40d0770", "comment": "Malware payload (AsyncRAT)", "value": "861d3dcfb2d2d0acd87f8f680fc46cf453d0de99", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100295, "uuid": "5b0b46fb-e972-47d9-b19e-91f744520d24", "comment": "Malware payload (AsyncRAT)", "value": "d2a9ecedc047b5e18bcbdff12dd5ab50b401f8a18b7ad8b42764ad33a91b58fa905ba17568608fa224410fb8b287f2e6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100295, "uuid": "6e0c91be-6fcf-423c-9b02-eacbade56e81", "value": "T1B0535B002788C925E2BD4AB4BCF2950146B5D6772112DB5E7CC414DBABAEFC64A132FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100295, "uuid": "8a53c47d-19ea-4ef3-a0aa-4a71e05d578c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100295, "uuid": "41714db3-4983-487d-813d-04a728d311d4", "value": "768:eNpSavt7iPbVoiU9JSaEtH1wg5SNqG1+LSCv7mqbGnJpwH1oFGWd8GSMVc6KN:eptUW3aHPGZGbb+waGtGSMVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770100295, "uuid": "ca97c4cb-d2bb-49e2-8f9b-816ae4aec404", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770100295, "uuid": "14751479-b830-4e8a-b00b-f0b5f68fd191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100295, "uuid": "18044834-f3c2-4377-8223-b742b72057e8", "value": "VantaOdds Engine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221994b9-00e7-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770112813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112813, "uuid": "b9122e44-aabc-4315-9766-5dbf4514483b", "comment": "Malware payload (Vidar)", "value": "7d065f8975ea0be4aedafd34e462a709", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112813, "uuid": "cfb88dcb-a860-42d6-b4dc-f34eee80ad24", "comment": "Malware payload (Vidar)", "value": "89a3e7122e3e3f5eaaca43422656a743f5df566711373cb3d77f1ef5b4c4ec43", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112813, "uuid": "9a836a63-9601-4307-96af-930209def80a", "comment": "Malware payload (Vidar)", "value": "52c3b2c897075c12881178767a6208968d66941b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112813, "uuid": "d89896a6-0b36-4ba6-9b86-a01cd65d8c12", "comment": "Malware payload (Vidar)", "value": "44522643e21d204dfa84bd373dbbe058457119162bf02253da9ebe2b747c80344d0fc16ac719e0cf73d4b3983630b915", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112813, "uuid": "487f79f5-9b44-4012-a089-0cbf3e73c50a", "value": "T19186297F729592A8C25D853FC0A7CF40F5F372761B33C6E7129007A98A4A8D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112813, "uuid": "cffbc447-09f3-40bc-a89d-8f4a13f63f2a", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112813, "uuid": "f9c2d9cb-c391-444d-a5a8-7443b70050d8", "value": "49152:QNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg4Q49dpjMUQwqu6Zz:Qz7Vp70Q49d/qHa7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770112813, "uuid": "fe468738-03ac-4bb1-a11c-16ec14cc1278", "value": 8499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770112813, "uuid": "9669a683-03b3-4dee-88b3-b97394c80651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112813, "uuid": "4a06a2e6-a419-46ca-b7ed-4a3f462607ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7ae757-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770151274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151274, "uuid": "49d80717-9ebd-4600-b480-536d418ed0a4", "comment": "Malware payload (SimpleHelp)", "value": "8369b04282fec95904fba77f7464bcfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151274, "uuid": "06e023f6-19e2-4f7e-849a-756635076fbe", "comment": "Malware payload (SimpleHelp)", "value": "8a9e73497774551a87efdc5fcbcdb7aeef750b6e182746e0f1e64c9d04ddf07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151274, "uuid": "9dd85d7d-2c88-480c-942e-d1c294d12bdd", "comment": "Malware payload (SimpleHelp)", "value": "a69571c704be90d9efef25c7b7e0d8cc02b30d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151274, "uuid": "7fb787c9-6c4a-4bef-98d4-92c8d6210b00", "comment": "Malware payload (SimpleHelp)", "value": "2358e1c43f84085bc784c72cecff7fdcc3463b4409eb19e46e482a67b2f810f3ba4e97df7b4174648d162db27e6e5bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151274, "uuid": "29c20166-3dcc-46f3-bdd1-ad9b2caadedb", "value": "T14B373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012727F1C6D28B213D0542EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151274, "uuid": "0413d88e-9c48-41a2-82e4-d97d75a5e58e", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151274, "uuid": "7ea40779-0002-48c3-943b-31a696983c83", "value": "393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3v:+tobo/qEVooAZNKYeJPeTe9B5JW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151274, "uuid": "76e0f177-5e4a-4344-9b00-28fd73d296bb", "value": 22855344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151274, "uuid": "5a93de07-0749-4516-944c-d085a301ce8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151274, "uuid": "bc8cdec4-bd6a-4942-a486-6590a5dbb073", "value": "eStatement_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e477b7-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143505, "uuid": "1309df24-562c-41c0-8303-ad9b66deb835", "comment": "Malware payload", "value": "1a550a93935cb87cd702db3e826e791e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143505, "uuid": "eaf6a306-df27-4550-83e6-12e925dc30c9", "comment": "Malware payload", "value": "8b61a098b5c4e86476100caca40bd5520b6dc295c53f1fc187de4e46c741bf4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143505, "uuid": "00746c55-2438-42fd-b67c-9bac25d678aa", "comment": "Malware payload", "value": "cba1a25835a3df5de04eb3a5415841fbefcc5725", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143505, "uuid": "5d60e026-b23a-4583-9828-89df9cb4b5ec", "comment": "Malware payload", "value": "f09a7dbc9fc700844ba748124a28fbeb4d93df2fe298f2b1d7c7b0ae99d8d4e47595647b655eb5550f2e3f61b6245c94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143505, "uuid": "f3260d58-5310-43d3-83b8-6a9b26188dad", "value": "T184D02BA73AD0FBD5C4B8EECD66524F29309D83B8F37DCB5C80C00049C422864305AF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143505, "uuid": "2b95be66-a1af-4734-95a6-8308592d6517", "value": "6:S7dlHOaGLKiZ4GVdT8bxklIMnDPdT8cFWWw:udlHOaGLK+4GVdT86IyDPdT8cFWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143505, "uuid": "2a0b05e5-8ed9-4b75-a132-15651e50f2d9", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143505, "uuid": "15252e96-3438-4466-96ec-5867ba7ca780", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143505, "uuid": "229cb546-d646-4efb-8c00-3d1978064ef4", "value": "fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23f7d7d-0149-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770155226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155226, "uuid": "f6d7d284-1c22-4210-a64d-3f055d4a5d03", "comment": "Malware payload", "value": "23dc6671d7ae70f2aacc29cff6ca0b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155226, "uuid": "3126b686-b277-4439-989a-87218c34fecf", "comment": "Malware payload", "value": "8bba91fb8bc5629d55b2068e548843cea582365e712213533647e2e79525c4fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155226, "uuid": "fedf1bf5-d35c-4e8e-bdf6-62268bb18f7a", "comment": "Malware payload", "value": "5e0f6f4cfd6678cbb447001451913f519912c7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770155226, "uuid": "6f90058b-d956-4e36-bf65-945dcf29e42d", "comment": "Malware payload", "value": "b0bbb6babb77527d4a77de0e4aa8ec3487bf1c70b9b6f3eb113a9be55c0f74756faadf46e20e8591c1d4b8b12a4c2b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155226, "uuid": "1f46abf3-f2e9-4a16-9f6f-b4948b3dccd1", "value": "T17F46E001B3D699B6D07F1638D87952A56774BC049312CBAF5394BD792E32BC08E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155226, "uuid": "9eaee74d-c1d6-4a78-8e16-0223e25b764f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155226, "uuid": "32a14dd2-9fe4-474c-a1aa-270518720460", "value": "98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770155226, "uuid": "9797c379-cef8-4a6e-9088-741a41fdf69a", "value": 5714352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770155226, "uuid": "95fb89fb-0235-4c62-ab6a-912b28f307e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770155226, "uuid": "893b1f7d-9fc2-4eef-8b25-688a0b4d6c39", "value": "SSA_Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f55512-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143265, "uuid": "ae129948-db3c-49d8-8494-9a6f8003c88d", "comment": "Malware payload", "value": "48632d04ec107434b5f751f845266b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143265, "uuid": "7e660720-1ad6-4a2b-9e1a-9fe9ede98a32", "comment": "Malware payload", "value": "8c0c35f322f397f04d9930a644e8852ec707688306118a2995e9bda098b93302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143265, "uuid": "5c514368-05dd-4b4a-8716-a23b4ddbeeaa", "comment": "Malware payload", "value": "a26d09714b945f6507977639377dc3689e2eb7c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143265, "uuid": "b099f2f6-37cd-49aa-b6d0-faeb506994c1", "comment": "Malware payload", "value": "a5f278d853a735222e683ea2707179d11026bb89c804792f3658be2bd17e59e8fad93dcf3e0e5b56ed5a01e4a460adaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143265, "uuid": "0ff2e673-9f9f-4193-bbad-796eeb0e432a", "value": "T16D04F18373114F72C2B6463106FB8692BBEB22D24BC29246B76DCD406B6974C582FFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143265, "uuid": "805cc3ac-dd77-4de1-b0ef-eb976d82379d", "value": "3072:kgfKVeEOH4lcgjxcJUBGmfgcb/BDYPk8hzvK6+usTeoCPYu7G:kbNR1aJUBxIcLBMPkQh+usTenAoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143265, "uuid": "5ee91d82-33cf-43a1-a71b-e585d86289e1", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143265, "uuid": "6144262c-f133-46dd-9d36-27a910d31e14", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143265, "uuid": "f4fb20cd-73ea-4804-beab-9ae45e12ba6c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77928901-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101789, "uuid": "cf5ce729-dcba-48d1-b787-60191e7b925c", "comment": "Malware payload (Coper)", "value": "695fdfba6327e24727064e31db2d847a", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101789, "uuid": "a9874f04-a142-424a-932f-316812cd9966", "comment": "Malware payload (Coper)", "value": "8c7dbb2080f2b862026b2d755cb01c4b484c357c7aa5e053398ee6fe497c6374", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101789, "uuid": "8b896472-d4bb-4af9-85d4-f2c9c079e690", "comment": "Malware payload (Coper)", "value": "fe533aace83904cecbc74af2bec62cc8c051c9f1", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101789, "uuid": "7f03a60f-c7ad-4733-95eb-271c884f441a", "comment": "Malware payload (Coper)", "value": "50dae5d5440600e6a563e384ce4b5bde8a9845fb75085954fdd329986138979c5a67137f054109871c663389023eac10", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101789, "uuid": "d09f4f71-7361-47eb-b0ec-831996637ac1", "value": "T1D9451282B3988613F4BB6B784F4683A096217D50EF054393BA42B71C1E727C9DF75B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101789, "uuid": "e1bdc0e1-3f40-40c3-b297-b82f5a885141", "value": "24576:uBdho0NZE8zLQhSp0DI02iXLGJH/tx8ENnaQAY7bA6JehmFJ/xh1zn9lc0Uco:uB3l/US10LqdtxUfYcmFJ/xh1xlc/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101789, "uuid": "c3694639-4768-44c3-8d95-e336f34246bc", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101789, "uuid": "81191020-92aa-4ba7-bf2b-73b458aa4bf8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101789, "uuid": "81516404-71eb-4197-9a46-18c4ea5ad28c", "value": "d800fb8_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077941e3-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143263, "uuid": "cf1d3a9f-73f8-4e95-9571-39e4fffa13bc", "comment": "Malware payload", "value": "d5d67ad64586e47c344438a6861abfc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143263, "uuid": "fccb0bb5-2c0f-4f8e-ba63-4f3ba61fa59a", "comment": "Malware payload", "value": "8d3b88141abffbc4edee2805a744507d32758915d8b3c0fcf18efd7e3607ecc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143263, "uuid": "eed6519a-e78f-4f79-b95c-b37601053169", "comment": "Malware payload", "value": "65a2d269ace7fd1e2d4f18de5251c0e440fffafc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143263, "uuid": "59ed252b-92bc-4563-a147-af143db399b7", "comment": "Malware payload", "value": "765ebc1f4fd473596887d1030dc9a8b80cbba835dfe82d19cfc04578394f8a765845a156596ec4f07dd8c0a0f2802a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143263, "uuid": "5d0a4c3a-2ecc-4a39-9b26-d657ce01dc6e", "value": "T131D3E029F4C0DB62CAD52ABEFA5D161D77230374D3D57209DD148B2077EA92B4F3A881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143263, "uuid": "59c10433-5bd3-45a2-b0ac-856cc0782db2", "value": "3072:7D0ownSrawpxdFIcv0c2JSB40cHMRyXc7VyrCmmW8:7xwSuwzdF5vl6SB4sRVyIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143263, "uuid": "210684b1-7c24-4ea3-9146-efe841edab8a", "value": 142049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143263, "uuid": "36dfed10-8d67-4a06-a75b-2a6dc97b52b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143263, "uuid": "d35b2b49-90da-46bc-a48c-a2cf294d6ae9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f9444c-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136839, "uuid": "4646f73f-3d36-44de-9f77-758a37b32bfd", "comment": "Malware payload (Mirai)", "value": "5e4a09a3353eb2ea14f575d7942c46d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136839, "uuid": "fcfe85f7-31be-4bd0-9a2f-95d1ceab0f1d", "comment": "Malware payload (Mirai)", "value": "8d857de255942fe77dfad99c2761617d24c26cb4dac25b737421cda65a4220fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136839, "uuid": "dcb4cae0-3c1d-4e85-9401-e7b5e86d862c", "comment": "Malware payload (Mirai)", "value": "7fd20f123ef1d90410a78a62bb4fab59cfb677ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136839, "uuid": "49793ff0-c7e0-4638-94ee-8b86bb1e5e7f", "comment": "Malware payload (Mirai)", "value": "96a2d87c57ab01ccc8cca8beac1ff7ecef98a1fb4acf3a7a2abb2d0017fcf92805e22ace9ff3a9a08b6c31be84069b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136839, "uuid": "59f9bf21-1140-4c5e-be2e-5f18fcd8df7a", "value": "T133535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185A94FD74A4235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136839, "uuid": "8f80a7aa-31b2-45ca-9cd3-09754c982f6d", "value": "1536:fp3/tcoPzVx57hown8n4SVsgEZJB4kv9IZK:ptcEVD1own21VXSJB39IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136839, "uuid": "44a9b15e-ba65-4c13-8be1-8d3db47b0e7e", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136839, "uuid": "7041e9fa-f2a6-4c5d-9c4a-88852dd73523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136839, "uuid": "e9ce9593-2550-4af5-8792-e1d74f46c39f", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d865ba06-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134164, "uuid": "c62cf4a1-8618-49a9-a0a6-f736d0f30c6d", "comment": "Malware payload", "value": "1ebf27d290b75d8da0b59ccef7abbe79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134164, "uuid": "bf466777-a655-488a-8852-8d636bee12e0", "comment": "Malware payload", "value": "8da52a5745aa5e9452637b577dcdaf345dab4494d0ed6938969afce28a03aeaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134164, "uuid": "e9a4f3aa-aaf0-4c57-993a-519ac12883e4", "comment": "Malware payload", "value": "2d6f917167550817cf65a1ccc3e132a136238cb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134164, "uuid": "9de18982-bb0d-4ce6-846a-88b226bd1308", "comment": "Malware payload", "value": "b06967987e5dc35782e6d49cae4639863ea35a5c8e7df26c885651abf1b379772b0bad1787a95de0f85aff75d5a69aae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134164, "uuid": "a846a972-6dc7-44d8-9287-b4eb6aea670b", "value": "T11FC30183F9C261F1E08B9177444EABCF6B30DE165408DF96F7043B94EC84759652FAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134164, "uuid": "8e392ef2-e6f5-4e75-9c54-bc8ac8a0be4b", "value": "3072:qa3z5a9yc6Dv2tzM/zVGa3t1hb4LjS5m66h0k048UQeE:qqm10v8qzkaX2Lm5m6FeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134164, "uuid": "4712e178-f7ed-47d1-b5b6-f9ee7176e2d5", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134164, "uuid": "28d7cc38-f0ad-4849-8d41-3377d45230f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134164, "uuid": "f8f748d4-9d34-4bde-9041-5c6d9f69099a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0b25b6-0116-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770133367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133367, "uuid": "794c0ecb-6f45-4a6d-be1b-3602533c30a5", "comment": "Malware payload (XWorm)", "value": "d6ee9d30acd1034104359b4ece529245", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133367, "uuid": "2460e0e7-0710-49c4-a652-8a2373512d5d", "comment": "Malware payload (XWorm)", "value": "8dae5bd66848657512de7b2d4cc9dc1f9aa24c7b57225566cc445e987c3338e5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133367, "uuid": "93b16ac4-4ed3-4f41-a99a-b96f991fef07", "comment": "Malware payload (XWorm)", "value": "62486d14e738790ebc9877a64a1d1123c762c593", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770133367, "uuid": "bac4deac-fa86-41b2-b777-5dbfb285baff", "comment": "Malware payload (XWorm)", "value": "98ba565bf1340d58240e2b612ca00d6c78b23aa6f97ec82ac77b8889ecc14a3e0da4b7a68c9440b6785c2eaf5bb62336", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133367, "uuid": "143c9290-59e7-4d7b-b10b-3cf5fd8016d6", "value": "T134F198BCC2BDBCC4431E374074D2DDCE12929A078EB62A54E75C1D686BB4259BBF9148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133367, "uuid": "7b700e52-23a5-48de-b2a1-3368bab026ff", "value": "192:QQMmyJLJO4+UNnQTuDRdJVY6P+kQwycKkEaDclaquc9mYESqO:QQMmyJtO+n11VYA+kQwrnzcZuMniO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770133367, "uuid": "4f867e7d-374c-48a6-9826-29935a8387fd", "value": 7601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770133367, "uuid": "1d5226e2-2fb0-42b3-94b3-764fa466e7f1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770133367, "uuid": "be5b808e-d999-4414-bc60-fd7208859914", "value": "awb_bl_shipping_customs_tax_clearance_instructions_03_02_2026_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7a1d58-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770143482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143482, "uuid": "8b28bdb6-2c70-4e78-b1dc-5eed0bf3dd17", "comment": "Malware payload (Mirai)", "value": "9b5e14bc189e5d09358d60dc7f0124a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143482, "uuid": "8cd84d2f-786c-4ad2-81f4-8d0e636010d0", "comment": "Malware payload (Mirai)", "value": "8e2bc66e379347e16c0fb5d3c3ba30cbde14629d3f96a233b888fc8821663fcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143482, "uuid": "aef16cd4-121d-421f-b0e6-01e856f0c34a", "comment": "Malware payload (Mirai)", "value": "40b5204ac15a58b94392259186eeaf95dc0955b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143482, "uuid": "f04f05e1-f6c3-4a74-a0a2-ab1149e93607", "comment": "Malware payload (Mirai)", "value": "e363fea5370c6b8afd85d7b27ef7a8485d36eb077374e3cc452946ef5ce739803d38a7767c3fc9913eddd47a36f77abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143482, "uuid": "b267f8c0-ecda-4892-9683-2086dd2a7dfe", "value": "T1E6D3C516BB618EB7DC1FDE3309AA4512108D909612E97F6FB2B4DA6CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143482, "uuid": "8632a4d0-09b0-451b-98cf-426d7d2d0f13", "value": "1536:KV39eTgFSi9PJ7iWs2uWMqZc93AQY7cbEEeLr/wnOeGixToDmJa3ZamkfDIFsF5g:KV3z+WVUCCEtwOeGCSamkrIFsFswr+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143482, "uuid": "1af462a7-c459-40a1-afa1-b1923d6bf17a", "value": 137939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143482, "uuid": "31c6535f-30e0-4008-9b01-ef3c555b8507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143482, "uuid": "36de1974-5997-4010-9bd4-23e67288cf62", "value": "pXdN91.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143d540b-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128681, "uuid": "1cdd65ec-8422-45d7-ae65-124b027bd905", "comment": "Malware payload", "value": "f6176be8a2bb5abc901040e69a87d43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128681, "uuid": "d5994d0f-5a19-4fbd-a278-3b8b7a39c522", "comment": "Malware payload", "value": "8e8f2d833a83db1dbc9e699b9e719993603e39e069b97d19763b9895a1bb035e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128681, "uuid": "70e4b7be-05c1-4561-a660-ceb306f16774", "comment": "Malware payload", "value": "1c8a7eabc143290760c93e160a108f97c0abe261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128681, "uuid": "5e946119-0d86-4c3c-a23e-2773116ee137", "comment": "Malware payload", "value": "dd2ea044080c2c2f3c57dcded71615a07ea31bbfb6593fb2f35aedc97644b429fe0ee7f13574ed63631803d31aa37346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128681, "uuid": "7ae3a2a8-f98b-439c-a55d-b78a3a5a8c40", "value": "T1C37623B9214D33ECC01E8F715523FC85B2BA561E4AF885AAB6CB77C07B87160C946F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128681, "uuid": "d8b306c3-3b78-4df3-9629-f62729d4bf25", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128681, "uuid": "13a28cc6-62e7-4cf0-a447-dd1185c20bc7", "value": "196608:NXHQJ0JJyPAvVhCGvQx0Cbp9nW9YedZIw+:NXMyLvbCGsns9Vdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128681, "uuid": "bc5081cc-eeca-4d1c-be0a-a1766d03947f", "value": 7778816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128681, "uuid": "df89ccfc-4d25-40ed-844c-a1b771cd5c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128681, "uuid": "406a276d-35a6-40bd-a66f-bb3bfa8e3dd3", "value": "SecuriteInfo.com.Win64.Evo-gen.17734514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06543f1a-00b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770093010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093010, "uuid": "e5f0656c-370a-4db0-a92c-9de446769731", "comment": "Malware payload (Formbook)", "value": "c7dcf55f6ec9f2d6044ce631e17f11d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093010, "uuid": "4290304a-d42c-4074-82d4-d2bfe4a495d2", "comment": "Malware payload (Formbook)", "value": "8f851a6b9ed143766d3fd2cb899de35b57259a422fdf9e81a8213b7198f2018e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093010, "uuid": "6aef3fac-e594-4b80-b441-dc831943f6c8", "comment": "Malware payload (Formbook)", "value": "25fc50e825a5c17941b6b1051cfd2e5a0a04410a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770093010, "uuid": "68370eae-5573-4f67-bd3f-f11cc8f7c0e0", "comment": "Malware payload (Formbook)", "value": "915dd65ff1ce14c0b016014901118b8d4b0000cadb022529fbd46c41252e69244114e1269d7c7d617970dd25cab903b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093010, "uuid": "133b916e-29bd-4c2c-bbd2-c96f5b910764", "value": "T1ED35015623989E02C6BA03F51421E23CC3B19D9B7570C384BEDDA9D77B66B011B0ABD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093010, "uuid": "4301c776-2eb0-4eb0-9738-a186c52f3623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093010, "uuid": "ac6ebb9c-0695-46d3-8fd7-5b7956da689f", "value": "24576:+zZN9u1HddYItzYZ4225WbcyfYOQnecq4JphAH/S4ilkwPkO1e:+yUZfIWbeOQnjJXAfSRlkwPhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770093010, "uuid": "16672a2e-b222-43bb-a8d3-a20e8895eb38", "value": 1128968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770093010, "uuid": "bc8c908e-3835-4098-accb-85e86cb526b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770093010, "uuid": "9dfd1d59-dbb6-4e8e-a0ec-85320a40c2f7", "value": "rPaymentCopy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25477ced-0124-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770139018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139018, "uuid": "9f4182f6-b955-40a9-b706-a68d57afd5c9", "comment": "Malware payload", "value": "f1f3a408d290ab9335fa50f358684ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139018, "uuid": "1c72da12-1a2f-43db-af9f-06b5bb4d2b95", "comment": "Malware payload", "value": "8fdc1e6f9d9cd263e1be895c63677d32fc1c3817b23ae8365d71482eb5468809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139018, "uuid": "825d6e6d-3370-441b-a4e0-bfe3d89c4d16", "comment": "Malware payload", "value": "40e6fb173c9918044cc5e84005c0a1e1acea35fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139018, "uuid": "afa2bbc2-0f40-428a-bc62-cf12fe6a768b", "comment": "Malware payload", "value": "1ca823a33c993b79a7b0a763d4269cc2eb00303f5f83095d2fde368ca87abd31cf3f9146729003a9b3ce7ec5592abee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139018, "uuid": "2d1f38af-bea1-46e6-a515-ac16faf70a2d", "value": "T19A03F685B8858A06C6D0237BFE0E83DE3B2673DCE2DE7303DD152F51379A92A096B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139018, "uuid": "ace30c00-dad6-4c20-b914-a3291ef6685f", "value": "768:i29DHoNLgoaYEH7a9q5nWg1dQ7Q527QnbepWdQjwpKoz5QY3lWfh5i:nwgYEHQkdWQ5kWQ0pKotD1y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139018, "uuid": "989da77c-2361-4e04-9c5a-40bfc9e29345", "value": 39760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139018, "uuid": "83461a83-2bec-492b-9d21-3f912605ac9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139018, "uuid": "f734ba0c-7088-4ab1-9e9f-983bda719ba6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7909c727-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101792, "uuid": "844f680c-d897-4f6f-b1c6-47588d0f33f5", "comment": "Malware payload (Coper)", "value": "ccff32e76b40a32184c8b071b9d6bf8e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101792, "uuid": "e92aef79-7161-48e4-b375-c50ceaeef092", "comment": "Malware payload (Coper)", "value": "90ac64358498e62a5718e92d9ede7c7e0fb30aa39c6cc94d4ac38010208cc255", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101792, "uuid": "1846a2b6-9259-4330-9658-c33f3c5ca452", "comment": "Malware payload (Coper)", "value": "a1366666cb9c62db9978a82ef61cd00160b7ee1b", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101792, "uuid": "4ca7cecc-a2e3-48a3-8bbb-33b46ee1e3ef", "comment": "Malware payload (Coper)", "value": "382ace6a5c332bf0333122cbff929fa1d7436ebd15452150df0024c506a422b9cd239eb2d2dcc4948f02d716317dc4f6", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101792, "uuid": "7fed15b8-d2e9-4501-a22f-5a57f9dc4c45", "value": "T140451242B2DCC667E5BE6B348D96C3D8A125BD00CF5243677941730D1EB2BC58E32BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101792, "uuid": "d8efb162-9b72-4b3d-b2b8-782e5fe4f3e9", "value": "24576:+rhZZnWSoVMphwFT8y9wxPplquZKryDiX8ci3U3cF9WQIBI:+tZQS9wFT8WwxPLpgrWKQrWQaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101792, "uuid": "20038fbb-0386-49e2-a30a-23010b51767f", "value": 1172703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101792, "uuid": "07e3e17f-7e37-4955-b70d-715c8127da59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101792, "uuid": "ea569290-c3b9-4106-a2b3-c15d66170f66", "value": "e2a3c87_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6536ebc-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140174, "uuid": "4037d135-4fef-4948-969d-6d3daf36d101", "comment": "Malware payload (ConnectWise)", "value": "d4b04754b065d5d0a9b04d223227ffe5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140174, "uuid": "afe1b3b2-8a5d-4ebd-8795-97302e44345a", "comment": "Malware payload (ConnectWise)", "value": "90dc5533765ff1b647d600ab23e17f9331ed5cdf6183039a67301b6541bb86de", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140174, "uuid": "995f842c-8312-46fc-9b8f-92fe64b1f7e9", "comment": "Malware payload (ConnectWise)", "value": "8f0bc4fd3f397128077cb8e7bbd6fbd60fa8457c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140174, "uuid": "1de624a7-953d-4a9b-b22d-1b31cdf34bc3", "comment": "Malware payload (ConnectWise)", "value": "d02e0cd635298055f6f6d6e4ed1e76863a932c309bcbc1b68c113ffba9f245d382aa4b8dab44339398c75c9295c2c035", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140174, "uuid": "666aa45c-f345-4e1c-86af-48ce22bbe626", "value": "T11AA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140174, "uuid": "472a9e5d-3543-4007-a348-e7afd27d002e", "value": "196608:8KaLNkbgzi4QuKaLNkbgRKaLNkbg1KaLNkbg:SWgziHQWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140174, "uuid": "eb689f57-06b9-4d4e-a98b-fbdae916ef42", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140174, "uuid": "a40ed3bb-d874-4382-8882-6b12ecb39746", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140174, "uuid": "84b38c83-6c62-4614-a01d-998a88a2e07d", "value": "RF_Architecture_doc2026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e608b13-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143516, "uuid": "622d1140-45a0-488a-aadd-c75030783862", "comment": "Malware payload", "value": "553fb19cb69137896c014f3bc8f90e00", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143516, "uuid": "def78999-4478-441b-bc79-9613285a3be0", "comment": "Malware payload", "value": "9184dcb57d28c8418e188de57fa99069736a6d1dd1a32050cf89ca6aa8f76c44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143516, "uuid": "70cf6c10-d521-4a25-856b-5256d98f2c6e", "comment": "Malware payload", "value": "0d365efc370fa276e792faa64d595139012c8c27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143516, "uuid": "1c99ef06-2e68-4ff0-86f2-00b6cf360519", "comment": "Malware payload", "value": "fe6671affda5dad749fdd561837a9e39253d898a9b66fac5dc415de3149c1d26317b08a24ff2d86e3a8319518beb7813", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143516, "uuid": "dd75a329-2c3b-460d-ad60-5363a3ebd754", "value": "T14A4170CB3360CAB8ACB4696F3269741075F9A1B69BBE9F441BD834D9848DD1C30C5A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143516, "uuid": "c61788b0-bef1-47ab-a599-3ab0b86fa884", "value": "48:1h9a/seuXErhKAvqZA2YIOUo8oZ3v0biEvvSZXrvNAfE:1V4hKAwYIOUo8oRcI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143516, "uuid": "2db7adc9-763f-4da8-ad3e-1100fc2d06d9", "value": 2036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143516, "uuid": "03fb36e4-76e5-4073-a924-38db9bcc74e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143516, "uuid": "f5496481-00f4-4d51-8385-7a944f1cfad0", "value": "pXdN91.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c969d02c-0138-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770147883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147883, "uuid": "f1120c41-f4b0-4a7e-bd65-184895e242fd", "comment": "Malware payload (SantaStealer)", "value": "9f2f256600a8d8b0dd8b154be0491a9f", "object_relation": "md5", "Tag": [ { "name": "pw-predict_github", "colour": "#C6A303", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147883, "uuid": "3a0f9383-8bbd-4177-93b1-05529c38cfda", "comment": "Malware payload (SantaStealer)", "value": "91f30c13f56121fcfe46dc3c6a0cdfd48b6c93ad562058474a89b7568e2e6ccc", "object_relation": "sha256", "Tag": [ { "name": "pw-predict_github", "colour": "#C6A303", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147883, "uuid": "a18171c8-0271-4bfe-8d2c-615c98d71c55", "comment": "Malware payload (SantaStealer)", "value": "b3e5e193a0395f0499369773f9b51edd2155bbd0", "object_relation": "sha1", "Tag": [ { "name": "pw-predict_github", "colour": "#C6A303", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147883, "uuid": "b59d1464-83e6-4326-b611-c7f67bc1004d", "comment": "Malware payload (SantaStealer)", "value": "5a440b1fe47cff23069523be52ed83d7bf28a34d8fd4f1209f91a0107b8e5c24c3ee1fa04434bf90069ca8fc5f9567a2", "object_relation": "sha3-384", "Tag": [ { "name": "pw-predict_github", "colour": "#C6A303", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147883, "uuid": "a2d8d0b6-8bf6-477b-99b2-d210c7d070e6", "value": "T1542733626CF8E7480CE0004D3001BE744FE66D69AC5AF93267E57667686A60FF7FA5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147883, "uuid": "8222bb0b-0cb6-4134-8902-169cc9c3ffb7", "value": "393216:NVBTzEKgj8cQIj1YRHvuYFjfJUzMdUwMG3seGhMkA6pXFInvgcMOorOXpr7H:Njj4OoYFdxd5/GZRFevgOmE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147883, "uuid": "9890f5f0-50f9-4d46-b423-427e3a22157a", "value": 21337673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147883, "uuid": "4d050719-d25c-40ad-bdbc-4a4911e31d1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147883, "uuid": "615a3459-bd69-46ba-977c-37679518a833", "value": "StakePredictor2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60609f35-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136969, "uuid": "db380442-dab8-4926-9ab2-7820ee418ca6", "comment": "Malware payload (Mirai)", "value": "1bdb66f48d6e7507d221dad5be985761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136969, "uuid": "548c6afd-ab69-465b-8189-067d98f6d693", "comment": "Malware payload (Mirai)", "value": "9494683239ff99d86db9145ddd361c5014eef8506c720ef34bae542b1f140c88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136969, "uuid": "3430a8da-16a8-4b48-8038-989f40493571", "comment": "Malware payload (Mirai)", "value": "faa9cacb9d9aa1a3fa5afd9a90ef1d75ef990f3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136969, "uuid": "bf536b29-b8b8-4d74-a254-05038d39bdb9", "comment": "Malware payload (Mirai)", "value": "6129ced7e929f80248caffe1faa710f354bc7c90a90a27c85ac562a981b6ddb5699b537807e640576be3f491a1cc8cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136969, "uuid": "2bbe2f4a-142c-41b3-9812-56e20d2c5a75", "value": "T128D2E0A884E7B6F8C0FAA6B5113C0BC9E976F256D1244AB70CE82075DE571C54E30EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136969, "uuid": "9df83e75-fa55-4ff4-831f-1d700101bbe8", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBU+D2bvD:NYJdJZiy1aBnQfTqBUDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136969, "uuid": "b43eddd6-990b-4f21-aa1f-d9f86a7f5d87", "value": 30144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136969, "uuid": "aecca2a3-1a67-413e-b94a-a2f2a79d35c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136969, "uuid": "cdfef29d-786f-4fed-b1e1-9c6b76e9be79", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79a154c-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136793, "uuid": "19c96986-9bae-4ecc-8360-cc6e25d17936", "comment": "Malware payload (Mirai)", "value": "413e97bfbae6f7bfc831064bbb8b19cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136793, "uuid": "d1e01f52-6a6b-42ce-b1fa-664561e82f84", "comment": "Malware payload (Mirai)", "value": "9633a560c9e528465418f37cb0111f6cbda015a4b46f4ab2efe27eaa0b75413b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136793, "uuid": "3031ae49-f0fd-4751-8b2e-88ab3064c88e", "comment": "Malware payload (Mirai)", "value": "77e6ce5bdfd9656f458c2d633dcc9eb3f1b331bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136793, "uuid": "d1acd307-64fb-493e-a7aa-4745f179dad0", "comment": "Malware payload (Mirai)", "value": "66be391e1fe8435d5557114423157f9258652d55f45de24ea564fe114aaf405bd8f09dc6a263443343d7b8dd95a3ccf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136793, "uuid": "3fc75b14-810d-4ac0-b435-0736787c0acc", "value": "T15BE2F2939361F451ED7C15F1F93FC2876B7D0A6CD77730A6160227185A6A0872A3C897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136793, "uuid": "3c862c59-a7a3-43a1-9eb2-cb82c5220c53", "value": "768:ToiWiO031vpAPbrVWZK3XVGxm9XNs3U03wf7If:Torm1vpALgUJNBf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136793, "uuid": "fbd84eaf-98a6-468a-bbde-7cf86bce46f1", "value": 33156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136793, "uuid": "30177c25-d583-401e-9103-638d81010947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136793, "uuid": "120117c5-5600-4ffb-a631-dd432b5fa238", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f1f55a-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143478, "uuid": "0c05ede4-82af-4daf-ad1b-c0c05e29af16", "comment": "Malware payload (Gafgyt)", "value": "8482c2ee87d591d9cb553774e47965e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143478, "uuid": "571ab972-b203-449b-a797-fbd7c08e6e5d", "comment": "Malware payload (Gafgyt)", "value": "96827bfc67e13a4a5ed08cbecf0abaaaa84279ceac6b4158663755bc18d3da5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143478, "uuid": "531e1461-1c2c-4921-a2cb-3640cc53cef6", "comment": "Malware payload (Gafgyt)", "value": "90b9e17012da7252d4293dec49dd462205a21cd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143478, "uuid": "eec0c83a-0b75-49d8-8454-ee2d4f6f7b62", "comment": "Malware payload (Gafgyt)", "value": "8e21ada8b70810fc52ae651a9b6bf70d92f12805e95e141fed42fd4abad8f8d28755ebd515445041e1a3448625639d53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143478, "uuid": "5e54ece1-4f7e-4105-baf5-b121d4f832d4", "value": "T1C4B32845F9404727C2D327FAE79E439D3B355694A7D73301AA386EF42BC5B882E3A520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143478, "uuid": "cef2d961-206b-49fe-ab48-75a677e99e24", "value": "3072:mwNDsbZLa8Lpod/tcuNX7zYmyqqQNB1a1wFj:3sbZLtLGNtcuamyqqQNB1a1wFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143478, "uuid": "bdf064d5-5dc3-44ef-82d3-f4bfee669e44", "value": 111060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143478, "uuid": "e64051c9-cf33-456d-a37c-6fcac1acaaf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143478, "uuid": "55394672-1839-4cbe-a07a-440e3b9d0fe7", "value": "pXdN91.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d034f0c-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101772, "uuid": "5ab6b6e2-c757-459b-b5e3-36c0382b652c", "comment": "Malware payload (Coper)", "value": "3e67564b7f47568d2a91164cbcf7f8e8", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101772, "uuid": "576fa539-bdec-4404-8653-8bdb08066a8c", "comment": "Malware payload (Coper)", "value": "97886afc752048f8d8044120044ac7396e50b78b74b7e0077b8881b4eee7da6a", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101772, "uuid": "ddda64f5-0455-47e2-98a1-a18e7d917381", "comment": "Malware payload (Coper)", "value": "1bc58653f3bca7ce42669ece913c64dc1cf35947", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101772, "uuid": "b0329ced-a547-468c-a09b-6b81cb281450", "comment": "Malware payload (Coper)", "value": "ef3cf59f08a551c5fa2609f593a5019345b2728319fa412f95cf94024da33011f9dba61ebc9e85b5baeacfe182af4e48", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101772, "uuid": "6b4cf129-864b-42d4-852d-3cef65224b38", "value": "T1D9451342B7988623E4BD5B3859A7C2E09224FD94DF5147BB3A01731D1D723E4CE32BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101772, "uuid": "0537dc40-a865-4181-a2a6-b0d15a2e5cec", "value": "24576:u2s0n5NiMPOS31a4+nDQ5ctvW/Dqg/HEdCXdZ+T134/0AILIq82T:u2soNBrGnEUvW7r/kCXcI/LILIq8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101772, "uuid": "dd4a18de-54d5-430a-b74c-e48fe48b44e3", "value": 1172695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101772, "uuid": "34aad20b-c519-45d3-bcff-9ffaec636a34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101772, "uuid": "b3e90607-4154-4602-8602-d4301a404dfe", "value": "8d38e55_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd44a1e8-00e5-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770112268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112268, "uuid": "4eb19511-ea40-4865-b7bb-225dc5f7b214", "comment": "Malware payload (Joker)", "value": "6ffeeae4f08293c220e0454d311e5cb5", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112268, "uuid": "f6eb1d33-51b8-49b2-b93b-cc65e7a58481", "comment": "Malware payload (Joker)", "value": "978b992afcdbdb7f25a22d88ec287d3a605020c07e6c5905f5681c9b4947c83b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112268, "uuid": "5a6fb1e2-5650-4e72-8ac1-328d1798d954", "comment": "Malware payload (Joker)", "value": "22c6b7c04c1b0e8ff3d5e16c3405849cdd9a7310", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770112268, "uuid": "e08d7f6f-847b-4e93-ba30-aef80550b16b", "comment": "Malware payload (Joker)", "value": "1b06d7ec5e3fb20e7818bb62df4a70a9be403c60e87aa1053ec16401ba7a602ad3550105671c8d3916e3422a480aff46", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112268, "uuid": "0522300a-9f7d-4501-bf74-e7353123abfc", "value": "T14E571206F70CEC3BC9DA74389A974BD571166C81459093876925F618BFBB7C8CE2ABC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112268, "uuid": "7b851e09-067d-4bcc-8a2b-2fe664d9cfb7", "value": "393216:ScMrH0gnn81Dmq1b2rDNpseP+oyegkqYyAiOh4TasOpRGoX:ScwVXq16tpseW7YyAiOh4+5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770112268, "uuid": "bfc77c01-d23e-48c5-9f13-29bba589480c", "value": 29330219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770112268, "uuid": "4b34f3b1-40fc-40f9-8470-09a93161635b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770112268, "uuid": "30da37d4-57b2-414b-8834-09d14bb26c97", "value": "com.colorful.joyeup.kboard_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a596bf-0140-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151266, "uuid": "ad21c00b-6a9d-4c48-ab09-2cd7bc4f74ee", "comment": "Malware payload", "value": "f5c5a4f00c037835be24a8e86441f261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151266, "uuid": "4949c32c-0620-47bd-8b31-5f45767bac56", "comment": "Malware payload", "value": "97c5d534d16cdfa35ff85fb7eae28bc0ffe712f23ffc59258f534c50d0bb9371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151266, "uuid": "a038c69e-4b91-4da3-96b6-5c03f6912529", "comment": "Malware payload", "value": "4231da3c02ca11d34bfa93cd40985dc9ec49e3d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151266, "uuid": "d2a4d7d0-4b0a-4a8d-9d7a-bfe1acec9d70", "comment": "Malware payload", "value": "15d83d92e6f38360c5358a86cc281d5259648efd76c0b47b166033d8a40330b667dbdee904ea5f96c47b7a3a1dc5993a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151266, "uuid": "3b6e7ba4-5189-4e28-b236-2cbb79de8e7f", "value": "T131E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151266, "uuid": "612d6206-d3c7-4d8d-9bff-cc04b7b44686", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151266, "uuid": "f8f2f1a9-23ed-4a19-821b-c918b6f30b9a", "value": "393216:0YF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1/:vrRxvoC/7a0jUxX7h1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151266, "uuid": "6ee801ce-9311-49f5-85e2-80fc7e2324e7", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151266, "uuid": "cf8147ba-316c-4d4d-ac8b-ee09d6691f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151266, "uuid": "93531a04-15b5-4576-aa3a-89f9ac686436", "value": "Solicita\u00e7\u00e3oCalipoEnergy.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cdbebf-013b-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770148900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148900, "uuid": "f847f609-1108-477f-bfeb-71c9d8ec763a", "comment": "Malware payload (SantaStealer)", "value": "8d2cd221772f2f2e46e13d302a0e67bb", "object_relation": "md5", "Tag": [ { "name": "pw-stake2026", "colour": "#48FB15", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148900, "uuid": "e594b0f1-b05a-4d3f-b33f-dc3ef1599d04", "comment": "Malware payload (SantaStealer)", "value": "981971db686e5a41abb733e19246a02f12d9f38d84c2b8b3a2f33f93aa5e5d76", "object_relation": "sha256", "Tag": [ { "name": "pw-stake2026", "colour": "#48FB15", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148900, "uuid": "0020ae11-1e1b-49cf-afb4-a92355322df6", "comment": "Malware payload (SantaStealer)", "value": "55fd6836fec4146feb0b8c6affe368c1a0b47911", "object_relation": "sha1", "Tag": [ { "name": "pw-stake2026", "colour": "#48FB15", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148900, "uuid": "cdbaeb14-71f6-46c6-9aec-83f39d53e128", "comment": "Malware payload (SantaStealer)", "value": "e34c2ae936e197afb5ef44c29cad23fc138d1117e33cd0dba6738e49148e8b6dc4e43fb6d00b87ab9e3d93033cd340d1", "object_relation": "sha3-384", "Tag": [ { "name": "pw-stake2026", "colour": "#48FB15", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148900, "uuid": "90f5e7d4-562f-4b6b-8ce9-a55f183e1d63", "value": "T12D1733CDE84A973E705E4EAB02F8FA8FD581033A0D4F061964DDDD82117A27BF592726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148900, "uuid": "cb41532c-68cb-4b39-80df-62f3bc86dca4", "value": "393216:+WagSdFGt3eplTC2i7hyOibxvrIYKHFh+X/NEhs:+WagWFGRe/TUJgxvcYKHL+X/NEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770148900, "uuid": "46f1bf2e-ce92-44ce-8348-3f91a5d0bf69", "value": 19332286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770148900, "uuid": "8d9f1ca2-1f89-430d-8624-fcf30986ddb8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148900, "uuid": "e6d61d15-557e-4a38-94ca-13d37981b0d0", "value": "StakePredictorFull-2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a7692f-00ed-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770115399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115399, "uuid": "01437763-683a-4f92-b846-ce81961a0e55", "comment": "Malware payload (AsyncRAT)", "value": "66b28ed133ffb28df30dc06abd54d04a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115399, "uuid": "10597e16-ea45-4400-9fbb-c9df2918a530", "comment": "Malware payload (AsyncRAT)", "value": "996798be5c35047dc4cfe9c12918a8aeb296776fcf3d740bd4d2667176634616", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115399, "uuid": "36d12153-c959-4384-a76d-6adb2cbd1128", "comment": "Malware payload (AsyncRAT)", "value": "95fa06ea2e3b8796edadf97b502a6b543fbe03bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115399, "uuid": "9502b6e2-73f1-4ca7-ac7a-641f8b1e5137", "comment": "Malware payload (AsyncRAT)", "value": "8c1e74966b198d7098c1b9d780bc7546fd4f24fbe4aec796f6a1922c05ad4f46cc1a14dc3a7ad400062b39ec9c52e622", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115399, "uuid": "81143db8-2cae-44ed-b083-26ee78417d5e", "value": "T1CE737C012399C965E2BE4AB8BCF2460146B5D5B32112DB5E7CC404DB6B9FFC64A123EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115399, "uuid": "bdf323d9-e4b7-4d4d-a266-53bb95cd8030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115399, "uuid": "869c3a35-bc04-4f1a-af50-4efa1f341034", "value": "1536:IoLuNzYxjprwGbbs4SOpcGeG3CPkov6Bwm7hIo0VclN:IoAzYxjpUGbbsOpz3Ccy6BwmlIomY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770115399, "uuid": "a4e4cffe-2038-4bc6-9d38-37eb3c04c9dc", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770115399, "uuid": "eabb82cf-0094-49e1-bd0a-2e1c399b6416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115399, "uuid": "18f6ec09-4000-4119-a974-4e613645753f", "value": "EdgeLoop Betting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb55f7c-00e0-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770110172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110172, "uuid": "0774337c-25d1-4633-b5ac-a1d80bef1c22", "comment": "Malware payload (Gafgyt)", "value": "443bf7beb96cd3cecd9f337eca387672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110172, "uuid": "044375ba-6daa-432e-81f8-cb079e06b111", "comment": "Malware payload (Gafgyt)", "value": "99f1d2fa2ab1e6ee7f8550a082f7ef54c16fcd8ef48fe1a419414ff1aa414c2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110172, "uuid": "0b95fe28-1278-42ff-b0af-965dee76878c", "comment": "Malware payload (Gafgyt)", "value": "399540880fbcc798ea1e04a4c7d97db0bb5e9dfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110172, "uuid": "114506f2-36f6-4e6c-8d15-5602fe429e07", "comment": "Malware payload (Gafgyt)", "value": "00c4eacb9bffb98c81580dff0cc223d35982277690c2605bf8bc41bb933b458b382a87cdf27c4e6638c0e42b56e7eff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110172, "uuid": "acc05394-5bf7-40f6-9235-659f121ec58d", "value": "T1BD73022B514F4BA3D0E99D33B40B7B34AE78E013E8E52F05F851A095E91DDB6A10467A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110172, "uuid": "98f0b866-0b4d-421a-9536-a9eaded18521", "value": "1536:mOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohK5u7beqNorM:9pn40+ZsvaTYbeO/VwP/zE99/ohmu7bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110172, "uuid": "89169a75-58ed-419a-8c87-a06144254344", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110172, "uuid": "e8047301-b417-45e7-a334-c3ee9d377c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110172, "uuid": "1ce8ab7f-f324-4b61-9b47-85f7f2ad815f", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2e8cb4-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101796, "uuid": "1673b759-e670-4379-8ec4-6a929376ef7d", "comment": "Malware payload (Coper)", "value": "046d9caaae81ee724942a8c0d31bd2a0", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101796, "uuid": "59b79b02-3b7b-457d-94ee-ddf20547e2b8", "comment": "Malware payload (Coper)", "value": "9a1ac04b85cc6f35cd83382f258254556a37f1fc314020dbecbde033caa00a8d", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101796, "uuid": "64e4039f-4ea3-436d-91dd-9eb312369c83", "comment": "Malware payload (Coper)", "value": "fd3e938f6cee85cd4bafd1eff4635603174e5e74", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101796, "uuid": "9f8e0a6d-bff4-4573-b405-412e0627e827", "comment": "Malware payload (Coper)", "value": "16a0efe181b66921ad7db28cb0e0f366f16101f3b4c1024896f92493db6f7ad53324ee6c55676c2b57de3e312ec036f0", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101796, "uuid": "fb25dbb8-769a-45a1-8dd9-428eb8980d2a", "value": "T1BC451241B799CA17E8AE6B304C5782E466347D48CF0553BB3A52771D2E32AC9CF22B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101796, "uuid": "a1ed1de5-3d80-4688-95a7-adb1d389adcc", "value": "24576:reSZGnl9AYvfCuzPpcbdZkTgo3Zw1fZHC8eGWglohR607ww/n:reQm9AYvrDpcbdyh3Zw3feGVlWr/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101796, "uuid": "ca5065bf-1d92-442a-b49d-c5a7ea81b36a", "value": 1176811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101796, "uuid": "0d18ec61-3539-4c77-b004-ab9fc0ad70d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101796, "uuid": "5ce1e6e9-b4a2-4856-9e2c-a90396368e6e", "value": "faaa4dd_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd4ee65-00ca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770100537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100537, "uuid": "fbaf9f76-1457-4d5b-8577-c50439ef1e5e", "comment": "Malware payload (Mirai)", "value": "c523fc3e8110970c85b82ce9e0495971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100537, "uuid": "0faa77a0-8403-408c-9ec3-af920864ebf4", "comment": "Malware payload (Mirai)", "value": "9a5e01fe9dba97cdf037a89a78d3ba7d62a64638b296af1cf12b592d2bbfd624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100537, "uuid": "5faefc97-76d6-4bdd-8393-f8c71114b92d", "comment": "Malware payload (Mirai)", "value": "8b47b21092821a95002093134c780152998567a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770100537, "uuid": "254b2ab9-38f0-4345-8ebd-d326d5b70334", "comment": "Malware payload (Mirai)", "value": "9124061ffecacb99117a2f432fb00cce983fce3a0b3ecf195cb350f64b049903b75c38f5b22f14a1dc78e021e11e13c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100537, "uuid": "0ca82d09-df08-4cde-9964-36091ef07f0f", "value": "T1C4D35BC4BB83D8F6D80506713037AF72A677E07E1539DB92D3EC6D32A861A42D4172AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100537, "uuid": "fb0db16e-a45d-4c7f-9b2a-1ade2ff494da", "value": "3072:ABIMZgN7g0CYwag4AAglUVCdQr01x+vL7djqPSiq+I0wbZne2H:ABlGk0CYw5BAglUsI01KGX5wRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770100537, "uuid": "444204cb-28f2-400e-95ce-7633af4c030d", "value": 131208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770100537, "uuid": "20ee7261-166a-4351-ac5e-57ccfcf42e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770100537, "uuid": "68c8434e-7d9c-4557-8e6d-92e2aa832466", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faca7be3-00cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770102869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102869, "uuid": "f1950c44-bf17-44d9-8d96-500bc17b6ce3", "comment": "Malware payload (Mirai)", "value": "b51f32517dcd2e05f35226a79bb925b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102869, "uuid": "1dd17512-6352-4ab5-ae8e-d24eeb02851e", "comment": "Malware payload (Mirai)", "value": "9ad46ded5a3d646d8eca007638fe9bdaa673407d531a07e7a9f4e2d979eaefc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102869, "uuid": "8d4aa8a5-bb3b-4a93-a98c-fb1287b98f37", "comment": "Malware payload (Mirai)", "value": "a71fb2fab52dd61ebbb5e9625d42cf4c70ac79f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102869, "uuid": "09206f49-ad80-4945-8cae-e3066b62caae", "comment": "Malware payload (Mirai)", "value": "458e2d5fe69f9e88fe20f30913090af2b7fde90a2514b099ea2ede84c8e30021554f7fb1e20ddd918ecd54d0244377f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102869, "uuid": "a9e81e46-35b0-4f85-be49-8228f8bc826e", "value": "T18A832A4ABDD28E19C6D423BAFB6E109C335173E8C1EA7117CC146B24B7C951E0E77AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102869, "uuid": "10112ec4-4afe-4774-8255-6cd69752f397", "value": "1536:lj/QyTjnuDU0viPLEu5D9Z+S6edg7tbYGGbjO5uwMlKX3oykaLpo8F/mRwbZni:lj/XTjnuDU0vKLEuXZ+S6ed9WYKn3BL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770102869, "uuid": "85fe3111-5e1d-4050-a047-b7f0b6f61d67", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770102869, "uuid": "b65d66a7-5045-48a3-98a2-0eff0981463e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102869, "uuid": "e764a7fc-e180-4772-a145-d46dc08acfbb", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc1611f-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143485, "uuid": "36867ee8-21e4-49ce-8574-c52b5121565d", "comment": "Malware payload (Gafgyt)", "value": "64232306e3e42628ded2d226525e96b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143485, "uuid": "2dde7824-09c0-492e-b291-e416857ef56d", "comment": "Malware payload (Gafgyt)", "value": "9b98d912b98cc86317a36b6fb75865ef1ef059a261337c2420c78c041ac63a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143485, "uuid": "6feff2dc-6cda-4d14-bad6-d485f3c5c944", "comment": "Malware payload (Gafgyt)", "value": "8e4929c53c9f8c5aa069e769bc6421528f09802b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143485, "uuid": "0b7b894f-587e-4ec9-8bea-be71d8dbcab7", "comment": "Malware payload (Gafgyt)", "value": "c2753e56ce0e210d98d56c7c682f3877577445c14df726128ef6678e3da34f4317edce26f5f721dd4ea301bc68fc8c2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143485, "uuid": "7d26c96e-44ef-417e-829b-4243a31f8d03", "value": "T174C33A05F5508717C2D3277AB79A465D77232BA493DB33119938AFB42FC2B992E39820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143485, "uuid": "42a97d5c-62f8-4ed0-978c-e84cb311302c", "value": "3072:5siuapO7EPDLzg9Qof2+hyeoh7/VmkQBWzXvb8:/uao7EiQof2Gye+/VmkQBWzvb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143485, "uuid": "7f571afe-4c17-480a-8884-478711d61875", "value": 128834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143485, "uuid": "c2a1830f-a728-46ba-90ab-44e959c52f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143485, "uuid": "f0508ec8-0a9d-4b3e-82ec-18c6641c408e", "value": "pXdN91.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79a9bf6-00e0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770110057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110057, "uuid": "34b807c8-b071-405f-8186-6f4d89639667", "comment": "Malware payload (Mirai)", "value": "c9b559b4a8e1def2037f1c5a8ea0993c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110057, "uuid": "5de16731-4a11-4995-b1a5-d73c99aac853", "comment": "Malware payload (Mirai)", "value": "9c2c65216f91d93de214d81bdec0dd067e079d81a8fd618c45eef8437e162a1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110057, "uuid": "8eb20f93-5c29-4541-87b8-c044b1dca226", "comment": "Malware payload (Mirai)", "value": "688279dad3809e88aceecafdcebbfba7dcd870ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770110057, "uuid": "064c7248-0b8d-499b-a693-d1c6ae985d1c", "comment": "Malware payload (Mirai)", "value": "47d95bf283902424232c92ab0b0fc4a2eb853f7bc0070c6451c81bedef3c11023ef4b9fafd17992c70bc606d19de07b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110057, "uuid": "babfba4a-eac6-4be4-b516-8e3958b192ee", "value": "T1FF612BFD41A0BF93CC85A94CBA2483A1730B91F5FD72F63C9C584A6A4481B15349BEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110057, "uuid": "680ee664-b59f-44c3-853a-cd5921b16d61", "value": "96:geEUuA1gZW8YKmsKo5MZmzizgSwGMIaMGSweSQ:4Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770110057, "uuid": "4be0aae3-6916-4f35-a534-bf7e88ecca72", "value": 3211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770110057, "uuid": "45dfc6f3-bc65-42b0-80f3-38972ff733c2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770110057, "uuid": "dde002ef-92ba-4c0a-ab32-8721f3486559", "value": "mao_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a883d3f-012c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770142436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142436, "uuid": "65f3f91b-d7a3-4a0b-b0db-a3824e354d72", "comment": "Malware payload", "value": "56f98070f092e1431fd300bc17f2b6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142436, "uuid": "eb1a8ecc-50c6-4971-93a2-61d7b2c608b8", "comment": "Malware payload", "value": "9c3c9141d8ebc3b1885e981afcb3ebe1fc9c57f313d9a1fa8b3a49a21400e27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142436, "uuid": "d95b516f-f96b-4aeb-ad54-f209a1c23d89", "comment": "Malware payload", "value": "8e225088b3fd665010b4eb2fae22b54ce81e47f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770142436, "uuid": "aff22379-8b9e-4a8b-a84d-794b610411a2", "comment": "Malware payload", "value": "ec34df4874ce4b9561c163f688184ce7644e577b378bcb94267b23e12fce19f3ea6211c37da84506bfd8cb4723205629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142436, "uuid": "8f6e071f-e180-409d-90ed-203bc71c5817", "value": "T17C266B53BE80C165C19BF239E962A2957330B84C473026D36B662EB64D7B7C41B3BB1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142436, "uuid": "e9c94ced-969a-4c81-99ef-64baeeb841b4", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142436, "uuid": "d886d46d-947d-4a95-9403-7dce9e20275e", "value": "98304:Ze9OonHDGITL83ydE6k9RFnyRSV9tm9qLYuKEUkV:7ZUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770142436, "uuid": "75a4e5dd-ef13-42a4-8781-a33f3bf34356", "value": 4557952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770142436, "uuid": "f35b0d52-89cd-4966-81b1-8cb56130f6c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770142436, "uuid": "84173ba7-2c10-4317-8ad9-33ff4e66953a", "value": "9c3c9141d8ebc3b1885e981afcb3ebe1fc9c57f313d9a1fa8b3a49a21400e27b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0474555b-015c-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770163014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163014, "uuid": "e3887e3e-d772-440f-be4b-8ef5f2bd9a69", "comment": "Malware payload (Gafgyt)", "value": "4d93d2b35388b86bb51d71c271fc13c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163014, "uuid": "9f53577b-bcb7-4705-a814-8b0ffec4c361", "comment": "Malware payload (Gafgyt)", "value": "9cbe471b6a376544ba200db0ebe96ead0a3a7bbdd51ee9d30e55febf3c51ae63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163014, "uuid": "dcfb305d-26e2-467b-a113-d1e3f634b081", "comment": "Malware payload (Gafgyt)", "value": "44366700bbeba81af1a5a0f0e321a3560f0f7ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163014, "uuid": "e9f6ca06-2c75-48e2-b36f-063304bce827", "comment": "Malware payload (Gafgyt)", "value": "45e35d9eb283ea766a5cebf6e1797db181c9c9ec70b50cc527cd555f138aebb9292292fe6f1ba700dae66d7ae413ce55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163014, "uuid": "6b305723-e55d-4229-969b-ade3635749a3", "value": "T1AFD33A05F5608727C2D3277AB79E465D37331BA493DB33225A34AFB42BC17891E3A921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163014, "uuid": "02d0afe2-be04-4201-a466-8f14a43303fa", "value": "3072:9ua5cn2EU8k2MVMk2s2yVjlA8uImGQ9aTXG6X:Ua6n2EeMbs21ImGQ9aTG6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163014, "uuid": "5e63593b-e315-4904-967e-fd7effc59e31", "value": 134283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163014, "uuid": "35eab641-d645-4bd5-a16f-2d5401267d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163014, "uuid": "65e9ec7d-6f0e-4fa2-9ce4-f0f2d0e0fbb0", "value": "pXdN91.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4b44e7-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128617, "uuid": "703c4562-026a-41eb-a0ea-7499578af59c", "comment": "Malware payload (CoinMiner)", "value": "e50736a83f9ceee9eee22baf6c940e50", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128617, "uuid": "9aeef139-f344-42de-b331-d90704de35b5", "comment": "Malware payload (CoinMiner)", "value": "9cc1bf98400c28f152312856c12869014b9bc7b481004c815d857cfbfe8f65ba", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128617, "uuid": "dcca1d06-bd5c-4e66-8b2f-18160a60393d", "comment": "Malware payload (CoinMiner)", "value": "d445bffe7d30a82d0458d633dd92d4d448e8ab17", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128617, "uuid": "5ae68aed-00a6-4ac5-85ac-3dbbffa76a3f", "comment": "Malware payload (CoinMiner)", "value": "3da45068898d2f6bcdd93310e89dedbd50a59d8ec5fa02b51fcaecf0447def10015cd8008669eff65d9f86ef9ca55a5c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128617, "uuid": "9e28d37d-9cb8-4feb-967b-9678e255dc8d", "value": "T17C7623AD614D339CC41EC3B44023AD45B2BA123E1AF995AA72CEBFD077EB4209947F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128617, "uuid": "df20998d-0cab-4ec7-9409-9ceca1b9dccc", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128617, "uuid": "adcd4ed1-6755-4cd1-9576-0a6879c86b4d", "value": "196608:DYoUvI0R1PguHsLVU1b8se9jf6FJr66lDAP/VCbAkGCSz76e2pQ7eN:DJmYagAb8se9jft+DAngSz92yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128617, "uuid": "14fda96a-6b7b-4507-90db-fcbd3f0c59b2", "value": 7762432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128617, "uuid": "012764c9-94f8-4cbc-a11f-ca3279e67bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128617, "uuid": "30816fec-4a1f-407f-9e05-78ca0dbd7676", "value": "SecuriteInfo.com.Win64.Evo-gen.34254431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faad038f-00cc-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770101580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101580, "uuid": "ee6dd0de-d3ff-49ce-9320-848af41b3b6c", "comment": "Malware payload (PhantomStealer)", "value": "252b8c111ad9470eaa84d92d07fba603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101580, "uuid": "8549faf8-9518-46f9-a593-3f5599b42782", "comment": "Malware payload (PhantomStealer)", "value": "9dea8482c43fedc7f16ffa089e1c4891fbb4be813daca72759bad16fe4d26f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101580, "uuid": "c75f8165-3ab2-4bc1-90c9-88e724966ca8", "comment": "Malware payload (PhantomStealer)", "value": "5a2072216934991cb60378723f96efb6cb49fad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101580, "uuid": "9d391b38-9899-43ee-bc14-52caaf18b8d4", "comment": "Malware payload (PhantomStealer)", "value": "8f2e5a820f53f2f96785c7eccebdd188e5b7f82792b1934ca9c5a6d719a16237cc5a8abdb2aad97449a830ba75bb4e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101580, "uuid": "439b4be1-8c3b-4393-bef8-0eb7ecfddd80", "value": "T112733A43B68B8762C5548B79C0E7551017F3F3877633D64A3E9A538E4D023EACA85B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101580, "uuid": "b1ae7b88-3a33-4842-b7e3-1deb2eeef687", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101580, "uuid": "63d994df-ae66-42be-ab09-d4766eeb28e7", "value": "1536:WSBvUU75eo3mt92D8KTyivhF9Aqo+gSJ+sXgaD:nB6o3mt4TTyi5F9m+gVswG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101580, "uuid": "25898b5d-9be9-49dd-b99b-1f80bcdd011a", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101580, "uuid": "87114e1c-a77a-4afc-9b0f-2eeec6d84164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101580, "uuid": "fc1f2043-88c2-481e-9ab0-c68dc825f118", "value": "Modelo 347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce8030a-00d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770106254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106254, "uuid": "1c659d08-6153-4d9f-8acd-ef9882c48f68", "comment": "Malware payload", "value": "6d25a35037cfae8a4cfab3611dd2df5a", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106254, "uuid": "6cf4c08c-2c88-4657-a04d-f750c7ff5960", "comment": "Malware payload", "value": "9ee7695e040ef9f191f89548479e558c66004c6ecd5d2ae69d44d40e6a14a8c8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106254, "uuid": "36607eab-22a0-49e4-90e0-bf6f55195054", "comment": "Malware payload", "value": "193b8961a9829ceaa1c7a7f553aeac9431930e08", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106254, "uuid": "62ba5a81-d87a-4095-8cab-77b1a379c751", "comment": "Malware payload", "value": "1370b8e103b1d81e451e170023dd569a6a43f5190af79cd5552aff4dd429dde5edd0b37bc7a8dde30a56621e5b57acf7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106254, "uuid": "b627380b-95c7-48d7-a85a-c038780bcc58", "value": "T19B43C1B345DC84719BD2963D7A79553120E071EC92EE568001C3987A3FE87CB9A4E6CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106254, "uuid": "ea64df0e-4be6-441e-a9c8-81b2f82da35c", "value": "1536:WDYc4M55JjjjjjjjjjjgNNWOEOEKZ6UYDggggkF:WDYQ55GNNjVfYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106254, "uuid": "a3d2f537-615c-4afc-8fd9-c0ca28c46d98", "value": 60253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106254, "uuid": "d78d3ce8-a8d0-484f-9410-c4107d3b84f8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106254, "uuid": "a0519f06-2caa-4a93-acfe-009ee06c9138", "value": "1_12_8_1590_03.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0525fff1-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136816, "uuid": "16a92c6e-eaa0-4dca-995a-0f64b6ef7a8e", "comment": "Malware payload (Mirai)", "value": "bb81eca867f91d05929cff72d6694c48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136816, "uuid": "f01520bd-ccf4-4e3f-86b0-7fd57b3b7a89", "comment": "Malware payload (Mirai)", "value": "9fce1578d0305981889ee6a62e114fef925d263b2ed93500b532a6ecf50f0bdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136816, "uuid": "ca8bafef-7640-4cd2-8f7f-57235b33591d", "comment": "Malware payload (Mirai)", "value": "a2997f004ae488ba9cffadabeec984517f16020a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136816, "uuid": "646e2068-1c71-447a-a5f3-313970168261", "comment": "Malware payload (Mirai)", "value": "f8ec49b3c8084cc10e506363f7e6ecfc6d487749c8728ca677b7654a7651d41882499bbb9df73b9f22bb5fdb96f695e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136816, "uuid": "91f92230-571f-4385-aef8-01dcd04364ee", "value": "T172518CC832204BB5BFB15992B6F585167489E0D1AEC74EC9E2FC68FE014CF096C916A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136816, "uuid": "14ac38ac-ae22-4f75-95d5-043e63aa101f", "value": "48:vzyucz3Ucz58czHwczBwczdudzEczoCczR8czKuczLMczH+cz7x7UfczAuczjWf:vzyucz3Ucz58czHwczBwczM9EczoCczu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136816, "uuid": "c0fc023d-05fe-4bda-97a1-8a6e66d2a35b", "value": 2793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136816, "uuid": "c32fd54f-3b31-4a73-a849-39bb3e094573", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136816, "uuid": "19ea4ae2-91b1-4d86-8971-1ea7c20874ac", "value": "lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c49ebb7-00d2-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770103811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103811, "uuid": "e75cce89-a055-4c90-a106-88e43d0eb33c", "comment": "Malware payload (PhantomStealer)", "value": "f5ec5a2c76d99fb68aade05a9528b50c", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103811, "uuid": "c448aec0-6fde-48d3-84f5-d3ab8d803dce", "comment": "Malware payload (PhantomStealer)", "value": "a0ab3811cfb62377b0c9cfcc5559858f8da49830cc93df5339e145458f216ea5", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103811, "uuid": "a35d80b5-a0b4-4815-8294-bbf2d0e9174b", "comment": "Malware payload (PhantomStealer)", "value": "7a6d6d6fe50f5a380ec28a49c803c8baacf3c7df", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770103811, "uuid": "0fee9459-efa2-415b-acd7-27a87cbf9358", "comment": "Malware payload (PhantomStealer)", "value": "7cdb6262260103fd29313572c00e4542791ffb521e92f13b8efab063f0602cec6c6ede3b6e0ac9a8463350cf536aca78", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103811, "uuid": "06781614-09f6-4b08-8325-91df2c90ca3a", "value": "T18565334BCC4AEC1E74AE9EF7935C8DB0A51810D536A1B79C2D0152A11EEB3CCB9FDA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103811, "uuid": "7b737d5d-93b7-4b2a-812e-c778350d8111", "value": "24576:U3sbYadU+lYteOlSejCKvfAECZl0BSURUpPHn1MSR7HpCJLlBq8iMoU39nEnpTGv:U3ss+U+zkCKv46BzkH7BHpcgMoA94Tjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770103811, "uuid": "e4db9d4c-f159-4d18-be66-3c7c6243bc99", "value": 1463620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770103811, "uuid": "1c320806-e3d0-4181-9a69-ebe3d61b3219", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770103811, "uuid": "1cc2a51d-7b1c-454a-83c8-12cf317cbeb8", "value": "nOriginal_Shipping_Documents_tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73114322-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101782, "uuid": "4872cdee-521b-4617-9c6c-0e60d8b8b4c4", "comment": "Malware payload (Coper)", "value": "cb73c9daf74d9382245af4fe8b6e79a6", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101782, "uuid": "3f19cf67-838e-492f-ba40-45664e174371", "comment": "Malware payload (Coper)", "value": "a126d643c83163c3cf7830de9cf2fc11b6b1eca77e10e0ce48e9e2edaaf2425e", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101782, "uuid": "6948b4f8-251a-4bd3-afb3-56ccdf95455a", "comment": "Malware payload (Coper)", "value": "dbb19187fa75ce2b2560792f2d3e06175981adb6", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101782, "uuid": "40c82621-6731-4fe0-9c7f-5bcd66baac91", "comment": "Malware payload (Coper)", "value": "5f1c61f2f911215125aa6288f8d41fc3cfc8d1453163f4252a90827bc8788d5ba17fedf51f454e3940b2e4709ec29339", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101782, "uuid": "871e965f-d380-4bd1-9629-fb852ea1ea96", "value": "T14D451281F3988713E8BE27380DAAC7D45221BE41CF15569B7A85370C1D72BC1DF2AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101782, "uuid": "fc506d7a-366a-40a9-a33f-2f27d8a4fcf8", "value": "24576:Ganw0hLBFuc7GbIBGXBiU9OEgnPr4BRs0jtKZx8MvFh4tLOh3bHytO:Gr2LBscqTXBVobP2RhtK/HCtLE3jytO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101782, "uuid": "e206f4ff-ac77-4282-bfbb-bf2d1c8fd9ed", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101782, "uuid": "14ba465e-a9d2-4950-b79e-04fc427a8b22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101782, "uuid": "08d25c97-ea3c-42d7-b83e-ae4c7843c393", "value": "b9dc7d0_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c12f25-00c3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770097653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097653, "uuid": "016fa2c8-b32c-4797-8e3a-aeab1dc88c34", "comment": "Malware payload (Mirai)", "value": "186a82313863a9db1960c52d0b576ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097653, "uuid": "24a5ca1b-ff83-45b4-8ea8-1b1a2956739e", "comment": "Malware payload (Mirai)", "value": "a13655a2a02812971c73bcd5fa0a49a6ce75a36e4741ed5de1cab6c2f78e140f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097653, "uuid": "a2c9066a-dee1-41be-b0ff-39df8e462e95", "comment": "Malware payload (Mirai)", "value": "7a2f690125c0e7f712cd0ae59224d7a8dc3832dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097653, "uuid": "58500cea-932c-4e9d-930f-71641f7660b4", "comment": "Malware payload (Mirai)", "value": "eb4eaa5849d3e4ec2f5a1589ddc28aa197c8eb1325c0c0ff49bd37b4c1d16351480063618976de23d909897f9550edf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097653, "uuid": "54b6fea3-87ce-4188-9718-74e948a72449", "value": "T1FA043A01770C0D43D2632EF43A3F17D0A3EFDA9121B4E545294FAA8A9272E33654AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097653, "uuid": "b1f34359-2a16-475e-ad71-068fa058dc80", "value": "3072:Wa0vyH+vPlTPdkwjxTOz8fgtrmewbZn0/:Wa0vVtTlkwjxTOzEgDwR0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770097653, "uuid": "6ff1810d-93ca-4a66-ae96-42ab5d38e069", "value": 176660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770097653, "uuid": "03f92b11-d8fb-433e-b72b-6b0cb3e96276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097653, "uuid": "b462df20-ad0d-4f27-8720-6673a843214f", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9676b41-010f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130327, "uuid": "50b10b71-65e0-4756-a367-dc0639384d8f", "comment": "Malware payload", "value": "7a5a5ab8f88e251c5de3b827d5c44272", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130327, "uuid": "f7091855-32db-40ea-9fba-7fd8644fe766", "comment": "Malware payload", "value": "a1ff279baaca4a94f6bdc31ead4a2c41c802855961a55a996148634df1ea9cbf", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130327, "uuid": "81cec019-c5bf-4a7c-a216-59de33a713be", "comment": "Malware payload", "value": "d4ae22c2aa3e6fb4a297080089de6bc1a24ffb76", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130327, "uuid": "076ea449-1bb3-43cc-8e57-b444d9f61dda", "comment": "Malware payload", "value": "c95e874a44b87a9de6f62b938cc4ae93d820b7dcb1fc050b74042698603d65cfe134b47aeee8e287b735654488bb27bb", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130327, "uuid": "1ba613e0-df72-4cf5-a821-04650d695633", "value": "T1B047331CAE627C14E22B1BBEA8B9BB1087F34257612CC755125618934AEF77503C27EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130327, "uuid": "cea1434b-4d50-456a-bea8-a5c7bf78b7fe", "value": "393216:RmhpJHNrOvea1J+8y1zORkaTBoX43YnqfR+Q44jJ/gbr4jso1okx0eUijRbAb1mP:RmDJHNrkp1JXiz3a1oX43YKRt5jso175", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130327, "uuid": "4024106f-d7e3-4895-9d22-63aa9004bb12", "value": 24909227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130327, "uuid": "af9390ff-f8c3-4617-9a81-52e55460e558", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130327, "uuid": "13fc081d-b7c0-4451-852b-8d34f2e7d21d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cc9bca-0122-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770138480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138480, "uuid": "01bbc754-48a8-4e46-9f29-09b816fd8928", "comment": "Malware payload", "value": "2175e27e3dd1197b310cef694b6d0309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138480, "uuid": "9908a55d-6e0d-4028-aba9-bd1cdc38ec72", "comment": "Malware payload", "value": "a234935ebc64bf92aa087cc1a25f443dcdb820344b568dff06f153723895ad74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138480, "uuid": "d8acd039-b758-4114-b4e2-5a80c1ba2721", "comment": "Malware payload", "value": "7732b2cb0685516ba99ce7dcf90a5050d29de6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138480, "uuid": "84dc9267-b7f5-47ca-9876-58862789887b", "comment": "Malware payload", "value": "dac8ea0effc623c7642e122767ec0756728af92ce22615da8ea4752d648eb68de9ba8fb6bd70f0b3a0276ef571e70352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138480, "uuid": "e1122a9e-11ea-4f7e-a5ec-61e4a71325ec", "value": "T19795CF13B2CBE03EE05D0B3B05B2F17454FB6E616523AE5296E48CAEEF250601D3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138480, "uuid": "73a12652-1481-4e75-8cf1-bdad595f5f7d", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138480, "uuid": "e8879cba-5182-4a77-b214-51858e7141a0", "value": "24576:MawwKusHwEwSDMnr9OIWNRrwpLajs0Ejq4BbUSxfafBGYpqMM3IW:swREDDMYNRruLa1ErbUQ8P054W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770138480, "uuid": "52984e81-1447-43ff-b703-52314484a26f", "value": 1937589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770138480, "uuid": "503c20a0-a349-4aec-a19b-496f4846384b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138480, "uuid": "ebddb3c1-9309-4195-89b5-704ea9febbaf", "value": "UpdaterSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda242a6-0130-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770144481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144481, "uuid": "ddae8cd7-ab97-4ac6-b648-1042f4889548", "comment": "Malware payload", "value": "948308d8c1bc9727a84f02c2f90b459f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144481, "uuid": "fa9755a4-587c-404b-a610-ebe4dcade4e7", "comment": "Malware payload", "value": "a2feb203612936fc9df61df9b147a2490939f8601e2f804432e352a67ba4833a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144481, "uuid": "6d3c25d8-8170-4beb-93bd-6cfe274ce964", "comment": "Malware payload", "value": "010f253a687d8bf83cb35865ea9f9ab875a7b1fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144481, "uuid": "c666ba4c-f556-4a41-b6ed-5192cdff0e8a", "comment": "Malware payload", "value": "dca7a4cbb1527d4cdae62793d8b344d53725d750424fe897a9ddef922676f5bfad0a7103f8f94f09ee5871a49060820a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144481, "uuid": "6df49cbd-da6d-464a-b759-40b21adb5de7", "value": "T14B52B0D07322174AE0AF3C7ABF343EEF31C56A99A6E8F2450F59867B1D812505CA4793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144481, "uuid": "534c0050-0c58-478f-91d1-691dbe774307", "value": "384:dFf+8dnSf74TofrGCImpHkzJVVeUeBbqh8suS/:jf+8dSf74kDT4zjcUGqesuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144481, "uuid": "738a0c3a-d581-4ea1-925c-7779942a0c67", "value": 14337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144481, "uuid": "d6677817-5bf2-4ae8-aae2-689d54184e78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144481, "uuid": "53e5bec0-af4a-42b1-848d-0ccc89da1c1e", "value": "xans.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029a670f-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136812, "uuid": "73e559eb-8d7b-4898-82a7-c67b48bd3534", "comment": "Malware payload (Mirai)", "value": "ef3c215baa6ae38722466754aa68b906", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136812, "uuid": "e1aee4c6-1d4c-44ff-a2a8-88c252999cf4", "comment": "Malware payload (Mirai)", "value": "a31130d93ed94b34a9eaca21d4e999058d208cdfabbfbd9e98588d080af5c881", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136812, "uuid": "47db5464-e0d3-4c2c-8879-dd49c109ea1c", "comment": "Malware payload (Mirai)", "value": "0c2172fa392688de6ebd03b042d38fbc4339dde8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136812, "uuid": "9aaf0f8b-b762-4e41-a8e2-448b77dca26d", "comment": "Malware payload (Mirai)", "value": "9ff49a61ee37765ff1d71a7c20c1307a4e479e52e53edf10b43a71fe1e910ce71fd1631a45a3b80fa7ce2ee44a13b2b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136812, "uuid": "878cb5a1-9261-44bf-b76a-f2c4edd7fe59", "value": "T10E5161C432204BF4BFB15D92BAF6405570C9A0D2AAC75EC9E2FC64FE414CF096C916B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136812, "uuid": "c43f35fc-c019-4dff-8617-8883ead2d771", "value": "48:vzyuWz3UWz58WzHwWzBwWzdudzEWzoCWzR8WzKuWzLMWzH+Wz7x7UfWzAuWzjWZ:vzyuWz3UWz58WzHwWzBwWzM9EWzoCWzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136812, "uuid": "aa2ff01a-1c7a-4129-a23f-326dc4556270", "value": 2807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136812, "uuid": "5d5d9970-d806-40a5-b2a1-5338f58c977d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136812, "uuid": "9140ba5d-4310-4342-bdac-73d7bcff6e59", "value": "zte", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daa3af1-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101746, "uuid": "90711aac-b695-4296-b001-c756a471d2b6", "comment": "Malware payload (Coper)", "value": "739598882f1bbad69552a9dbbcc03434", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101746, "uuid": "e20b1e24-2e08-47dd-8fd5-a7bc813c879b", "comment": "Malware payload (Coper)", "value": "a31788dbc93e0e00318afc0df550f22b20a6c5823696195d630197228721a53c", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101746, "uuid": "4f63b621-6782-40f7-b01b-af40c163e88e", "comment": "Malware payload (Coper)", "value": "c528cad576defbc31b1aa9136a4f3c0d7a40ddaf", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101746, "uuid": "2a88ad4d-5160-488b-a832-618b62756a0c", "comment": "Malware payload (Coper)", "value": "c744cfa0be34a3e997439ab1d421dd1eacaf543925a65d42917e581ed6c23a5cbab4e7392e3b068773f6d36dae367b71", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101746, "uuid": "30dd67b3-f34f-4e56-878e-78fff623416a", "value": "T16D451202B3EC8613D46E5638891BC7F4A5387E44DE4253972A467B2C1E72786DF36F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101746, "uuid": "5e2e3ee4-1e47-48ae-9488-a502d8c14714", "value": "24576:RpqNwm6LkHFFWTGQV2/TLSSkzQ2+gqFPu07fvd5MQMRUh1O96QKjc724NnyGJvsd:RpxLsFuV2/TLkQ2uHd5MdmDDphGFO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101746, "uuid": "88417a89-cccb-4596-b8ae-f458177f1c6f", "value": 1176811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101746, "uuid": "d6b9acf9-858a-4720-bab0-3c3e49422676", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101746, "uuid": "6008400e-7d8a-4813-b2df-a2cd40d2e6b7", "value": "252b7fc_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a68f80-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (StormKitty)", "timestamp": 1770088235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088235, "uuid": "29a6e3b5-fe14-426c-8148-8a010581c483", "comment": "Malware payload (StormKitty)", "value": "551c2c23ae63cbc9bf2b1b88cb3ecc02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088235, "uuid": "f3f5d1cf-6b91-41f1-96d3-7361571b40ac", "comment": "Malware payload (StormKitty)", "value": "a335a711f8d6f218b2fd186d874cd807e10dbd4f532e46b6b058f5b0f8b74085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088235, "uuid": "627626ff-d992-4501-9295-96e5fb520e5a", "comment": "Malware payload (StormKitty)", "value": "ea030dd8319a4b891883c5baf7f1c4815fb85a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088235, "uuid": "ec78ca66-c1a3-44ab-af9c-dde280529d78", "comment": "Malware payload (StormKitty)", "value": "60ae4fb4a3a9660355ec3c27853198ec9d459bd82825bb923a0258dc7a99d5a9ca3cd2b6b4d4ed54fab14cf888b091a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088235, "uuid": "83cc8852-d1b4-445d-aa35-d26ee12be155", "value": "T18814C229B61EE23BD23589B82C144FDC10F955F8F0CB9A06D3055B6A27B05B2BF7D582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088235, "uuid": "222b2878-4579-4d27-a9ed-dc5227de5cbd", "value": "a60e2f996367d3f0f40289c655d2d075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088235, "uuid": "f6c99cf6-eaf9-4e8b-8725-4cedbd431cd7", "value": "3072:VONzIHNq/O4Wrz5EMIjfppzJX773hivdz6yxEZA3Xcy/PI:VONUtLz6M4fzJXpC2yOmcynI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088235, "uuid": "32f08453-d00f-45a6-964f-bd30b1c1fb19", "value": 204456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088235, "uuid": "507e874c-ed14-46f6-80a8-a81932f544b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088235, "uuid": "58d4c280-2793-4282-b825-b95850c34500", "value": "ReviewandSignImportantDocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fded134-0111-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131009, "uuid": "11e30f48-7ac2-44af-8c1a-b779023af91b", "comment": "Malware payload", "value": "24ff36beaa25da0158e9e0f04de59247", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131009, "uuid": "b574362b-dc03-40f5-8a0f-fc70079d56b8", "comment": "Malware payload", "value": "a374e301b85b8c2caf43301f5ebb66ccfd75d4a0162f3a4a1323c6c24aa8f669", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131009, "uuid": "d9ab76a9-cf74-4c4d-a394-5adc0363b5fb", "comment": "Malware payload", "value": "dfdd0f75b12570053e6dfe0997011182c1368289", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131009, "uuid": "9c6d5d35-1c76-4dc7-bd39-7461f031a27b", "comment": "Malware payload", "value": "c3614176014245fb96736a851a4e3791a9cb26dcb19bf07a7a6d30552ebfe5e2d4fef3950b0d2b9cfdf93130bfcdcb85", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131009, "uuid": "daf88a5b-f49a-48a8-8008-eac7d54c85c1", "value": "T10AE67B51ABE85625E0FB027DE139E2AD15FAFD697731C1DB3408BCDA0A3178015B2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131009, "uuid": "6929b9ff-38ac-49ad-b5c5-9f4c458f8796", "value": "d925af022d801d3a21eb63c20ea317a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131009, "uuid": "f372d39c-4333-4464-903f-5ac4b8f73f5d", "value": "98304:eJXzcJKdQpHdvm5jHupMZ/6ZauGOgK+qdYF3EQvvfoYDRgMS+Unt8zi8o5jX24Yr:e/QpFKZlK+OYrDq9ntxX24Y/Vd1ZFoWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131009, "uuid": "cc152821-492c-49e6-9b9b-8223a85bb62e", "value": 13903944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131009, "uuid": "c54992a9-2f14-455e-a016-173f3ecdf05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131009, "uuid": "093c8f31-7c3b-464b-8051-bd3a526b82ff", "value": "python38.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7c4c2b-00ed-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770115733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115733, "uuid": "1075f1ef-1697-4d6e-a5b3-bb3d66953bf0", "comment": "Malware payload (Smoke Loader)", "value": "6136a591a45bcc2c39d462676e6b2204", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115733, "uuid": "453e93c4-dd95-4351-937b-920cc496511e", "comment": "Malware payload (Smoke Loader)", "value": "a39fc2a98861dd86461e891cd22e85160e8eb5c24467a713a9d772de53e40f2f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115733, "uuid": "29157bd3-03ab-4c7e-ae6b-d7893c0edc40", "comment": "Malware payload (Smoke Loader)", "value": "f96c567a16c2d761fd896936ef25ee02050c680d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115733, "uuid": "6ee2294a-e390-4506-b108-54cfc1bcbdfd", "comment": "Malware payload (Smoke Loader)", "value": "da32b1501bf096e8f06676923cb79bb0970613ba2b616773440d985c060e1a8dc8b5f8865979beebfa8da97ab27c3fe6", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115733, "uuid": "6a9c6ca3-30a9-4c4a-85d9-27bcf6884426", "value": "T1E375125662A932FBD8379376A9A705138F30BCA49B2152BF32D8D27D09533E05236F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115733, "uuid": "49b02259-261b-41a8-a23d-c92ae0cd8026", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115733, "uuid": "fa4a1ea9-3347-4765-ac17-87c6810cfa70", "value": "24576:cg6t4320+XUicHZeNEEFopm7F2lLqOTyH+4RPoNMnZP06XHiCiPE8ICyx/VSgmgv:h2xmH0xTYdqOTyJPJnZPdwc8Inn5mJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770115733, "uuid": "1c6dedb8-9ae8-4ca2-999b-0ff6cba44d82", "value": 1649152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770115733, "uuid": "72db279a-8ba1-4b58-9ddb-943563bcaff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115733, "uuid": "be730d7c-b0c3-4c47-9edf-89c2227f9618", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9efd6eb-010b-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128637, "uuid": "3c9eed8b-d23a-4eb4-9d14-ccaea901b64b", "comment": "Malware payload (CoinMiner)", "value": "3b70e2d34ac20d289bce004962728695", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128637, "uuid": "7907d815-a72c-45dc-b61b-6d43aedd9adb", "comment": "Malware payload (CoinMiner)", "value": "a4c352fa0050b25cd7f3d7f051ad8d879ab8f15d124a58fb2eaf4a18e08fdf3e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128637, "uuid": "d89e894f-64a8-4166-bfb6-186ed8dc63ce", "comment": "Malware payload (CoinMiner)", "value": "17fbf55f7503959dc48ec60ec5f139a1ccbbbafd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128637, "uuid": "a3e34e83-eccc-4bab-a5a6-a8cf4bf3e67e", "comment": "Malware payload (CoinMiner)", "value": "4c6b496b076d4a5acf5c0e8b8f94bb979aea19fe03c31f12fce6f1f5ad8dd51c7502b8ad0d668b83126929c51ff2d1b8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128637, "uuid": "47d9618c-3aa4-48a5-992f-0ba3cbaad732", "value": "T1D2762379214C73A8C01F83755423BC85B1BE141E59F886A6B6EBFBC077AA420DD4AF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128637, "uuid": "6229781c-85f8-4038-a8b1-8fe43e05175e", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128637, "uuid": "224dffdf-dff0-4b24-a99e-2d3e26e08730", "value": "196608:OCQlQf0x4s+MsMrFACLfcibYkVTYufHoWxn:O7x4RQLfcib7Tdvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128637, "uuid": "b5f42bd9-5dfc-4740-bce5-082790a24ed1", "value": 7756800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128637, "uuid": "4cca9622-4ead-46d5-bd50-fbe38e6142ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128637, "uuid": "ba2221dd-8149-42bc-b63c-1c5b56686764", "value": "SecuriteInfo.com.Win64.Evo-gen.63631369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f31509-015c-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770163171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163171, "uuid": "c7f1727f-7391-4108-bcbd-6b4eefd947ed", "comment": "Malware payload (Gafgyt)", "value": "77057570dfcd93b6896d97331fe62a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163171, "uuid": "ba0db2a1-42c2-4308-9700-82cbaaa639b5", "comment": "Malware payload (Gafgyt)", "value": "a4e2d61d38eccbf3847379b8920238c2b5b2394d4f8bd0896df3e028fec7a622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163171, "uuid": "9f17c7e7-b5b1-4503-b91c-9a32ba0e9ce2", "comment": "Malware payload (Gafgyt)", "value": "ba552a1510114e59f67d3708edd225872de46fce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163171, "uuid": "5b5e827f-296b-4440-97e7-37e006be30b3", "comment": "Malware payload (Gafgyt)", "value": "a3a20e86337ed4bcfd27dfde8b24d072f2f11c12d3b475230a57fc24b7cf577b50a5db87eeeba654f643be4d9bcc053f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163171, "uuid": "5a8c6d49-32db-4c48-937f-9d1c6aa41973", "value": "T1FCA34C03A5518FB7C086AEB529F659300B17A8911F1F2B957138A7F8474F9CEB80FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163171, "uuid": "c6ea3bf3-cf4c-41c4-b651-8250b5d5996f", "value": "1536:edtNebBTr0CJ5U8gKQvtHEEaXCvQDk5/NOIr3Hmf4MDT43RG9u0+i:eNm3nQWEaXM/NOUHmwMDT4BG9u0+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163171, "uuid": "9f192d69-6a9b-480f-8d2c-9191b6a7ea63", "value": 104422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163171, "uuid": "be334b6a-9e9b-42c1-a61f-2fdd68f1aa7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163171, "uuid": "410df7c2-51f7-4c62-93e2-ff092d07ea14", "value": "pXdN91.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cbe5c9-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101766, "uuid": "46668a5d-14f9-4cf7-adc7-7fbc6277fc2c", "comment": "Malware payload (Coper)", "value": "d96f7bce9db5e805fe2ef125ade06113", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101766, "uuid": "be73ed26-a5a4-427e-afbc-91db7438129b", "comment": "Malware payload (Coper)", "value": "a4fd3292b7bc5800f8d9b3a3e4c6a757daeb0800cae762cf2294012cee5604f5", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101766, "uuid": "a0217d7c-e006-4241-a54d-b49fe88623e6", "comment": "Malware payload (Coper)", "value": "fabe25414f7e3d9bf1c4767613cf8d7d84d0cdf7", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101766, "uuid": "9cc2b281-623d-43f9-857f-1e4507ececc3", "comment": "Malware payload (Coper)", "value": "6b2f5d8f414b6d7b4669e1cdb11c41828dff495cab2cf0e881758ba9d00c5c74bf4ec6e20316134df260a8119ca52879", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101766, "uuid": "be1945ef-1152-4183-90f9-a5fc3a73273e", "value": "T1E9451281B7DC8A23E0BE6F344D9682E0A5353F80CF4193676985735E5D722D98E22B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101766, "uuid": "526c4e2d-d255-430e-92db-f6570c971379", "value": "24576:ka4kUBn3lXv/EWmGEgoAKRGcCb+0WSBIJMRqXPJfvJdPPukV5D:krvtpvhm57C7BIJMRQPlLPmkjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101766, "uuid": "aecf3b52-ecd0-41bd-9139-16e78872313a", "value": 1172703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101766, "uuid": "ce588e66-1080-41b6-986b-e62c086ac4d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101766, "uuid": "383a6efa-b08c-407d-90a3-4a57c71a7e43", "value": "7a62c62_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c824576-00a9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770086390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086390, "uuid": "2de0a3cb-9e70-457b-9c2e-65cbd76da4ca", "comment": "Malware payload", "value": "869b85d8004b64fbef4d4ae9d4b20f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086390, "uuid": "4a67c961-6114-4456-aed1-578cca16486d", "comment": "Malware payload", "value": "a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086390, "uuid": "9ffa7622-8ec3-4ff5-86e3-1b1a86c2c44b", "comment": "Malware payload", "value": "d7ffd7b588880cf61b603346a3557e7cce648c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770086390, "uuid": "f342813f-270f-44bd-bc27-1fbbd6c6ba5c", "comment": "Malware payload", "value": "1bd0cdc3e1ac0bace490ada8b789b69302a174cd6a12cbf753a12a35fc4e8962bbc369901c6adcd32bbaadbb5e89b3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086390, "uuid": "71e46401-5d69-40c7-9eea-b2c003151efe", "value": "T119E423255AB1C035C766233F2DB23367DBF680252ACC552743243FFA74966E7228FA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086390, "uuid": "9e664414-5bbe-4853-8249-c573576cefc7", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086390, "uuid": "40cebfda-e076-41a3-92bc-e34fa27aa40b", "value": "12288:TTAe5oCEIBor8PrGzs1Rd/eD27KTHaTjSFuUKRD5Rvdpb08bWisBP9xuNDZKn00g:TTAeuNRrMWsTxq278HaTWMx3RvdJ08yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770086390, "uuid": "46f8e5d2-8345-4d4c-af16-6abc9aba0e2f", "value": 697145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770086390, "uuid": "f97987eb-e269-48a5-afac-0b3e6e7e94ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770086390, "uuid": "36f8f5da-d83b-49bf-afec-68775948065c", "value": "_a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2a1edf-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139059, "uuid": "1efa3f34-dc26-4f2b-874f-8deb68bf3dbb", "comment": "Malware payload (Mirai)", "value": "0d65ac9038be2f9cb428fe62a3942ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139059, "uuid": "b793b994-8bb6-48cf-8420-3a16953cca28", "comment": "Malware payload (Mirai)", "value": "a5e0c62a680a626fd11b95c0a18720552e203c11bbc3c282d91e2f6c122552c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139059, "uuid": "af85918a-9075-45f7-832b-5a24783a0c74", "comment": "Malware payload (Mirai)", "value": "febe11f074644234835002770fd3e0672fc375ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139059, "uuid": "34c83722-b9b5-4a9b-af7b-914376be7f03", "comment": "Malware payload (Mirai)", "value": "decd171f86328932100558faadafc19655b95acd9ee1519515d79ab732374ecd9aba87eb81e259ac64621db379f77ecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139059, "uuid": "b54e6a62-b195-430a-b09c-dca0c6f96e8f", "value": "T12B73B649F9649B2DC3E272FEFB4912CE33271BA8B3EA71258D315B5433C5BA61429134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139059, "uuid": "5efe15c5-96cb-4abd-b793-286617b1645e", "value": "1536:KFnPFxGjTvcmSnZ/M/+SR/9cY9DMQ5MLi4SiYCM5TIu:wajTv9kU/NTcPSiYCM5su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139059, "uuid": "29b822e2-6a4a-4539-b810-e9badf4e61c7", "value": 77704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139059, "uuid": "900fdb60-c016-434c-8439-3113ba355118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139059, "uuid": "42d02c32-61aa-450a-8699-46b2e91c23d7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67638bc-0110-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770130752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130752, "uuid": "0471fba4-4fa8-470c-9070-6f0d48a98d4f", "comment": "Malware payload", "value": "947f1ade5005e4f75774a48a2fe2305a", "object_relation": "md5", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130752, "uuid": "a74f5ceb-c5aa-46e9-babb-bfc68bf28237", "comment": "Malware payload", "value": "a60d26948f0cb36a61d754ca37f0fd8c9a28bcbdfebc97226b6c8d1d7cb6e9af", "object_relation": "sha256", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130752, "uuid": "c2cdeb51-0219-4e6d-b530-53550e12255a", "comment": "Malware payload", "value": "6e75a9c49582148b118e05a851b71e8cd07a6eab", "object_relation": "sha1", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130752, "uuid": "56791bad-2e23-44c3-9353-5fe330051261", "comment": "Malware payload", "value": "c3836f98cee81cf43e297b7f64ebe6cf88230130293eec6267876a08abf44246cd6bcd4504a4a0d36cf20afd47eab568", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-241-194", "colour": "#7596D6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130752, "uuid": "ff43631c-6f68-4dee-b304-5c67532176d6", "value": "T102768E31E2459021D4FE1B7F93BE8AB944A9BD141BE7C0C3A98478C84A716CF7DB524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130752, "uuid": "f66c108c-1e64-4a49-a08e-365d40809a66", "value": "d925af022d801d3a21eb63c20ea317a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130752, "uuid": "307f8310-bb8a-49a8-898f-51d3b4d7e8d2", "value": "98304:0JXzcJKkQpHdvm5jHupMZ/6ZauG8dJ2/J3yjkbBphD5PB2AW9RJ4tn:0OQpFKZ2J2/J3yjkVphD5ZKJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130752, "uuid": "cb05f21f-4c03-472e-bebf-942f32728eb0", "value": 7503472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130752, "uuid": "2e6dc4e8-8879-44e6-9af4-5ca5c1d64497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130752, "uuid": "c8d05a86-f10c-482a-b6e4-a6dfecb125a2", "value": "python38.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f95fe7-00ac-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770087610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087610, "uuid": "f0ecfade-6bf1-4022-a42c-7959195b417d", "comment": "Malware payload (GuLoader)", "value": "d3265b00d6e30468b97e6b9d893a961a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087610, "uuid": "65df8996-4d7f-4472-82f2-8b02c1f89553", "comment": "Malware payload (GuLoader)", "value": "a6e6ee5378cb721a0b661380e3af01cd95629cf13e1d0248a1e7f78a2092b2bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087610, "uuid": "9a9316ff-a627-44b2-a29e-3829d1f7307d", "comment": "Malware payload (GuLoader)", "value": "f0d6ee449c33cae2539e1868e3c277bc81219005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087610, "uuid": "06502d24-6f37-445a-b720-44b507cb0925", "comment": "Malware payload (GuLoader)", "value": "78ffa13840148486bb0a0e6a3b04ddfbcdb09a86e4d1389f648d8a330a450f98137088c7f4db415ec6fe5393162f4993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087610, "uuid": "1b05a69d-23b2-4dcb-98b3-0ef9bd31e832", "value": "T1D494E1597B18E2A7DC1A59718DB3D3CBB2F4FD206A854A133266BF1E8C313018E1A75D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087610, "uuid": "736321a6-926b-45e5-909f-b01ef0bc856d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087610, "uuid": "19697b7c-6933-4c6d-b9b4-c7449e0d07fe", "value": "6144:xIw3idCURpOvh/lCMMzDWm0PfGT0DmKEo7aV3c4kZcNXNUQUEx0SExJ8oh:uRUtsMMWm0Pfg6h7UoZGdCSEsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087610, "uuid": "748ded36-cb1b-4ddc-a2d1-a5984c44a43d", "value": 414408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087610, "uuid": "17483766-6a73-4641-8c47-b7ee7f2c32ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087610, "uuid": "60f90c57-ba17-4db3-a393-425f973148ba", "value": "r0127ShipmentPreAdvice_00060343_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ff0508-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101740, "uuid": "b6e73524-1e8e-4b91-869f-0af5f8c2bdc1", "comment": "Malware payload (Coper)", "value": "51c2c426e77647a8ddacb9e672a2bd0a", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101740, "uuid": "8ce8a90c-e793-4e41-954e-40e927508208", "comment": "Malware payload (Coper)", "value": "a764bd1b5f0f0ea0554eec5cebf111f56ea5e9969391e467a45c46ff96309da4", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101740, "uuid": "dbc2116d-41c4-4cc5-9dbf-54e79dce13c0", "comment": "Malware payload (Coper)", "value": "ca82cafcbf57b3e456285aa4cac8a5d48917998f", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101740, "uuid": "3ec76f03-6849-4d25-be6f-73b0e6d4cb13", "comment": "Malware payload (Coper)", "value": "939dc5a407a0fdf58c4cab5b8bde32f4f2318afcdddff4b0f5b91bccea6a422340727960d60e581fa05f8503f37d1120", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101740, "uuid": "840256fe-e8d3-4fe7-adbd-c0ca6fe7d07a", "value": "T1EA451202F7ECC513F4BE6B788919D296AA32BD85CE41475B2641B71D0D316C1EF22FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101740, "uuid": "6fd564fb-74c9-47f0-ad50-88b2d9dbb5e1", "value": "24576:8IPZnFLwWcA44SO+gkOkB0Rh2zJ/dOPAiM31P1keBWBAndBWrXVhk6MQr6ixJ:8IPbw9E0gfRh2zJd+A31uebdQB+eFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101740, "uuid": "b17b4bfb-5da6-4cac-8fcf-6d8dd5620cc1", "value": 1176811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101740, "uuid": "699d041e-e9fb-4c14-b0c9-e15fc36dcbdc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101740, "uuid": "9d7d56f4-2284-4b8f-9b89-696705d2ef84", "value": "0c80cbb_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b733c8-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136797, "uuid": "b62deb2f-65c3-4e45-8fb7-88d78b549e72", "comment": "Malware payload (Mirai)", "value": "87cf7b05e5445c09cb8c9e19f4773ee1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136797, "uuid": "c9f1a94a-1923-4725-93f3-f4c9f2f873a3", "comment": "Malware payload (Mirai)", "value": "a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136797, "uuid": "d79633c5-b9fa-499d-b117-df88ed67765c", "comment": "Malware payload (Mirai)", "value": "a7335fd0f10d9fc35942ad44c85c5bec7568365e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136797, "uuid": "d04ae72c-125b-4da5-9289-937e39e3c4c6", "comment": "Malware payload (Mirai)", "value": "b6ca3cfddb658935ddf76c6d479e5f2321413d771e35dfa7b4d6e4e2bd5ddf9665bfe313e04d446474de055cc144138b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136797, "uuid": "ebf45a93-6de2-4080-8a8f-01e510804561", "value": "T17151D5C432204BF8BFB55E92B6F6412574C5A1D5AAC70EC9E2FC24FE054CF096C916B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136797, "uuid": "e940627f-0b89-4577-8ac3-3ad052f22023", "value": "48:vzyuHWz3UHWz58HWzHwHWzBwHWzdudzEHWzoCHWzR8HWzKuHWzLMHWzH+HWz7x7f:vzyu2z3U2z582zHw2zBw2zM9E2zoC2zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136797, "uuid": "041c6dcc-9e6a-49f9-a90c-4ca2bbd354e4", "value": 2821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136797, "uuid": "2c530e5e-5cdd-4be6-af22-9fd84e412bb3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136797, "uuid": "0a29354d-41d9-4a05-a5cf-a325e4fd108c", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdad437d-0108-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770127274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770127274, "uuid": "932de238-07d4-4e8b-93a7-7c6bc8f0c37a", "comment": "Malware payload", "value": "c7ba85ccaaad2b0eb7652d8abcd2fa47", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770127274, "uuid": "a68b3817-77ab-4abe-87b1-492ac6f46767", "comment": "Malware payload", "value": "a7a14e8740be1c90c2082c78741e54e91ebcdc16a37ee3eb9384b32bd5b10a15", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770127274, "uuid": "18cdd941-49cd-494d-8aa4-3550179424dd", "comment": "Malware payload", "value": "a2421df90e172af41c6f472fd28bec4dcb70c6d2", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770127274, "uuid": "ac6ccda2-4039-47ec-880b-2d552e7e84bd", "comment": "Malware payload", "value": "f1988deb8e3206288632a318cc8e8f77352a6ef834f29ca3858531e2735b67c0d7650cd3246d3e7c500c2f6016dfb61e", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770127274, "uuid": "62a751d5-77f9-4bca-9b8d-4cbc02af4edf", "value": "T1EB413BCA1EEAE5005CA59D729889D839F388A967308CE6786B640FC04D0C271DDDA88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770127274, "uuid": "88af7c3e-9adf-4d05-a810-d8aa13ad8a26", "value": "48:ZS2ong8Gky/roZK7r09JH5W+EmubNeZ8Y6kqfbrPxoj:ZSHn2l/rSKY2mcs8Y6kgP6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770127274, "uuid": "c15e7ea0-3f3d-4d62-84fc-5bdb0c144ab9", "value": 1896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770127274, "uuid": "25163376-debf-4891-93d7-79f952fe41a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770127274, "uuid": "bcf6fdff-6726-4ebf-93c8-b4db9fa2912f", "value": "nRichiesta_di_preventivo_-_RFQ20260203_Listino_prezzi_commerciale_pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a2237a-015c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770163013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163013, "uuid": "8a1f8eb5-5656-401e-b17a-79d9b90187ae", "comment": "Malware payload", "value": "99816974d8873a10332357948cd3d088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163013, "uuid": "2f2840ba-3f4c-4896-a919-d59a4b9f0633", "comment": "Malware payload", "value": "a91a3aa27ca336433e1db0061816aa57b63d7263bf87c458795f857f7a0a0042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163013, "uuid": "0c7dacac-8828-43b4-9467-1e20e8201501", "comment": "Malware payload", "value": "686a180c866891b2311d130c9b2f3216a78b5144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163013, "uuid": "75a7e247-d0f1-4165-8bda-d33aa44df034", "comment": "Malware payload", "value": "3f5286b8fbd1a831966a3bb0c4c2b39c102929948ee24bcd96142cfd46e12f2dc7e1bb7500aafe85ea9ec7127b159562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163013, "uuid": "cb52f575-4ca1-477e-a45c-aa569c2b7074", "value": "T11D7309CABC858B11D5C526B6FE1E218D33174B78E3FA7113CE185B2E634AC6B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163013, "uuid": "719ab766-aaaf-4e45-b399-9c8961ea4f96", "value": "1536:TGnKE2gPI9Pd1ce2Me6OKJEYvYf/cmKBsxn6c+FVsHM9iOGf0KL6:jgPub2MZOKJEYwfkmKByoGfpL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163013, "uuid": "237fb498-57b7-4078-abb6-60cbd6406398", "value": 76444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163013, "uuid": "1635f282-7aa9-43d2-bd5e-8822a2b23411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163013, "uuid": "1215051b-fb41-4a43-833a-9d7375d738f0", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4647cc-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136800, "uuid": "721b4f74-66bf-40f7-9353-0ec552bb61ae", "comment": "Malware payload (Mirai)", "value": "dbe44f41c1fe6c39f98e1dba063dc58a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136800, "uuid": "dc84ba1c-98dd-4a17-8350-b17c1f1109ee", "comment": "Malware payload (Mirai)", "value": "a9251992cc292e6f756d1feb638d70cb7505bcadedd367c822ba9e666cd095ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136800, "uuid": "0e8e0f05-1e5a-4632-98ce-14ade2ba18fb", "comment": "Malware payload (Mirai)", "value": "182032c3b4640e0e6a5cee4c08530c9597ebce77", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136800, "uuid": "2b69faff-c14f-4d78-8497-5b99d23beb96", "comment": "Malware payload (Mirai)", "value": "8d4532b8d8471c7b043d64e4bf2e34231a490451fe1d23437aa7a720caef49594debf14107bff7132e87eb6c1cc0f065", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136800, "uuid": "a056d327-a297-4653-b000-0ea413f00e78", "value": "T1DE51D1C432264BB4BFB25992B6F640557089A1D1EAC74FD9E3FC24FE014CF0A6C916A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136800, "uuid": "f4813e40-bbc6-42fe-8f95-c6be906a0da8", "value": "48:vzyugz3Ugz58gzHwgzBwgzdudzEgzoCgzR8gzKugzLMgzH+gz7x7UfgzAugzjWz:vzyugz3Ugz58gzHwgzBwgzM9EgzoCgza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136800, "uuid": "f7f76865-2420-44c0-af8e-b08a34311923", "value": 2849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136800, "uuid": "8d6992c5-470c-4e68-adc9-801c4c96c8cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136800, "uuid": "1285cbc3-99b9-4ce3-acda-817a11959f2e", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12b3c4e-00a3-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770083820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083820, "uuid": "1cbfbaec-1bc9-4655-9264-21f8e0107d3c", "comment": "Malware payload (Vidar)", "value": "bdc6c166e2224dbd227939201aa57d7a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083820, "uuid": "7ab7a10b-0d0c-4e22-a9b5-cfcfbdc4c1d1", "comment": "Malware payload (Vidar)", "value": "a9b0c2ad5ec288376408e0527875484ecfad275487637111265feaba7f92ea05", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083820, "uuid": "c2d05fff-cff9-4ed7-b3b4-b76b1f4c31ec", "comment": "Malware payload (Vidar)", "value": "35bd2f506a9491254571991c15dcbad710ca7630", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083820, "uuid": "a9c48a70-021e-48dc-8bfa-e038d751a098", "comment": "Malware payload (Vidar)", "value": "e4938e9889e7fa7feb0157bffe69387a67a0b2e9487839c4e100214eadb7b2ff8bd43d094dbd8cca29034e93b8165220", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083820, "uuid": "2d751958-29b0-47a5-8628-3bf9e3bcdded", "value": "T1D986297FB2959268C26D863FC4A7CF40F5F371761B33C6E7129007A88A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083820, "uuid": "3a0ac644-7f34-40ef-8290-8850225b7693", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083820, "uuid": "d551dd27-1830-4261-95bd-19328c8371a7", "value": "49152:iNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgAQ49dpCMEUcWWcu:iz7Vp7cQ49d/cFcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770083820, "uuid": "ee29be71-5c5e-424f-89aa-2ddf3d05c181", "value": 8484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770083820, "uuid": "73a1c210-6232-4be4-a6dc-147e6799a508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083820, "uuid": "255efeec-0937-49dd-ad1c-1ae788e790e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59919e6-009a-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770079989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079989, "uuid": "0ba5e250-cf03-47c3-972c-61a0bf5eed02", "comment": "Malware payload (ValleyRAT)", "value": "b881ee902102572a85080bec53767b0e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079989, "uuid": "22b60dfa-3f3f-48dd-ba7b-1b96eec266ec", "comment": "Malware payload (ValleyRAT)", "value": "aa94291f9f25c61f4ef1181043c6c402b238774620603716ceea6412a9f29cc5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079989, "uuid": "521925e4-e0e3-4fc5-a87d-6cab09d68dd9", "comment": "Malware payload (ValleyRAT)", "value": "b63153bb028bc0145d312e162447ab3e4a76e301", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770079989, "uuid": "89972fff-0260-46ce-abd1-92410d1820f8", "comment": "Malware payload (ValleyRAT)", "value": "caef512185b686ef12ad5cb08930e2cd7d42962c0dbd14f3a6765abaca1c74c6b944192d284093d7b25dde366eb947d4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079989, "uuid": "d0a8640f-0ab7-4146-b5b5-891d46a00615", "value": "T158E4239F065A09406AFAD680A90F675CDF96D16D72D3C28F2F1B25381123ACF41DDBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079989, "uuid": "f2cf8e65-cb3f-47c1-b579-f03fe78ca7d7", "value": "12288:jthfEByFfRK6bhiNq9Ep5UkOgDJxN+9IAjSN7d2japGxD5n7:XEBoRKzmEEUD5+9JjSNBEd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770079989, "uuid": "fd935240-69f7-4e5b-bada-9c55654d95fa", "value": 702145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770079989, "uuid": "f942432f-0efe-4108-aa66-58c081584f59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770079989, "uuid": "6489c2bc-f155-42ee-9dc9-c176764c2e46", "value": "E-Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea86c819-00df-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770109713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "0d2c4fbd-c3c0-4a4a-a6fa-1f8e769b1dc6", "comment": "Malware payload", "value": "7b34649d5cf5958d5ec1884fec1c579c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "b80a21e7-52c6-48f1-9bc6-bb298c164058", "comment": "Malware payload", "value": "aaa3c4cd6bbd0b1f379e27cc85e5b67cc7df19f78bb751fa4a0893c6b9d7eb19", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "b2704680-ff0b-494e-9728-a70facf5c605", "comment": "Malware payload", "value": "9bd06e0c5eab703d8d672326bd710ea978399d9a", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109713, "uuid": "9f0f0b7f-34ba-4a99-90cf-19682bc63fa7", "comment": "Malware payload", "value": "e448bab7dd24bb55c219e85529f1b3b2376ec06376c8bf43e7f2f133f224e579c74c85188780d5ce3777c7d2328235f1", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "74919e60-a637-43d7-bd77-94cd785c3c72", "value": "T123C1DD026A64386187634C6AE4364C01321F3DABD69A7C2CF5DC81D19FF6631DDB9E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "ec12eeea-f0db-484c-92a1-e29c7958795a", "value": "96:VbrG5wQ+ELx7yAzgIGmz1cLBYiOjG6CjlvPgbOO:VHvMRgBE2YevoqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109713, "uuid": "a865d81e-8796-4925-bb98-2ad42d23d22d", "value": 5906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109713, "uuid": "eb636a58-6ac9-4a81-b08a-74183721cbb6", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109713, "uuid": "ee802739-528f-4fc9-a1fc-8035164f10e3", "value": "aaa3c4cd6bbd0b1f379e27cc85e5b67cc7df19f78bb751fa4a0893c6b9d7eb19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91495cd3-0136-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770146930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146930, "uuid": "c11c3c24-62ef-4be2-b956-e64b1bf0bfe9", "comment": "Malware payload", "value": "e6b92c70b7d35dd865a1de4ffddda8c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146930, "uuid": "ab15f0e5-d407-4303-ae7a-211b840fad57", "comment": "Malware payload", "value": "ab1dbc5af7a80134c1752a10bf53202b40b0b51a96dcbafab1037b0d7723c8c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146930, "uuid": "2ff1d048-6ed9-44bb-92a4-06df74076ea9", "comment": "Malware payload", "value": "00285d0c9f8a7f503c5e1dedfa7c8fcf3f31301c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146930, "uuid": "d265b2f7-ed89-4add-aa18-c3db32c20f8b", "comment": "Malware payload", "value": "b1f64257ec670cadf8c72e965e113fdb6383b44e0aab08267db2e47284905542423e9b4e8edbbb42a280033d36679d6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146930, "uuid": "f7d38c7b-09b5-4f14-99e1-402b87f314dc", "value": "T1235533B787D44161C2411FDE811C9B86E60AB8AD2CE17C5BEC02D974A53672FFA211BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146930, "uuid": "8bd7655e-9c44-430a-81a3-a1a83125d85d", "value": "24576:NX1GTAUogoGmMDF2762AjSNSjsUTW92JWdXZZKiO3dVFf9xUYmo:NlGTC6va7k62JcJkn3dVZQjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770146930, "uuid": "42382c0c-f9c3-40d9-b171-fef1196bcee6", "value": 1406447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770146930, "uuid": "15c33e28-9872-4040-b26e-ea91f102c22a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146930, "uuid": "3f3f47a9-16ae-4506-a979-58bc8ab62e5f", "value": "bizy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbdea9e-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140159, "uuid": "45d853cd-dcd1-49dd-bc59-0ba1af275f47", "comment": "Malware payload (ConnectWise)", "value": "c0f58ee96c21113b03f67950df700199", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140159, "uuid": "21d61ddc-2e70-40ec-b293-9f43704a5d9d", "comment": "Malware payload (ConnectWise)", "value": "ab4e3cdb02791dda97abd220f89cd5e9f0ba404d48b87e17213a526674729abf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140159, "uuid": "46c1b3c1-f77b-46b9-b0d7-837e2e6e2f67", "comment": "Malware payload (ConnectWise)", "value": "5a7c435e2da39f3e6725a898826525fdafda9d33", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140159, "uuid": "522744ce-cc5d-4cca-b150-ae1d9aeb78af", "comment": "Malware payload (ConnectWise)", "value": "3a99c92f6f8e0a0cc7879ae626886ca5502f398cd1424181b9f841e036881b1026b0e20b45bfa2ff4c606859cdfc8670", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140159, "uuid": "550ba344-aadf-46b0-a085-bae1c0e3ad52", "value": "T1F846E00FE3A2456AFD7792B1E963850BDA703C472539B60E21A5F6662F33523411BF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140159, "uuid": "227928f2-b4b0-40ee-be17-8d70ba6f8103", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140159, "uuid": "89cfdda3-5f54-4d8e-be8b-3f1493824a3c", "value": "98304:NUyRu5fp1ksAafByB+ZkfitnfoqRBzw89fIoe4sKnIiYpyrtH45z3uFLrp6:N72vW8ysTlrfy4we1458Lrp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140159, "uuid": "976e9516-e33f-4acb-b249-02a20e6d0b0c", "value": 5695488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140159, "uuid": "364dccce-48c7-4bfc-b6ef-dcc250b63fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140159, "uuid": "922a8503-979a-4799-9693-3eaf1e5bcc1e", "value": "photos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fec9e97-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139062, "uuid": "52d1d1f3-8de0-4972-9cfa-830586bf9ea6", "comment": "Malware payload (Mirai)", "value": "38632f659968a79a2a7b53d0f4414e1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139062, "uuid": "108fab9d-f365-4cff-be48-7f2af8cc570a", "comment": "Malware payload (Mirai)", "value": "ab4f429b4cd899984ddc5aa0f138b08d8bd2ac6ddde9e7793a019e6041dc7132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139062, "uuid": "681cb2ab-9b97-4a2c-9863-4409385e6bb0", "comment": "Malware payload (Mirai)", "value": "0b873362e5f08c35cbfffc2ed85159d38e00d69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139062, "uuid": "a89e04fa-dd2d-4f4f-b71a-278709f30dbf", "comment": "Malware payload (Mirai)", "value": "b91d643b7a65c87c82ac5fa28198a4da8128e751ee6ab16ca5e31ce3339c7607be96ab74535c6e7ceb699128c31ce228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139062, "uuid": "4ad6feac-20ae-4b25-9c57-1504b069bfd1", "value": "T160732A5AB8819B11D5C116BEFA1E118E3323477CE3DE73129E24AF20778796B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139062, "uuid": "e2f2ae8a-8e17-4474-9a05-d34a14db959b", "value": "1536:SDnE7mi6DajEVRLD85PQObqaKK2NQbMui/1GnJcenm7de5YYNz:v7Z6D4+D/ObqaK71GnJcenmZeauz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139062, "uuid": "da14ef09-eeae-4290-8902-07b71480abf5", "value": 75348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139062, "uuid": "2a662474-e4a1-4c68-909f-6efec3dbdf5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139062, "uuid": "0238be79-4c53-4465-93ab-775f56607e6e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69b10bb-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140147, "uuid": "ce8f144d-9c3b-4ac8-9148-f71c7600b9ff", "comment": "Malware payload (ConnectWise)", "value": "5580fdb662ef2417e24d1b1e4ddef964", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140147, "uuid": "a55ca2ed-e9c3-4543-a38e-4ac3a1b7103b", "comment": "Malware payload (ConnectWise)", "value": "ab7f46ba4ba3151919b226ea0aaded462a6a8de66e9575f295ae7b7443e27f77", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140147, "uuid": "f8f4c4b6-6008-4fc1-bf99-4f45a30bf83a", "comment": "Malware payload (ConnectWise)", "value": "1604912c5fb407904bc259acf5c84c00023726a8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140147, "uuid": "eafe35b0-a7d2-46dd-b07a-1337cbc5d295", "comment": "Malware payload (ConnectWise)", "value": "b3250935afdd6f3ed6f9c1cb56e694819e0d7158c91dba45c43a0a21e644953eda901de531c7e15082f4ec2d6170ef4a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140147, "uuid": "d6643c5e-1fe5-443a-8c82-13c1f7211174", "value": "T1D9A6231172E58179F1FB0B39FD3A91B16A763C699E63805F1394391E1A72E50CAB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140147, "uuid": "dba0759b-e547-4ded-89bb-bc207df2864b", "value": "196608:ZZJbjFd29rxmGZJbjFd29jZJbjFd29vZJbjFd29:Z3b29rwG3b29j3b29v3b29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140147, "uuid": "8af5c219-4753-4e91-b2b5-24e443e37538", "value": 10067968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140147, "uuid": "6093b123-c068-4073-8480-369f2d59711e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140147, "uuid": "99a9b60c-81c7-4460-81b0-d79aa4e6a220", "value": "Reader_7732_install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3faa467-00ab-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770087342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087342, "uuid": "31d34c61-8d15-4f31-8165-5e5953b24f35", "comment": "Malware payload (CoinMiner)", "value": "8791b528428a3478cc7739caab004903", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087342, "uuid": "2fe4040f-539d-4436-af03-c2620bc56c3b", "comment": "Malware payload (CoinMiner)", "value": "ad5001254df2ea5b77542d3b0fc090a993913acfd661298c2a630924644752e2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087342, "uuid": "1d0d12b7-8777-4073-b7cf-8ff1b6acf9bb", "comment": "Malware payload (CoinMiner)", "value": "226fd3e877e7bc27ed65b56e9ee56cf1907df682", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087342, "uuid": "9ad39953-ba85-4b5b-8f44-776259a29b03", "comment": "Malware payload (CoinMiner)", "value": "d0a2c5ac48ffcd381fc74a54b018f4915d059b19e68dea0f646d8ec6af00aac34815c3eb6cc33b8e36b61fd4886b6c10", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087342, "uuid": "8203d30f-3363-433d-bae1-7f871b622c98", "value": "T1E5A5011153EA9310F17B037A557187004BE67613EEA7EF0963882CEB1DD37898B5A27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087342, "uuid": "60a17948-d8fb-402f-892f-231a28a61384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087342, "uuid": "7f4af71d-c622-4f31-a28d-29f011cc95df", "value": "24576:qp/aDrODUhgHAri4hKxK041pkqWI3XlZfa5BvT3Vp8/d0kOvsk6YgtsP5GPDHbGU:wTDeri4lXUYlp0vb60k9NYFPwDHb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087342, "uuid": "802b601f-5e25-43ac-b161-d0b86a85e2e0", "value": 2064896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087342, "uuid": "0f9c54db-0094-4cea-b008-8b9990b8a270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087342, "uuid": "a4e3c012-2232-46c8-ae17-5f6a40443a86", "value": "injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ef575b-00d8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770106436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106436, "uuid": "f657718a-8a3d-47df-91ec-f57b09d55196", "comment": "Malware payload", "value": "1ab25af2932c3727df208b17affb4b59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106436, "uuid": "3ecef77c-a9b8-4b5a-9189-dbc473e2ee03", "comment": "Malware payload", "value": "ad50d95924852e481c4960d9e7b874f96618c4fa92a2e572deee42c25a33779e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106436, "uuid": "439a6174-7dfe-4c58-b705-45cf49d8f15d", "comment": "Malware payload", "value": "217b99a9f914aae716b4ee11f838f1255285f4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106436, "uuid": "2bfcdd90-3381-4e62-be92-ced07be3f540", "comment": "Malware payload", "value": "b7c8ea7bd9aed16f772cec0628fb19d086cd6566e03b4564d46dbf411a85ffaf75fe80a34d3bcca0acbeb631ab79ddc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106436, "uuid": "1512841a-fe10-4ae9-a9fe-7b69f7df49f1", "value": "T1B9D4090AAF501EFBD86FCD3746A95B0A34CDA84736893B753078D814BA5B50B89D34BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106436, "uuid": "98eb7c1c-afff-43bc-a3fc-0c3619a693b3", "value": "6144:BijssFWt66RxxNhs2Z32dpfwmuTZBM1NRumflE6OHyCH/iKP16Cp4VtH:rsFWt66RZg3f2tBM1zuclFOHigp4VtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106436, "uuid": "dfc08d53-0219-4e0b-8ce5-055b31a3c4be", "value": 639080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106436, "uuid": "62c91de5-2a70-441d-9b09-ab5007129b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106436, "uuid": "bbce2a71-ac73-44c7-a75a-993f1b175afc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2b93de-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136801, "uuid": "e3035b14-5b56-45c0-a67b-995dd00d72ad", "comment": "Malware payload (Mirai)", "value": "16a4479649665890b1227bc0c5ade97f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136801, "uuid": "7bc2519b-7aa3-44a0-8941-86b090a2b9bc", "comment": "Malware payload (Mirai)", "value": "ae11a50715d4f0b2cb689217ef8248da401f9a4ea058afb032f3f1121f336bc5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136801, "uuid": "18a000e1-0e26-4075-9fcf-b6d1af038b2e", "comment": "Malware payload (Mirai)", "value": "8834d49930ebd122d3c4fb9e7921e216a602b87c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136801, "uuid": "0fcddb69-ab6b-4081-a2f2-cee854535e84", "comment": "Malware payload (Mirai)", "value": "db3b008c16a34c5dad346a122904acd715684bc4aa13cccc3afc45d0746a4433f3b4e93650d01e9029362cfa7856280f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136801, "uuid": "e4985c2e-c47e-498e-a767-055e19985a7c", "value": "T106515BC833208AB4AFA15992B6F5801570C9F0D1ABC75EC9E2FC65FE414CF0D6C916A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136801, "uuid": "824a03ae-e811-4b05-9b97-22ace25a07ed", "value": "48:vzyuKNz3UKNz58KNzHwKNzBwKNzdudzEKNzoCKNzR8KNzKuKNzLMKNzH+KNz7x7R:vzyuKNz3UKNz58KNzHwKNzBwKNzM9EK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136801, "uuid": "5d96d43c-1fe5-4368-b13a-18b8e53e3091", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136801, "uuid": "e1c7d5fb-267f-47bc-b443-ad48a751caf3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136801, "uuid": "f0e87335-357e-4236-9bd6-bcf431d7ec48", "value": "pulse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3df0ba-0123-11f1-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1770138543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138543, "uuid": "241406c8-c592-45e9-9ddd-185db90e2b81", "comment": "Malware payload (MaskGramStealer)", "value": "b07daae9fede9aaadd5e9e342c7c3833", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138543, "uuid": "3de0351c-970a-4315-9084-c341d6f10ad0", "comment": "Malware payload (MaskGramStealer)", "value": "af8adb44dd5bdf5d68760c0949bec5b06736e33f4aa2368bd9dfa150c24c139e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138543, "uuid": "b298d3a4-c0fb-44c0-9aac-453d1d967b63", "comment": "Malware payload (MaskGramStealer)", "value": "6c8e01b0908974bca9e4b5c87c95c685c94fd848", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770138543, "uuid": "c4de7e2c-f4dc-4d34-a919-4f50dee68b79", "comment": "Malware payload (MaskGramStealer)", "value": "b2048fd5ac2040ff7715133bcafc14a803ea63159656ed3f22b09ec1f61adf777dea27040717dee0c71b42beb658c804", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138543, "uuid": "a7647d59-8c30-4e29-adc2-cbea09aa3031", "value": "T1CCC6239659D593E8C4D34700798752DB70C0731E84EE9D1E3ACB6C03A271DAB858BEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138543, "uuid": "15d293b1-ef5c-4cfe-b5ed-84dd51656176", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138543, "uuid": "d7da2365-49e2-424f-afd3-1437695e6977", "value": "196608:rsY+X75k+vBj6h8rkMwR9UltDbAb5YJd1IWz0B2+xgKcnAh8J6lgIJLv65:I8+Jcqkj9Kgb5YJd1I+0BCKcnAh8Jkjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770138543, "uuid": "2fc3e009-621e-4cb3-8d80-8c8a0c374c9d", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770138543, "uuid": "08d62bc8-847f-455b-9df5-b0310f2ee479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770138543, "uuid": "1ac93cc9-34bd-448d-ae49-ca9c0f9a0c62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a53ff31-0139-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770148126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148126, "uuid": "5d1a7e3d-aa9c-4e6c-b0ef-ce9ac2541ed9", "comment": "Malware payload", "value": "4540b9550521858a46ce0dd0892dca76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148126, "uuid": "64e9d75f-72e7-4c76-9fa0-77c555fd4b28", "comment": "Malware payload", "value": "b15691ca929ca06ecd262275b0a67b9e5ded46a98a340a4f75c750fa7a341244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148126, "uuid": "1f935089-d449-4439-8762-c20be233e72c", "comment": "Malware payload", "value": "b72118982d4db689237c1bce442523ee8ca76de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148126, "uuid": "af591c9f-d8ec-4d21-b150-b24287cb6b47", "comment": "Malware payload", "value": "66e8b32f78b5626a9722b221281fd35dac516f18d7684d93b1716f026229fdeb1478693bc33b61b11dfc5def99775947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148126, "uuid": "f06df82a-4102-4542-afef-fac1d4bcac4e", "value": "T10FF733DC4FFDB07CD16260B3A2484FBAA56EDF0E068F06B8997B29F9B551434061C53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148126, "uuid": "06c4b8e4-f779-4c57-acf0-3a4497a145ba", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148126, "uuid": "b30bd322-a2e3-4e1f-98c6-14bd93d84c31", "value": "1572864:5UejOYfX0IQqg+ZNU1AWyGP3yxoWuEn6I7plQoXpABsWYoRJ1+1/rPnd:5U4/0esvyGP3yRu+p7ZY+oF+1j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770148126, "uuid": "98d70d52-18bd-45f6-99a2-4dc44cf25a41", "value": 74999074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770148126, "uuid": "30df2e9d-698f-4a54-85f2-8a3c398a48f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148126, "uuid": "f44076cc-72c8-487e-9717-15940ebd683d", "value": "b15691ca929ca06ecd262275b0a67b9e5ded46a98a340a4f75c750fa7a341244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ea85e0-009d-11f1-a129-42010a9c0007", "comment": "Malware payload (LClipper)", "timestamp": 1770081386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770081386, "uuid": "ac585d00-7349-4a09-bbce-57422fd8a93b", "comment": "Malware payload (LClipper)", "value": "893fa59d7b5eb2c36f270e40c1df64f1", "object_relation": "md5", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770081386, "uuid": "e94ee849-cc0d-43f0-92a8-255356053000", "comment": "Malware payload (LClipper)", "value": "b1963848120a2c7b31a6a816a09c0d7391b5cca1e3234a2f92adccb8bbeca2ed", "object_relation": "sha256", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770081386, "uuid": "808525cb-8a42-4913-a9a4-0f61cddad829", "comment": "Malware payload (LClipper)", "value": "223b6911a5fd511fb6068e2bac96510041a3b375", "object_relation": "sha1", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770081386, "uuid": "1592d199-b6ed-4d94-bf64-bb261d9fb2a4", "comment": "Malware payload (LClipper)", "value": "31159b27dcb50f43f24df350b82137676f260ea79b2f8197b53de48e32e2b28e0e293ec0a47d58887fec5dc7702c9fd0", "object_relation": "sha3-384", "Tag": [ { "name": "BB1.file", "colour": "#D5282F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LClipper", "colour": "#DBF740", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770081386, "uuid": "df97cdf5-a322-403d-9b9c-21e045879c6b", "value": "T134D46C91AE85CA53C9370EB547B6C33883B6DFB8BD534307A4BB7E2DBC366452901252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770081386, "uuid": "f9a573ea-77d7-4165-9205-a0a9780bf3ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770081386, "uuid": "73e42b85-de8a-4c7e-a1d5-a3f9c460e064", "value": "6144:57L9gg/62WcaLDC02yzsXjCn8o0CC8OhrhajycWaMN+VO3YHlZWHEnlKS:kgGLex08oBLO2WaDnll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770081386, "uuid": "22e9d0f0-dfa6-4457-9843-4134cb4e8339", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770081386, "uuid": "58c58ce1-30a2-4164-a0ee-0fc24faa9493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770081386, "uuid": "d1aba0f3-4bcc-487c-86d2-76a395931440", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bda1be-00ec-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770115052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115052, "uuid": "a23c8921-1a1c-4b06-b65f-e8338b06af77", "comment": "Malware payload (AgentTesla)", "value": "ac8225def4b494cd74a7f8f480fc99da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115052, "uuid": "7eef293c-d6e2-4523-afef-679ea0bdf27e", "comment": "Malware payload (AgentTesla)", "value": "b2c55968ebfa683dde47a788acb0cea62d164be955460d11c8fb2bfa21004311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115052, "uuid": "d9792ee0-0f43-4121-92a5-e8d6ba48d40b", "comment": "Malware payload (AgentTesla)", "value": "8f069c74aaa02e655a984be37017ff229b9708e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770115052, "uuid": "767e7cff-6fb5-4162-81fe-3bb48b3708c4", "comment": "Malware payload (AgentTesla)", "value": "ded75ca16181b08231b93d802068aa056b4760eccd9779904581bfd56770bca89a22227c543c59b9e105dffcca4e5f44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115052, "uuid": "c6c1e424-031d-4d61-b71e-7ee55baf1905", "value": "T12F2512A91651CA27D2E603B41972E37563B84C9FE402C31ACFFDEDE774152B06A183E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115052, "uuid": "a45be8f0-b713-47aa-8fbd-4a21e1f256d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115052, "uuid": "f2b12dec-52f5-4054-a02b-3109f88c29c1", "value": "12288:kddx3V8Ytpe0elxTHRozWCp3PwGIol9/V98iCTPKajpdr/Gvxs1gt72WCvIsxOC/:kddA3H6zfV9t91CLNdrGiCt722zOCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770115052, "uuid": "0d912fcc-16c4-4d39-ae1a-619f83315a7b", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770115052, "uuid": "8ab8e0b5-9eed-4833-9894-b7f8e056e607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770115052, "uuid": "115bfefa-8f46-4296-9170-578a3aa57276", "value": "14861-TEKLIF FORMU.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11068231-0094-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770077136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077136, "uuid": "936029e3-3bea-41d5-8f71-03ed9f1179dc", "comment": "Malware payload (Mirai)", "value": "9c0e5184eecdabd0fe6a5c76e1a059e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077136, "uuid": "a25e7fd2-f17c-4b38-aec1-9ff12f2de22b", "comment": "Malware payload (Mirai)", "value": "b3151f3fbb3192990b4092a80bf09861c740d677d342c8982fbb52f8e12733f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077136, "uuid": "3688cf29-8273-46bb-bd0a-d099ebd0fbb1", "comment": "Malware payload (Mirai)", "value": "874655000d7964ff7c137f681df33b3be14fa1a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077136, "uuid": "acd3701d-7b5e-4a9d-a36f-228f6e0b89e0", "comment": "Malware payload (Mirai)", "value": "c27acc3f6f376fc47bb5b02d0bd3c74268c011884ae748db4a3419ec4fd65f62066997842df9d8a50eb84b95304f18bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077136, "uuid": "04a6a1b1-7b62-4697-bc4d-4b2faf84cdc7", "value": "T162E43906EF405FEBC46FCD30893EC35705DDA9C75281B67971BC8A9CBA5D26A0AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077136, "uuid": "9918c6d1-59e1-40c3-9cc8-e90cc8033f8d", "value": "12288:SukbJq3Oj/aUuELuK4RXwMrOAsO3W/KkFAsdNyHpOfAuhH3UaJSjB/clym48ejnO:3vgjrdlqLrxTyIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770077136, "uuid": "f6216442-d33a-40f4-8301-37a2bac11196", "value": 704620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770077136, "uuid": "cd17788a-5e03-4bbc-91cb-5dc980f733b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077136, "uuid": "38835e8b-121b-4ecc-be4d-e31095915d8a", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c1352a-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128632, "uuid": "34b147f2-6385-4d6b-9c0a-a0ea820cf912", "comment": "Malware payload", "value": "a2851558f61044c3788bf8370bb5f600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128632, "uuid": "6911facc-9799-4b7b-8067-89806964346a", "comment": "Malware payload", "value": "b3aac889f2cf7735941b7f71e7909827041d3e209f4aa57915f013f95b653980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128632, "uuid": "d6f67a95-c714-4b08-b3d4-836decdb64a2", "comment": "Malware payload", "value": "29dd63d2ecf2e081def4b5c48a81e1e2a651b117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128632, "uuid": "ae8025be-5792-43b3-ae72-c3c4a88f9c40", "comment": "Malware payload", "value": "22b1047d49507ae4d8a56342abab592eede8b68171833bdaf3056ab72e23a05aca89a04fc72c51115bbfba3d2910621d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128632, "uuid": "c72b798b-245b-4bec-a5fa-834b517da7e6", "value": "T1C776236D614D3398C02D87389833B944F27A514F56E889AAB3DFBBD07797430D986F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128632, "uuid": "3da25e95-4296-452b-a494-4d1a6513243d", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128632, "uuid": "5767a915-bbcc-4789-a94b-be720f4bebe3", "value": "98304:2y+ubRCVNlLKx+TcPQQVYR3noxn+X033j6xZYd1MUyBWYE6IPlRf+E7jjf2XCk5M:1bR2rLrOMq+23joKdiGYqFuXC08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128632, "uuid": "980905b8-e935-4b20-a65d-25340be03155", "value": 7769088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128632, "uuid": "48c94a63-9546-41ba-b998-4fd8e96c80ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128632, "uuid": "3e1b8db5-0f3b-4660-bf30-0455c48fbc3c", "value": "SecuriteInfo.com.Win64.Evo-gen.74936648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee5254a-00b2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770090152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090152, "uuid": "df4c4d3d-48e5-4d43-87a0-f35d5b01b5cd", "comment": "Malware payload", "value": "c1b1cad9e7afabfacd8988c2a6182a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090152, "uuid": "4fafa157-79c9-4e1f-835b-84b013d12abc", "comment": "Malware payload", "value": "b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090152, "uuid": "ddd1636b-c237-4986-8a85-945ba117a404", "comment": "Malware payload", "value": "3090ecf034337857f786084fb14e63354e271c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090152, "uuid": "91db6165-df3f-4b30-9d59-3a4635a00957", "comment": "Malware payload", "value": "5428af9c406a5564ea7fba5eac1503118b040671701cc6ce9b6bb255f3e446126af16e967edbeb598e06abd3314bb67a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090152, "uuid": "90731957-ea19-4217-a272-edbf6de6f130", "value": "T11DB36A2B73E930F8E1768278C8914A15EB76B87647209FAF07A442561F236D18D3EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090152, "uuid": "02cbd4d6-47bb-408c-b982-179364d9a1ab", "value": "41473acd7feafd3d0f6d0317b6baa5e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090152, "uuid": "76eebbaf-9939-4f65-b7cd-d9430b2e6905", "value": "3072:UH6seKSfFHF67fKrk8QpxD+b1d1b7WXLp:UVeKSfFyfKrDQLG177u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770090152, "uuid": "96c7bc23-d1e1-4b53-95af-9609f72c5c8e", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770090152, "uuid": "ff9e373e-6173-4003-bd02-cf0586b9fab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090152, "uuid": "031688aa-0d0e-4996-bf3d-555ae52e3ebd", "value": "_b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fa1bb0-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101738, "uuid": "f958db79-0a47-4b26-8af7-bcd9c2b95582", "comment": "Malware payload (Coper)", "value": "81bd0fa36ea4a87c21c3946a65d6d782", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101738, "uuid": "76702926-16bf-4cfd-854f-0800a01e3e3d", "comment": "Malware payload (Coper)", "value": "b4bfe02a51dde614538414162222759255fb8a1423489b8cf4db3fb7d380e6b0", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101738, "uuid": "59b3689c-8eb5-4242-bbe3-ff2a8e31c0e5", "comment": "Malware payload (Coper)", "value": "d8423b474117cbd7bc05d53b0f69c2eba26b31b0", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101738, "uuid": "922e3fc7-8399-45a0-b1b9-98f87703b82c", "comment": "Malware payload (Coper)", "value": "f50095d0655fe984afba10fab1917be7e33191dd8a58d996890fdd4c92f578045f72268fbb6bea5423161df85c9da953", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101738, "uuid": "c5cb97a3-85b4-4e9b-a3e8-abc42bafdbac", "value": "T111451206F3D58617E5BFAA789C5683C06931BE40DE5162276A41B70C8DB27C8CF32E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101738, "uuid": "b6944958-a82a-433e-853b-51e18a645fbc", "value": "24576:zYFnJGeyqgSupqDDD6tOGG5knJ7G+v+/VUwh5mvOGl8nWhCRlv:zYSJXXg3yOcnJN+WwhIOGl8nUYlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101738, "uuid": "4a4d8b43-196c-4f77-83a8-e84fd6a9c9cf", "value": 1172719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101738, "uuid": "6b649ae0-7d66-4aa1-96c6-b25bff6aba8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101738, "uuid": "fe248731-a992-4d99-9a6b-05d057d40bdd", "value": "05411c0_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0462e27b-00c4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770097731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097731, "uuid": "0eee4f37-b818-4057-9a26-b1f591a9b84b", "comment": "Malware payload (Mirai)", "value": "0494a4ee6eb96001d95027e9a94da56f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097731, "uuid": "11f6c2de-1aec-4fb5-9d32-92716752491b", "comment": "Malware payload (Mirai)", "value": "b4d2ed92cc922ed2c964185d8b46a7b65d06eb8a1ec03248128949dbe6937824", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097731, "uuid": "c5ac4cae-1140-4b6a-ac0e-c12c56a81862", "comment": "Malware payload (Mirai)", "value": "5dff0e4f7e44eb44764708eccf4d41a95a6d8e81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097731, "uuid": "04beae55-67de-488e-a3bb-0a2c7dffa12f", "comment": "Malware payload (Mirai)", "value": "8282d71aed2f6fc7aef2bb5500a8e9563a154342939fc3228255e4846ef646916e77f5c16ff822d23a885edcffc999cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097731, "uuid": "5dfd31d6-5a34-43fc-b11f-e55491172ad1", "value": "T1C891A3E57478577A2DA0ED73B7D6C582F18032AAE1C94C0AE2D6F0E4485CF61FC94A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097731, "uuid": "5f0fa0aa-a6f0-4f02-a89c-529218247feb", "value": "48:vnuMV4k4nt1V4dnrsrWV4hnCoV4DnEWEEV4EOLn2kV4DJnt1V4BnpZV4hnASV4xP:vrWnW16/QENEpOLN2ryjaBqTkrS7x3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770097731, "uuid": "86ca14dc-fa34-4603-a18a-0eff179bf6c4", "value": 4414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770097731, "uuid": "41a09f4d-c813-43d6-8e11-fc43f606da44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097731, "uuid": "18686c60-2efb-4d11-b0e8-1532f6915259", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf93e092-00a1-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770083012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083012, "uuid": "b1e4ea2b-f27a-4e5f-ad1d-c10a9631e4db", "comment": "Malware payload (njrat)", "value": "3d6079d3eafbb38ea6f99f62507aa713", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083012, "uuid": "07455ac6-33f2-4ad1-9280-c4da74e9fef7", "comment": "Malware payload (njrat)", "value": "b54b69f400656ee17e279fdc1d1e9ae7f46cf507642e87756e3568caf86e2613", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083012, "uuid": "c17c07e6-77e8-4704-830d-7fc5b7d87951", "comment": "Malware payload (njrat)", "value": "037555b162f38f4a7934b68dcb47caf706822dd0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083012, "uuid": "1f1f8dd7-9b0e-48fa-addd-f37102f73ca3", "comment": "Malware payload (njrat)", "value": "91e1e7a85c185792bee438d17b10e7e21f30736a383b418c4f226daa58b1c56af0b8c4a456811a36348142ebc24422d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083012, "uuid": "06239797-003b-49d0-a31c-3313bdcf9d2f", "value": "T1F3650107B2D554ACD056C138931AD673EA27BC8E0521B9BF13E5AA303EA5F616F1CB4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083012, "uuid": "60713461-8f96-444f-bcc1-a7de4275ed6f", "value": "dd71a0fba7b9bcb4ed897c7097ba15c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083012, "uuid": "6487cc4c-05d6-4432-84eb-74a3fc2690b8", "value": "24576:tG1qi4bd2456L4ZRfqH3gZRFAx0QHPMfQMgcpoeVh6WkIuSLwov16DjMsmyxK:SqiW4456L4ZRfc3gfFhQvPW6ecWkIuS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770083012, "uuid": "96a7135d-fc85-4a67-9276-f67775ef4138", "value": 1450496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770083012, "uuid": "df718eac-104a-4354-b056-e4b40f788073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083012, "uuid": "3704cf65-c793-4cbd-b6e7-bfb22b38d141", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01fb424-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140163, "uuid": "e6080e1c-eb1a-49ba-8952-465db65b71b6", "comment": "Malware payload (ConnectWise)", "value": "482d0b7b7dea43db173aade8b6eeca97", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140163, "uuid": "12690a1d-781e-4777-87f6-920f0f878c5c", "comment": "Malware payload (ConnectWise)", "value": "b55ffacd5a09015967c7e3a2531dc0c92f244aff5e12ee13b66aeafa4663a0c2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140163, "uuid": "88ebaf79-f2b2-41f0-a7ee-f449f7df0c3a", "comment": "Malware payload (ConnectWise)", "value": "48571c22438a89acbdafca08e2d7c9814a91e2a2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140163, "uuid": "15ccb9e4-e588-4b38-8837-47a3080d728c", "comment": "Malware payload (ConnectWise)", "value": "be851d4731370150086027a9efa9ad4d3d77710e034c80e994ef9ff88e7dbbc7dc29506908478272a5490b0edf60ab69", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140163, "uuid": "eabc7ee7-0a35-43c9-9886-beae61004300", "value": "T108C6237127E98425F1A79F39EE3A89E229387C64DA16C45F0BB43C0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140163, "uuid": "6ea12cc4-f530-4c53-9390-00c37a6aeaf4", "value": "196608:AKaLNkbgDi4Q8KaLNkbgcKaLNkbg2KaLNkbg+KaLNkbg:GWgDiHSWgyWgYWggWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140163, "uuid": "e1285852-9016-41de-938c-b7473a71de48", "value": 12185600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140163, "uuid": "e612f82b-ff62-460b-91de-d71ad050c8b4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140163, "uuid": "61b16916-34b9-4bed-96d1-fca2583f83d5", "value": "INVITE8794.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf956a6b-013a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770148752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148752, "uuid": "ac605ec6-5618-40d2-8b7a-d6c45ce4564e", "comment": "Malware payload", "value": "cf7686225bf83633bb24970f4100b8e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148752, "uuid": "be871433-e162-4403-8d2b-53d061df11ff", "comment": "Malware payload", "value": "b5c1dd84c0cfaf7877b965e43183db2f4f47a489c8e45e45a66f14bf0d8f1c57", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148752, "uuid": "82d2fada-02f5-42d3-b830-8a05d5ef789b", "comment": "Malware payload", "value": "9cf8b576d58a652d169ba89c458be84913b32de0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770148752, "uuid": "df8de52d-a69b-44b4-afda-d7f4e403089d", "comment": "Malware payload", "value": "7f18e8347861824987213ac7169ded85419a73b86e4c53e318f88971d648143e9fa002f52f7be4162d34bf2258e5b78e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148752, "uuid": "2f04697e-dbdc-45e1-bcbb-cd5539d3e983", "value": "T144E0A59F201BBB928C6BCF3AB25389A89106E3D51063CF5E6498197A7CC4680B455F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148752, "uuid": "3225e67f-49a3-4d69-898b-28ca6f638126", "value": "12:CRSlR//YNR/hNI1hW+R/q6sRZDjRZnKF/DR2gr:CRKwbhNIfl2Del", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770148752, "uuid": "388814c7-3730-4b55-a30b-4b0f0dec43ca", "value": 408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770148752, "uuid": "5e120430-3e3d-4410-9936-b5476487f7f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770148752, "uuid": "bd92b6c1-e4cd-442c-9716-3977cc6343a3", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951b9b38-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143500, "uuid": "db9a7a36-d431-4530-ba1a-6f1649e63a0e", "comment": "Malware payload (Gafgyt)", "value": "0098c0dec21a5bc9e8410c0dc8c62378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143500, "uuid": "c15112c4-ccbf-4eff-b35b-82dcd9771041", "comment": "Malware payload (Gafgyt)", "value": "b67b3f2e348c9cdff22de0457879a1271aa4f74086861d5d3e627c3b2b516f64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143500, "uuid": "2e8949b1-92fc-4110-ad76-350b0de181bf", "comment": "Malware payload (Gafgyt)", "value": "0b930fec997c734c64705e99006d644ec32a83d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143500, "uuid": "4206cf63-9e6b-4e39-87f6-0ab5a7330320", "comment": "Malware payload (Gafgyt)", "value": "c735147f614dd448afb4968e3198aa77db24d033aac7306802c862fa6d722b6ade7a71aabb324da8fbc08d249cba9c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143500, "uuid": "7d36d9d5-8401-447f-837c-78cf86ea4e46", "value": "T1F7A34B07A9A18FB7C086BAB125F759300B17A8914B1F1B857139A7F4874F5CEB80FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143500, "uuid": "2daa6bd9-0fa3-433a-9112-407e546db0c0", "value": "1536:pYzzLnTj6pIoWOiK5fxhfnX1CPvKqI6Ist4mc3KVDsUqtlQhv:G+F57nX16IBmwKVDsdtlQhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143500, "uuid": "f87cfdbe-98ae-4751-8ad5-01d437148172", "value": 98783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143500, "uuid": "ee66f556-9eab-4d65-b2da-cef22716eaf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143500, "uuid": "e77e2ed5-b53a-4725-aa1b-2ff8c01eb861", "value": "pXdN91.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233d4328-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139014, "uuid": "e589ac35-58d6-4511-8ec6-c57afafb7c03", "comment": "Malware payload (Mirai)", "value": "578825cde2d184571732d801cb4e41f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139014, "uuid": "0a6db9f2-bd2b-4570-8717-4ac7457a012b", "comment": "Malware payload (Mirai)", "value": "b682eb94328121e1e366fe1dcbd31ffb236f6f5ed2c30cec688b5fdfb7a0693b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139014, "uuid": "5aab96ff-2e66-42dc-982e-eea0aa5dcb3a", "comment": "Malware payload (Mirai)", "value": "271f7913ef9a2dc271023bc558905205f5f4c72c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139014, "uuid": "7901ce34-3b7b-406a-a342-7a5f6aef8011", "comment": "Malware payload (Mirai)", "value": "e92db13761a55bd107b44f7461590f29689b24902005e02c66570e46128863f3e20e0320f6510b20721649e3db3b9e25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139014, "uuid": "eddd3be9-5d6f-4a11-8e94-50027bd71a4d", "value": "T115532955FC819712C6D012BBFB6E428D372A53A8D2EF32079E266F1137C791B0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139014, "uuid": "c6d116a4-9851-48e4-9a3a-d68f92146855", "value": "1536:h2ohZei810I0mbqiLolgutb8SC6pmIwgYO6Z0uA:h2Ia3l2MOgutbX7woxuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139014, "uuid": "791f5442-06d3-41d3-a1b8-26d651e1745e", "value": 63600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139014, "uuid": "290b87ac-b4b2-4595-971b-5d2fdf1f49b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139014, "uuid": "a4e5b87c-ae5a-40ea-b840-b58c4612f8d1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09de3483-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128664, "uuid": "4cb3abef-d571-4613-aa87-86909464c70a", "comment": "Malware payload", "value": "b2aa205a6e388b1f40613d5316ac1a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128664, "uuid": "f841de6a-4a39-402a-89b3-115c5c175a7e", "comment": "Malware payload", "value": "b6acc029cffa40fc50827ad59fab8285575ad84f23229be0dbac8fd5dc99f81f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128664, "uuid": "59ddf4d1-1a06-4274-9e63-6e8dc50e79af", "comment": "Malware payload", "value": "10c54bf2b5069cc73085ee3cd0685794a3799f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128664, "uuid": "0667b52e-e071-4b2e-9252-9837e8542207", "comment": "Malware payload", "value": "b8a642af0175e5a1ea78fdb8446e273da1c47eb50f5246ad42b6c64466890fe6dab29e77a1a8dda09e6e441970dd888b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128664, "uuid": "ad0a9101-0fd0-4d9c-aae3-d3e0eb81f803", "value": "T1B87623AA654C339CC41EC734A023BD05B3FA112E0FF866AA71DEFBC46797421D946B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128664, "uuid": "49415334-4e58-4b96-b228-288c456c1e43", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128664, "uuid": "811d40c6-2556-41a5-99ae-630e90733f3a", "value": "196608:dXr7KTDjwg10fVwSsDRyH1/g2YkKBBtvK8Ra5C:dXr7KTwg1yVwSsDRyHJXUDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128664, "uuid": "54538a54-2e14-4839-b141-4818c545e813", "value": 7766528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128664, "uuid": "5f7f4785-0a1c-448a-ae46-ebe65c503498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128664, "uuid": "f6527732-5208-46ef-9d30-6b46d89de79c", "value": "SecuriteInfo.com.Win64.Evo-gen.68551576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d251c78a-00d3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770104519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104519, "uuid": "28506d22-f6d6-44eb-956f-0f6f36838322", "comment": "Malware payload", "value": "1045fcc5b7d92271f1a16c95ebdec9de", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104519, "uuid": "7ec4553e-fb43-42ae-8321-c7d535427b11", "comment": "Malware payload", "value": "b6ef840b7161653d32f8f87b246209188c1aef5f074fe086c833d3e4d5a9a7a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104519, "uuid": "28ca5310-cad4-4ab4-beb1-acd2abadd7cf", "comment": "Malware payload", "value": "a0cc43167f2c1ac6d4f358f99b9ea33bce629e3b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770104519, "uuid": "1d023ac8-577d-42b3-901d-6404c683a631", "comment": "Malware payload", "value": "9c9a86e57c631279c1a1526d2add30cab4222b0c1935be95a3eaf74e326abcf3695ba2646f714c431d4329c31d5a06fd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104519, "uuid": "cdbb6110-82a7-49ac-9e03-9c1f1896f456", "value": "T19343BF32289DC429136B5AEC70D46B67B61070ECE5CF37576AF0D130BB89186256BECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104519, "uuid": "940f2b93-1b04-491e-9480-c1976d838b93", "value": "1536:Xz/aXOe7ZQHqObObObObObObO3QpQYgvnog3uh:XzyXOe9ObObObObObObOW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770104519, "uuid": "c92daa3c-b05f-462f-8905-9f7e2e57332b", "value": 60381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770104519, "uuid": "1087d3fe-41c2-4f63-8ee5-abb35cdc8f08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770104519, "uuid": "f80bb9b1-9080-4433-8109-39611e22d6bf", "value": "5_12_6_1292_02.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bfff12-015c-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770163011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163011, "uuid": "9c2d41b9-2766-48c9-b70f-6dc2890a4e71", "comment": "Malware payload (Gafgyt)", "value": "903e59a545d18dabbabb75e89bdf3895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163011, "uuid": "806bb8c4-51fb-41e8-9289-5689108ab6be", "comment": "Malware payload (Gafgyt)", "value": "b6f913923e9c8845b3c1fa47035e3bd3c0c1cbab3660d01d90fae3ec8801cb37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163011, "uuid": "f239f57b-7524-42e4-87f6-fc171220a51b", "comment": "Malware payload (Gafgyt)", "value": "5ff200a354bc30150eed4b0308593eee4a5f165a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163011, "uuid": "f48bb7c2-fbbe-46e3-9e15-7a519b9cd249", "comment": "Malware payload (Gafgyt)", "value": "c9cf4ba12cdd54856d57f21fecde0e4a2754ff094eb502c12ff2f15b70094d73fb8ff226f18b0b8c4f2c2a481fd0596b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163011, "uuid": "b3dea9d1-8bea-43a5-b1ee-dd34ab2e16b6", "value": "T11BE3A52E7E22ABBFE169823107F35F70879521E227A19385E26CD71C5EB124D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163011, "uuid": "00b94b72-9e6a-4bf6-9641-1e77b8801c8b", "value": "3072:+mFjEQ715OgoNedio+ZpyjVchJpX6ipZ7gVi0DrbD3ZpMdkmk3cpiBAGHBZO:5aDrcf/zZ2kmk3cpiBzHBZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163011, "uuid": "bca98283-ee36-4bd2-9631-202ad99a9f71", "value": 143874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163011, "uuid": "2b571542-9ef2-41bf-89e7-ab4b4434dae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163011, "uuid": "d50fb998-b322-4e6c-a054-7ee07e930dc3", "value": "pXdN91.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72389a31-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101780, "uuid": "622a0621-6ae2-4971-aa77-8a7a500920a1", "comment": "Malware payload (Coper)", "value": "5ebaf4e70426b9622aa7a2137dfa92ec", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101780, "uuid": "923398c9-8090-499b-9d33-cfde4e3ff848", "comment": "Malware payload (Coper)", "value": "b7273b4a1b2d2a968a890f363e256d6d6b8fdda6a63280e673262f221c76a1fc", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101780, "uuid": "32b74d8d-d5c4-42b3-87f2-c4a5f4d05bb4", "comment": "Malware payload (Coper)", "value": "275a7e85a2932788ee1b123aa4dc486a4415ac3f", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101780, "uuid": "e1c37f4b-6017-4124-bf17-11015c5a355c", "comment": "Malware payload (Coper)", "value": "7c1d9b30f3379e026ff0a1dc7337bdccae8b066e6a5127da5246a23adfa27b0313a8e3653a67f2a37ed044de79d2d2a1", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101780, "uuid": "cfc4aa98-156b-4318-9727-5ca6e1af9afd", "value": "T1D2451242B68A8617F4E93A388C93C6D4A260BD54DF21131B3E44B74D2D727CA8F27B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101780, "uuid": "1b066d8c-48f8-471e-ab37-90aec6d65020", "value": "24576:fcMhcanYAFi1hFlX9R1N+J0hkrTkBVIeFfJCRkZdFnYc+MMQk1XIb7Ja:fcOcTAc1hFXTN+0Eg3tFJCgnYunk1XIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101780, "uuid": "0e7870c3-b98e-4946-9c58-0e64ad010392", "value": 1172711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101780, "uuid": "136c3982-b7bc-4a28-9273-8e85493357a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101780, "uuid": "ded2f3c9-f742-4d0c-90c4-7bd2b1196649", "value": "b6d6259_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197017c5-0111-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770130837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130837, "uuid": "dadab230-220b-4e87-8024-0fb0b003a6b0", "comment": "Malware payload (GuLoader)", "value": "d3b97d3a820e8c78fc00f08ddfc54690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130837, "uuid": "7157d635-e4c6-49d6-89b9-6976218e0e58", "comment": "Malware payload (GuLoader)", "value": "b7d239db797326e43a96fb228e93bbbfa1e12d610c8a79ba3148b74b0021ecb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130837, "uuid": "73f3301f-c629-4546-9814-18c6beed062f", "comment": "Malware payload (GuLoader)", "value": "ee6640fa3f2ccff294b65d60ee9b6a2dc4b8e13f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770130837, "uuid": "be13f705-4be3-4be0-87ea-d34dd008c5cd", "comment": "Malware payload (GuLoader)", "value": "7d29703ede4518b7d0219c2cee0914f92e2b5a4c99f4efc9ccac62c5f9464d7b58eaf9fb7efa68de49725a2d986d43b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130837, "uuid": "2060f470-8657-468b-8f4d-848d96c37afa", "value": "T1D0A4F1103646EA07CEEC06B544BF86EE4E759E7BA9818B43F381F76E7C712C5B928114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130837, "uuid": "c2e19e6c-a4b8-4e17-b40e-84e71398dd06", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130837, "uuid": "555bb543-1e80-44e8-8641-502fcced3abb", "value": "6144:fQ606xV8H+lc7SGd7UAteVk8I1if8b3eBNTXnqdqEC8tTVefpcjM1JymU+/GIBe:UecGGRUdk8/Eb3EXqFyCI1JymU+/v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770130837, "uuid": "0608716a-7a10-4250-afa8-c8a4faa092b5", "value": 457952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770130837, "uuid": "a252d24a-c305-4958-a9b0-0c8c473d0aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770130837, "uuid": "15d08d6c-f41c-4182-b0df-5e36b6eb2fc1", "value": "inv. 5234353.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04778308-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128655, "uuid": "57f84edf-d852-4985-9f9f-92b486c8b166", "comment": "Malware payload", "value": "0ed147803c4d233b17957123aed5f894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128655, "uuid": "1844163d-62e9-43c6-a1f7-5aad972de54a", "comment": "Malware payload", "value": "b807e8394d93f9744aed9b520328ed531744590614ca74b40c40e4ecb53a1720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128655, "uuid": "0fd7c411-68ff-44f9-b011-8b3b513e9b09", "comment": "Malware payload", "value": "07171080b17760460506a3030df71b46e3b17a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128655, "uuid": "cf87e4c4-dfe4-4757-b1c8-bd9f4d8f10db", "comment": "Malware payload", "value": "32694273ea71e5ad127cb01a10f7b9d4d9c11b2ed581648bf43f89902b7393c32b041698ccce7637b42bbbdd55371bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128655, "uuid": "e535adc8-2a3d-41a7-b149-7ea545461bce", "value": "T1AE7623AE605D229CD41EC7388033BD04B1BA142F2EE955BA71DE77D473AF521D98AF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128655, "uuid": "781d6b5b-df80-4573-8c2b-4dbcc8aeb933", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128655, "uuid": "ad9e9418-a947-4de9-82a6-a21b10f22a87", "value": "196608:gOCoLKoVTREMwzYEz2IBijdHsMzsWsgejP7D:g8LKoVfwzPz2djl/zsW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128655, "uuid": "4847149c-77f4-435a-95e1-2921d77f55a1", "value": 7764992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128655, "uuid": "c8f076bd-7ae4-4bee-9f34-56af75d58e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128655, "uuid": "31b9443b-eae9-4559-9886-318b9a0e2229", "value": "SecuriteInfo.com.Win64.Evo-gen.51211127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb70b062-010e-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770129901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129901, "uuid": "007ce683-4821-4e40-a3d8-593a6115c9a1", "comment": "Malware payload (Formbook)", "value": "eb79958e4ad5f2e3a130926dbc8a059b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129901, "uuid": "6a138111-78a7-45b8-904c-24ddaee5250f", "comment": "Malware payload (Formbook)", "value": "b9c3d1181ce23bba35e82fe27f2a1c3726f880e045be58ada8bf919c4b59375d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129901, "uuid": "a430704e-1371-4ef7-b16a-cb1487e5faa9", "comment": "Malware payload (Formbook)", "value": "3bb70a53f4bbfc65eb5680be4621e8d9305c7b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770129901, "uuid": "4033178c-e372-46fb-a668-365d3d8fa3c6", "comment": "Malware payload (Formbook)", "value": "32cb4fdd2dfc1fd764c1f4fda9f5929c2b33cafcaa628f57f18925f0299c1ff8bfa9ffaa495dede1304103a7b0b86ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129901, "uuid": "62b5ef2a-7710-4ef7-9d42-c44b902a72c0", "value": "T14605FB7F99629126DA4A80FC34494B625971B33B03B41FF701A69130271B9B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129901, "uuid": "c99b9748-0215-4776-8da9-20d0a3b444fb", "value": "12288:N+Nuw7qIBVnpoKbhVeSCtMP4CqqLdWVtyDHK0ifh6adlDo1ct:44w7qIBZpoKbrekUqk0ifhnUct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770129901, "uuid": "bcc92925-eb0c-4f6a-9da4-db5797261b6b", "value": 797752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770129901, "uuid": "563da455-e36f-496f-beee-1550c60c9893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770129901, "uuid": "323984b7-deae-4711-831b-798dee542d3a", "value": "license.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3734d960-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770143343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143343, "uuid": "09eaa984-75f0-4e95-9fc5-689f394cd4cc", "comment": "Malware payload (CoinMiner)", "value": "0266170a952d087b029775fdc3b44b19", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143343, "uuid": "cb62874b-d3aa-4d94-877c-990bd3133d26", "comment": "Malware payload (CoinMiner)", "value": "ba0f1caf90fba4aba5c7115a3c42a8bb82da21dedb1c426be3b4473c4bfecd12", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143343, "uuid": "5eaab00e-a260-4b4c-98a6-111ea752f8ce", "comment": "Malware payload (CoinMiner)", "value": "c8bd98117a6b7423fd68b7471ec9adfd8f36954d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143343, "uuid": "9f8b1341-1c93-4b54-abf7-829c2889dbc6", "comment": "Malware payload (CoinMiner)", "value": "1f3f615024b9130ad296baa1f5d078b19245a76a71dfedc021ebe5176d9a7116d42acad094c458a05add46b72ab2b18e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143343, "uuid": "1332bc55-77fe-49f0-a58d-69b29bf9f0c6", "value": "T15D96339B77145935F4A9413F4AB38006D632F9B553E485AB23F0626A3F332D1BE38B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143343, "uuid": "91b1cdce-0592-41e1-8a29-3bb31262553d", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143343, "uuid": "ee1a2bc7-dda7-4814-99e3-e6758360e1b7", "value": "196608:WxVc5hESD9O13c0V3murErvI9pWjksbHhQFPvzmwE4Eeg:ac5hESaM0tmurEUWjkqeF3zLpEeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143343, "uuid": "13bf717d-e484-461b-9960-67e3b3789da6", "value": 9403176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143343, "uuid": "d0763798-761b-4396-9eae-a65fbfe6da61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143343, "uuid": "b47bb421-86e6-4167-b02c-3d261276c09b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0794d40a-010c-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770128660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128660, "uuid": "fec7ae41-3340-4d27-8452-747701f148d9", "comment": "Malware payload (CoinMiner)", "value": "87eccd5e7fcbb12e64814207468b9f2a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128660, "uuid": "cebda2d7-cc9c-4af6-a0dd-7540c5868788", "comment": "Malware payload (CoinMiner)", "value": "ba2d1265f9355b41a1e6a5571ae72ac5550cb045993b0fa9dc399264f0861845", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128660, "uuid": "1e885496-0195-420d-b6c4-3b922389e117", "comment": "Malware payload (CoinMiner)", "value": "6d47b17d38919a6c6cfbcf7980bcfc011265f3cf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128660, "uuid": "d7a1954d-44ae-48ab-a2cc-4133d902c629", "comment": "Malware payload (CoinMiner)", "value": "67bb91eaea31c83e843012f9424a8e3fc3c626319ecd09890c633d183f4571e8c6c98859b5ce881791bf6cb1cc3c9108", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128660, "uuid": "65432328-9f8f-4ee7-8f2f-322c0c7be29f", "value": "T11E7623FA704C33A8C01ACF389423BD15727A112E57F9A5EA7ACA37C43F4B1249956B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128660, "uuid": "60fd9c44-8bfa-4768-b819-cb74f4e8da21", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128660, "uuid": "a80414ce-8538-4b85-b7c2-b247cb1f0784", "value": "196608:2JOVhppxMxhKYSbBjq4zrvW2rzf+KS4D2:2IVvoxhKFBuozprzf+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128660, "uuid": "71b5f148-6839-4edd-8e6d-f3a5b09432d7", "value": 7788032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128660, "uuid": "af4458f3-8821-48d8-a31f-5d2cd0f30687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128660, "uuid": "d82963e8-1654-459b-b3cd-bd6f923233c7", "value": "SecuriteInfo.com.Win64.Evo-gen.57268883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db55f41d-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134169, "uuid": "c6d0a741-49a3-4fba-acd3-414214d429e2", "comment": "Malware payload", "value": "9925c0685e477da42a9cd3c5f8d217a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134169, "uuid": "e68d497a-68f1-44e9-a12b-df180008f873", "comment": "Malware payload", "value": "ba8b22657ba1ca2b4a902de4a7efcf6ae0f05c6a696b6cd08f537af36555750c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134169, "uuid": "6923ef2c-5ce6-4e96-9896-7fb9568bc2e6", "comment": "Malware payload", "value": "cffc75787e23179df3813d34bd82fd17de8ce30c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134169, "uuid": "b63c6ef2-32a4-40d6-bf49-f671663334f0", "comment": "Malware payload", "value": "1bf048e8ab8cc370dd51912312ba90d71aab0e386e8096f04b960754fcfa6c3283934bd31ca40cc79f106e000d7372b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134169, "uuid": "89c691a8-3e62-4165-93e0-4f27b2a50e89", "value": "T149C3F102F693E1F2E48349B15487C78BEB359FA54414DF5AE3583738AEA2B13648E31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134169, "uuid": "bbb45ed2-59db-4460-bbac-42af58656a84", "value": "3072:rOlNTZa+Ef6jM4SWNAcZVe+Qrzos47B6JrYOfAGCaIOEh2Dl:aPGfcFSWNAUV9qoT6JrYFGB5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134169, "uuid": "07d85298-1542-4f0d-9687-86824d406275", "value": 126957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134169, "uuid": "8d9cf9f6-31bc-4ac2-a5d5-abd6ed753648", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134169, "uuid": "b2417795-e74c-48d2-9a91-eebc6c140677", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9005223-0094-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770077472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077472, "uuid": "14945a96-576f-4dbc-8bc8-856d42099967", "comment": "Malware payload", "value": "5a92c18e756e14c89186f6560fce70eb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077472, "uuid": "d335ae6d-fa61-46af-80ad-9f0c877966a5", "comment": "Malware payload", "value": "bad67fc05a524cfa5a8bb39d547a7c81675171c0252344ee1142d4d10f04045e", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077472, "uuid": "a873483d-2c8c-4d7a-a292-adc8bcb8d8a4", "comment": "Malware payload", "value": "9630fe396bd188acd9e3615e6c908ffe8ae19f19", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770077472, "uuid": "a3273b1d-676b-4955-a55b-35c20ab526d1", "comment": "Malware payload", "value": "e29f0a56e848dde2b3533175d592b7ad0cdfdb47de7f84cbbc96a31dc2f18f5c1b4c9a9ddaf544bf2efb809c801685d2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077472, "uuid": "322b453d-18d0-4f68-9565-ba6326817c9f", "value": "T1E4B533975A99052BE0B688B849CAC6E77FF7CDCE30398430D5163C7D91B3B054E2668B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077472, "uuid": "1b310050-7631-4abe-8666-a9dadad43392", "value": "388dc1cc36ef83cc05ae9d06320e5c56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077472, "uuid": "95c25d77-f8a2-4947-92fd-3f9db0b611dc", "value": "49152:Zdl2IM8zLAhnKvL1zVUmGO5kOIso1lKvEZn:ZdHMyL+QTT5GsccEZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770077472, "uuid": "8bd8d95a-3c66-4ef6-928e-fef2d57e288f", "value": 2402304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770077472, "uuid": "a947a315-020d-415f-9cb5-e0d691ccc8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770077472, "uuid": "f87aa670-061f-4f3c-ac55-b0db1f674d11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785bd929-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101791, "uuid": "37812bea-3d03-4edf-8e97-936fa0767fa6", "comment": "Malware payload (Coper)", "value": "5bba2e378653375950a8967c3de61ac8", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101791, "uuid": "39fa2722-fc5b-4104-809b-34fa225b7e7e", "comment": "Malware payload (Coper)", "value": "bae41a16babbac0bcf8280bf6a60c78331bfaf50b0b5c31cf6c55ac29c5c7c4a", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101791, "uuid": "f5637f30-db54-4627-a033-d09b34d64263", "comment": "Malware payload (Coper)", "value": "515729056335e1f26df7d37ebdf1d61446ef06ea", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101791, "uuid": "e89b8a57-cbdb-49bf-bb55-c63a088a359b", "comment": "Malware payload (Coper)", "value": "d3e37b1a1d1189bb100c50944227c6c030a58856f50c9fdb389fb91cc64c6553d01cbdb0f3ce582239128c1177af1505", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101791, "uuid": "d78fe97c-e58b-4a44-991e-deee70911efd", "value": "T19F451281B7D9CA27F9FE2A344D6682D423243D40DE10536B2E827A1D4DB27C5CF26B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101791, "uuid": "6c151092-e868-42a7-b2da-a9347d331fc4", "value": "24576:XEKXnpeZS+XuA0TM096uuYevicDphNdIW4xghWZlUbASzPRN3W+84:XEK58S++A0glYuDcQbAMK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101791, "uuid": "18ac9d44-7f1e-427d-a2e8-409d3b5ed63b", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101791, "uuid": "62fe58b3-fcf9-4adf-b6bc-f7353c62eccd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101791, "uuid": "810b945d-ebbe-4388-ad0d-f2f1e37e5c24", "value": "e16fd4e_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20177726-00b4-11f1-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1770090905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090905, "uuid": "dd372038-a2f0-4400-ac9a-f43679a8a0a3", "comment": "Malware payload (XenoRAT)", "value": "85e8abb0e0335b1b4453e84b9dd466b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090905, "uuid": "91c941ab-4355-458f-9f54-ef8fbe322492", "comment": "Malware payload (XenoRAT)", "value": "bc02945d95bddaa8b73660f7b4d6fe84cf9a6f53ade99caad909d22203522af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090905, "uuid": "8a2a0ee0-d6d8-446b-8606-3330e0b99ec2", "comment": "Malware payload (XenoRAT)", "value": "c0f3b5a6a994a97c8e2f274633e35dca8ea16db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090905, "uuid": "ee864645-8c50-4ec1-973f-fe1b1a0265d7", "comment": "Malware payload (XenoRAT)", "value": "505b3b7a356718228381c66365ece18cc34d8b383a87eb0790c19acc97ee169be5500f305f90a8ea670055c046a4a911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090905, "uuid": "e7151c4d-595c-4510-afbd-1aae4bb54b19", "value": "T1DCB4ADAF72CE4E13C2802AB5D09385244FA1BE763637E74E2F0836D91D72F752D99681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090905, "uuid": "e462e6f5-210c-4424-8566-33c898db6b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090905, "uuid": "895722af-376f-4205-a882-04d3fd3db577", "value": "6144:NVIom3zDD9VfprbbMp3GQCjdrTeE8/JIT70/5junpBtDE3tbYZMJNGxDQRP:sz3LpYMQMChInK5C1MqMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770090905, "uuid": "9a934a87-488e-4b62-b819-52e286ac7420", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770090905, "uuid": "5e72a3ff-da2d-4df5-a9fd-d9a5e10cd4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090905, "uuid": "8415de43-5f66-4ae6-a9b9-1cae9f39122e", "value": "85E8ABB0E0335B1B4453E84B9DD466B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24447449-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139016, "uuid": "36381849-4ba4-4f2e-ae0b-c50b596f50da", "comment": "Malware payload (Mirai)", "value": "c499093d3d3e521ccb49e273bea49b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139016, "uuid": "22dada24-6981-46f0-abe6-8c3803f95dfd", "comment": "Malware payload (Mirai)", "value": "bd0538700aff68bf3a259c3927a436a8e9f9db3e74b9d0aeaa2498846a02e296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139016, "uuid": "60ac2193-e41b-4b92-a01c-fddbac5b9a82", "comment": "Malware payload (Mirai)", "value": "22c0629fee03d3f52cb6ede18656fff0b99805ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139016, "uuid": "5b27dcf5-d8f2-44e0-ad97-dfa0098875a5", "comment": "Malware payload (Mirai)", "value": "9ccb356a55cc7dd5a9007a9bd78c9ffd4c70a2cdc473bcd5a2801d4aa2b76526cb2b269826bcfb205bddbfab067fb3f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139016, "uuid": "4a285137-a787-44f1-ac72-d99eadb6f430", "value": "T17CE27DA7C93A3E58D6154675F8299F3D5F23E914DA8B4EEA44268A31D003EDCF8183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139016, "uuid": "c1ddd524-7db0-4b19-bd89-de9620f309d9", "value": "768:nUcRp/t/K9shd+WuYQLc/3O9CCoQ6rzkoC9g0:nDHZms6WgLEOQQ6EoC9g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139016, "uuid": "3d3a4ecd-010e-47f5-9b69-306eb865c7f5", "value": 33784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139016, "uuid": "cd2d4070-ae3e-45cb-9578-8480667c4aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139016, "uuid": "b7dd6773-8110-4257-960f-ba32612e24ee", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3b6261-0104-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770125255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125255, "uuid": "e886a748-8c06-4d22-8996-a876285b50d4", "comment": "Malware payload (Vidar)", "value": "3ed1e2c37757190535d71b7959b3fdf2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125255, "uuid": "f16e3863-dad5-4a9a-bb04-fb256099b7ec", "comment": "Malware payload (Vidar)", "value": "bd26d607310fd4bd7af261b0c05a3c85d15ec1917b987a50b774733a4e75990b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125255, "uuid": "0abaaa52-bb41-45db-8ada-bc3797e5e4b6", "comment": "Malware payload (Vidar)", "value": "5b0f2ea4fa617a78af561f3d78ea9ac7f09f4925", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125255, "uuid": "f1f0b3dd-e1cb-4003-aeae-7424392aa0cc", "comment": "Malware payload (Vidar)", "value": "3f7e58172cb8dd98b07ddd0a41c8fbd1e60a335765e43c2bd1a96239f837e07c3b16d501545a2365090169c1b37c60b0", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125255, "uuid": "a253e7f9-6a08-4a16-8706-4ea1cbb65c01", "value": "T1D486297F729592A8C2AD853FC0A3CF40F5F371761B33C6E7129007A98A469D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125255, "uuid": "fd715e87-283f-43ca-9fa9-f9f62e58c31e", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125255, "uuid": "b3f88fee-9b52-4868-8b3d-4b813f25122a", "value": "49152:DNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg8Q49dpaM2xt:Dz7Vp7IQ49d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770125255, "uuid": "24a28af8-6d57-458b-b1a4-f2daf4cb8cf9", "value": 8538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770125255, "uuid": "27bb8bee-b13f-4284-a024-eccdd87ed42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125255, "uuid": "3744e206-9131-4faf-84b8-35fe12501879", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a720849a-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1770151261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151261, "uuid": "cb5f6fa7-b611-44d3-bb42-798ebf586c31", "comment": "Malware payload (N-able)", "value": "03568b44eb3719291498eefdc12eed2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151261, "uuid": "b9b23c91-58ed-4944-bb44-e172e9b23dd1", "comment": "Malware payload (N-able)", "value": "be38e256598bb8a7aa2f29346f40147be94e965718c1ebb7d86840abd05240b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151261, "uuid": "f767f007-e1fc-4c78-a8bd-66aaa65f77f2", "comment": "Malware payload (N-able)", "value": "06a8a55623f9c4b012338e11c6a65fabf204d992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151261, "uuid": "836269d5-2b7a-43b9-9a09-e9784cba6155", "comment": "Malware payload (N-able)", "value": "93e679297a9324b12df2490c96ab524c59a9c7619e5cba60e87f758ea575bfabe010d637088b1c1bc34b1a808dff67eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151261, "uuid": "72f1304f-cbf4-4076-9bc2-0cb04a3befe5", "value": "T157E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151261, "uuid": "d407ffb4-54d3-40f1-872a-61081808d394", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151261, "uuid": "3f1452fc-28dd-4ee7-83d9-5bf3046b1261", "value": "393216:WpF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1P:6rRxvoC/7a0jUxX7h1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151261, "uuid": "089000a6-d2f0-4278-8aeb-cbecbafd3d7d", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151261, "uuid": "d7bf7b54-5ee9-4b21-8294-89e290e9d2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151261, "uuid": "1a67222a-5b0a-4a63-b198-9ec94221a2d7", "value": "Pedido_ficheiro Cota\u00e7\u00e3o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63936cf-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136791, "uuid": "32ab72b2-61e0-48d2-a1e6-6cbedcffd5eb", "comment": "Malware payload (Mirai)", "value": "eb06c572d11ed14a8ad71587e52478df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136791, "uuid": "9d956815-e33f-49de-9394-0144ce2e6d2d", "comment": "Malware payload (Mirai)", "value": "be6d52de33de60fd6d03fc14a719eea4b605519b22370321e44acd102ba7447c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136791, "uuid": "43422b23-400b-4962-bb3f-cefa05ffee23", "comment": "Malware payload (Mirai)", "value": "0e8918c14ff48f8f67f15083d16c85ad54118b84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136791, "uuid": "933b2a71-cd31-4a88-be75-d9e0f2f3e8c9", "comment": "Malware payload (Mirai)", "value": "d1d178ff2f2c23e2de61a7ac37aa4ef64ab16dace2fe3efe87cb35318d22533bfdcbe2fcd31495b095066e09e1c7fcd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136791, "uuid": "6a3216d7-2951-4520-8321-b61b9c4493a1", "value": "T121539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136791, "uuid": "cc37228f-25e4-4f0b-96bd-fb8c458bbf6c", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136791, "uuid": "356a970a-52ac-430b-9ae8-deb7745ed815", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136791, "uuid": "1daea5e9-53ea-4545-9e68-6e1c04580e49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136791, "uuid": "be0a251a-76d0-4e87-b887-57b0d7c937ce", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813f154d-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770120704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120704, "uuid": "21a5951b-e611-4564-b0be-62f48511d5a6", "comment": "Malware payload", "value": "58f517bdc9ba8de1b69829b0dcf86113", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120704, "uuid": "4cb062a2-7e0b-4677-af38-444f5a348d2a", "comment": "Malware payload", "value": "be859b4f4576ec09b69a2ef2d119939f7eb31de121aa01d38e1f0b2290f5a15e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120704, "uuid": "cb00f72f-c0e7-4bbc-ae04-9b6b1ead9ffa", "comment": "Malware payload", "value": "34f77c7e57f4f1798835b09c398765cc40414461", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120704, "uuid": "cfefa98e-81e4-484d-bd2a-d4787d6a0277", "comment": "Malware payload", "value": "47ca6a0d23b8655cdf58ca0a2abf9a247bfbe5b266f918286ee87f9bd184a97a3d7a7064f580649aa2788a81a8e39042", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120704, "uuid": "87ba2d6d-f91d-4432-afd5-8984efd73f70", "value": "T1E4D371B400541685D24350936F0AFC89396AF41A7CF551B07EAFC3BBE5BEDAECA23512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120704, "uuid": "721d8fde-bef3-4532-9eb1-3deeff84b034", "value": "768:Wg/3t5HxipS2aFdxwx/nz/Yd1jn8l/NLSJ0oWWssq3u7QBxYX1ICs4kTFwvl5ibk:WC5TbEtkqbBxYXxkT6lsbP2HcGD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120704, "uuid": "c097eab7-1412-46be-ad33-b9ba0a80d46e", "value": 134311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120704, "uuid": "c3aed947-f1d3-47d5-972a-1326f111c85d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120704, "uuid": "67a7b5cc-1756-4b73-a0d2-cebe4347e170", "value": "\u0417\u0430\u043f\u0438\u0442\u0430\u043d\u043d\u044f \u0434\u043b\u044f \u0456\u043d\u0442\u0435\u0440\u0432'\u044e (1).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99758bc-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1770140125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140125, "uuid": "cbab674d-3ff5-4102-bb1f-88c804fef805", "comment": "Malware payload (N-able)", "value": "8275ea4772d8285fa81703d8606f63b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140125, "uuid": "44b67ef9-1d03-45f5-9f6e-7f6e5c90279a", "comment": "Malware payload (N-able)", "value": "bedc24340489ad4533acbec8a0fb31274848b92a7058d810defa4987e2e8d611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140125, "uuid": "77260579-36f9-4996-bf5d-e57a6de561fe", "comment": "Malware payload (N-able)", "value": "c8661b199a0ebf07840e6cf32ad047b886d72bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140125, "uuid": "9312057c-f640-4b64-a070-90412a048821", "comment": "Malware payload (N-able)", "value": "e3da5be242f514054c1049a6a6faf1d39f6b5305c217cb4debaf39ec09da3120ab60f4121c5bacc25800f89e8e633c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140125, "uuid": "4f2e515d-7296-4fe3-be35-884b4242f901", "value": "T11AE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140125, "uuid": "1dc2525c-e7e7-49da-8a16-c8c20c635e0d", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140125, "uuid": "f42c5f7b-1b50-41d0-a432-a2cfdd9ec999", "value": "393216:CMF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1f:FrRxvoC/7a0jUxX7h1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140125, "uuid": "d1e589bf-7d15-4b29-9f62-d7f32ff5981b", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140125, "uuid": "71dde7fa-63b5-4865-af50-50e4d0277888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140125, "uuid": "02c2e387-9908-43b0-aa4f-3a11f2029e62", "value": "Or\u00e7amento2026.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9d0ebe-0154-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770159864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159864, "uuid": "1ef7ca79-c3d0-48df-a007-b1752dd75c95", "comment": "Malware payload", "value": "9c06c392efc517da443b8e847ce752fd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159864, "uuid": "d0744845-f172-4b51-951d-1d023ab4a3c7", "comment": "Malware payload", "value": "bf1b8188e4a025237264e670cf5eec1a56d6e5ef10ee837d325f642626f97fe7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159864, "uuid": "12017ca9-464e-44c4-a151-958685d139f5", "comment": "Malware payload", "value": "952145e9c2b050da533c3c8e26fe421a9cf39955", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159864, "uuid": "facb4861-1be8-4ee0-a582-cc2e9849b5d0", "comment": "Malware payload", "value": "13b0d52817f6cb112b027d8ce7c26bdab7926dbbdd6ac2dca1c998b81031727f23cfcac81d242a77666432d78f7aa544", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159864, "uuid": "57027b16-c3db-4a6c-a36c-7b511626885d", "value": "T15826DF2629ED60EAE87ADDF2A0E0B5C11F94FD7D45A508E468CC7678DC120533FAF819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159864, "uuid": "b5787ab3-82c3-4c85-9676-51b310b93d46", "value": "2357c925d5987053dcf0c59a30ebf2d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159864, "uuid": "0f666ce3-45e6-4b09-8272-fa39ae8d4ad2", "value": "98304:kBXwY53vIMvUnh9bqnWkI/B5NJ2dIaZ7L/Foze7:kBAs3Ji+WhpXJ2dRZH/Fo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770159864, "uuid": "2f097e74-7e00-4dd7-b861-7024eb96d676", "value": 4811336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770159864, "uuid": "a4ddefe7-f1cf-4ff0-8455-e1e5b1e86fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159864, "uuid": "0048f62b-2efd-4e9e-94cd-6aa022e71410", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b18840-00cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770102830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102830, "uuid": "f7476d21-8708-4074-93a2-2638d3713147", "comment": "Malware payload (Mirai)", "value": "a13c2a131b20470bb96168f8ca545aaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102830, "uuid": "a6fc4935-a48e-42b8-927d-97a91899ffe2", "comment": "Malware payload (Mirai)", "value": "bf513544937e1492e9391e0cbeb6eb1b3f9933e882fb771309ccc46ab05d8e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102830, "uuid": "3100b39f-807d-4d6c-93d8-62b51d9f8832", "comment": "Malware payload (Mirai)", "value": "73e10f5055577020bc1e561cd5651b9d2658dfee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102830, "uuid": "cb7e464c-ded9-4f9c-940d-725c3172770d", "comment": "Malware payload (Mirai)", "value": "69c730e966b206583ebbf68cc353c4a156880e4de6dedc74ec198446dc841e19c4889b7ab28b0ea06335397f32862a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102830, "uuid": "4fb4e1d8-6752-4ccc-9e27-e50fc67b5e89", "value": "T16BE2E09252C41572DDF348BBEFB1428375CA15A8E29F34822774436CBD4AC868B9E397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102830, "uuid": "460eacb1-4f24-4104-a57a-22accd3875f1", "value": "768:HRcR/2Kw9oZpsE7jwwGqJ1PU0pxhWDG43UWV:uROKiKj7DU0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770102830, "uuid": "f490c7b8-7c59-4d62-b0da-14279836755f", "value": 33140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770102830, "uuid": "62081d1f-c701-416a-933e-e4defe4b6cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102830, "uuid": "22a6c32c-c467-435a-b4ac-c74e3c66bb87", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd54699f-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140132, "uuid": "e2790873-9d2d-4ae8-adf3-779595e18eca", "comment": "Malware payload (ConnectWise)", "value": "851a9e8d56754f8dfc0600fb44ae6a49", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140132, "uuid": "4bff4ed6-f15b-40c0-82b1-f19173e0eba6", "comment": "Malware payload (ConnectWise)", "value": "bfab09a918d4e8124ca938f878c432c9c20da90a2c5a1e84b24d38228eb45a4e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140132, "uuid": "389afa28-5a2d-4856-beea-f9241255151d", "comment": "Malware payload (ConnectWise)", "value": "372cde6aa19ef907cf16bca4a48e3ca69b18ffb9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140132, "uuid": "f537a45c-0332-4767-9dab-4e32b7f731b7", "comment": "Malware payload (ConnectWise)", "value": "6981127feabe0790d4c4f0eb229a8869b0f640a47fa2dcee730efe22e86f2fe7af49168ed981222f22673b5ada505978", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140132, "uuid": "3b6e0d01-840f-4c88-b6ed-ebaed2f72519", "value": "T195A6231172E58179F1FB0B39FD3A91B16A763C699E63805F1394391E1A72E50CAB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140132, "uuid": "27715c9d-1c6a-4da1-8703-3202208d9113", "value": "196608:cZJbjFd29UxmFZJbjFd29jZJbjFd29zZJbjFd29:c3b29UwF3b29j3b29z3b29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140132, "uuid": "5899cfee-6141-4c32-b64a-54469e16b247", "value": 10067968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140132, "uuid": "36a3cc67-6944-4244-b0a1-bd10d7a0aaf7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140132, "uuid": "fbe6af3f-c1cd-4882-83cf-44fd623e656a", "value": "American Silkscreen Inc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c14ddd-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139023, "uuid": "bd8a30d7-fef4-4312-8415-7717f3486589", "comment": "Malware payload (Mirai)", "value": "4bd427747886a21caeb182fb9a70ee22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139023, "uuid": "8fe2626f-6e9d-4c52-9890-85a6f2bfded6", "comment": "Malware payload (Mirai)", "value": "c02a799157174157b85776e23a2745b0995a9b0f26f5365d33893cfc83b88b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139023, "uuid": "da0d3253-2ccf-424b-a32c-384bd7eade8f", "comment": "Malware payload (Mirai)", "value": "2b0313d9060bea60a4a42b610f962c0f21f149fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139023, "uuid": "36479657-2991-41db-a070-e9e55f0b170e", "comment": "Malware payload (Mirai)", "value": "1ec4293de13a89b6c8a480f5ea8a3b16be41870953ff845b9f4206b05fc4708d96011ae547ae55c3b3773f8201af88c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139023, "uuid": "7e70dc0b-6f62-4d6d-a87c-f371085834bb", "value": "T11AF20A684902B67CF2A5003DE21322B261B32D1D7EECA3E3E4473939EEA57C85975D1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139023, "uuid": "8c6e74cf-af0d-4710-9571-0e144680a5c3", "value": "768:r9WQUSY3NGKXP/8dMtSCaDjRHAsQuDygV:r9WQq3AKXnZapHAsQuDygV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139023, "uuid": "9f8d0dac-074c-47a2-827f-82ef0cc26256", "value": 34248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139023, "uuid": "a9b3619b-9860-4d37-9192-0c9b5dd27833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139023, "uuid": "2a93ceaa-9765-4721-8774-0ac93d44d56d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dc913a-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136817, "uuid": "54487345-592a-47c2-9526-a0720c203d0b", "comment": "Malware payload (Mirai)", "value": "743ac21cf9245397dae9fbfcce1c6c20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136817, "uuid": "eb124378-6f6d-4192-9150-1d1652b97f67", "comment": "Malware payload (Mirai)", "value": "c0469c8400de5b76b99f26aa982023f483df42781813ebbbdaf4e4013d8fdabd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136817, "uuid": "e0951d8f-3099-4705-85f5-f3c5038f2fd1", "comment": "Malware payload (Mirai)", "value": "a82b9f2b9ae10374b182fdd285b74c925daa4704", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136817, "uuid": "c5144924-4a4f-4770-96a8-b050b1a05ab7", "comment": "Malware payload (Mirai)", "value": "88dd505582b8d169e53519bb162debb01fff719eab5de391c7111acc16c8039ad60274a6475ec5c1eb7fac25a9b64704", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136817, "uuid": "4be3f7d7-3ffe-46b0-adf9-7b550956687e", "value": "T11D5193C532254BB8AFB15D97B6F540057485A0D2AEC74ECAE2FC64FE018CF096C926B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136817, "uuid": "d16f4d04-d510-4b07-8265-b3a95f230ce2", "value": "48:vzyuoz3Uoz58ozHwozBwozdudzEozoCozR8ozKuozLMozH+oz7x7UfozAuozjWL:vzyuoz3Uoz58ozHwozBwozM9EozoCozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136817, "uuid": "f6b06c8b-6b0f-4376-a1d9-3e3f5db892fd", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136817, "uuid": "67d1ca4c-fb13-4c02-8376-af7302f514d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136817, "uuid": "92657fa4-ee8b-43fd-87bc-5bc25f2cc9cc", "value": "goahead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e80c80b-00f6-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770119276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770119276, "uuid": "adbc01b5-4785-4c2c-91d8-208c7aa17493", "comment": "Malware payload (Vidar)", "value": "af1a7652e4ff41b530cf46c863f11aad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770119276, "uuid": "1a73b9e2-3d4e-435b-845a-dff7890a4c1e", "comment": "Malware payload (Vidar)", "value": "c0acd0c46ca99e4ca24f680506c9f0bc89cd233ee8518a0e5effa5b41ad0bce5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770119276, "uuid": "6dab8abf-021a-4c66-a0b4-391954a6af7a", "comment": "Malware payload (Vidar)", "value": "e68c96b4b14e4d2246d3a348f147b9762015967d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770119276, "uuid": "44904024-6727-4d6a-8541-605dc99e6423", "comment": "Malware payload (Vidar)", "value": "c6af9d3d7e3a29fd046dc6dbe87f13fbe55db2ea873cb1fce42d70c27386c56aaa3863821283dce7c5700731f7632a4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770119276, "uuid": "611edec5-510b-40a6-b5a6-1a35393a3d5e", "value": "T15086297F729992ACC25D853FC0A7CF40E5F371761B33C6E7129007A98A4A8D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770119276, "uuid": "021689ef-6b53-480a-871f-5f3534e98663", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770119276, "uuid": "95a29be7-d997-4f33-a666-99ba4ec8aebd", "value": "49152:SNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgnQ49dpgMDhAE+8JV:Sz7Vp7bQ49dvbJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770119276, "uuid": "04cd1d4e-37c2-41ba-bef8-bd098b36e31d", "value": 8568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770119276, "uuid": "19a616e8-7308-412e-880b-fa24fb9dc928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770119276, "uuid": "ae44521b-4fe2-42a1-b321-e9311bee436b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eaf535-0118-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770134162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134162, "uuid": "d8586200-bc78-4b24-9712-7e6653e5d08b", "comment": "Malware payload (Mirai)", "value": "76d41f23875643de922c17abb7c1241d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134162, "uuid": "2d202ad0-a7b9-4091-b1be-8a8b0086676d", "comment": "Malware payload (Mirai)", "value": "c0f2f113941cd099a078309378ad0b1e4e2ec1414713f52fc60435c0379fc216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134162, "uuid": "71b3d160-7f91-466b-bfb3-3006d3d995ec", "comment": "Malware payload (Mirai)", "value": "9b1e836c0d9796ba068c52fd62c24d7c0402e51a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134162, "uuid": "c9be811a-bb10-4b43-9df9-e4da571e6a63", "comment": "Malware payload (Mirai)", "value": "f2d9dfb4b5d1d5abb85c43877f3b7475d03b7a9791569f3a69d54d3930dc9173d25be21d73da899a94b13d93e1037cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134162, "uuid": "f7b9a671-e4df-4a2b-82cc-886daf742251", "value": "T1EED3E195F480CB62C7D4663EFA8E0648772303B8D6DA7353DE155E343B87A1B4D36A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134162, "uuid": "8050d578-af29-4473-8559-9171e9ad7bb5", "value": "3072:rponhnSMawIDG4wRgmDQ43I18bXX/hx5+kmj9pAd:rUhSjwi4s6I6bXJ7+kepAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134162, "uuid": "53e8b343-941e-457a-a7c9-44ace95fb50d", "value": 141438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134162, "uuid": "8b89c19b-9110-4ca7-b87c-ab010f12f35b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134162, "uuid": "3fef00c7-fab7-44a6-beb0-b1d97fadc62a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c46747d-00d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770106790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106790, "uuid": "36fe5d3f-c98a-41c6-ba39-145477686e9a", "comment": "Malware payload (Mirai)", "value": "9b50982257feed17621abe6cc98a5780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106790, "uuid": "ae93d878-6129-4185-938b-3d116983ae21", "comment": "Malware payload (Mirai)", "value": "c1492cb7bd21a48c80f51e360e3bc342d03d4f8b8654946ab62f7c38b1c1658d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106790, "uuid": "80d754b7-7dac-476e-9799-c5b7c0500d01", "comment": "Malware payload (Mirai)", "value": "dc03bc5a05752b863cc68509d3cea0737bb057c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106790, "uuid": "6256367b-ea76-4a64-9d68-ea34668def54", "comment": "Malware payload (Mirai)", "value": "ba4e02ae66bcf2f45c41c562f15d6d658f0cbb27f31e5ea0de9556a4172c7fe56b758949d403938056b4b55fb1f2d2e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106790, "uuid": "4573b758-b9b1-44e9-9890-c2975baa3cb0", "value": "T1A004392F258192F0F6411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106790, "uuid": "4b567962-000d-4c02-b7cf-e673da82850c", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wpUX9:7IJ5k1DVA2nDXNgEJi5aKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106790, "uuid": "85c90552-2a32-4267-ac89-43844471d693", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106790, "uuid": "71d71884-d89c-48b9-b434-2b0de6da831f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106790, "uuid": "fdef3063-094b-4bb7-98aa-2d5a1b8f3743", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfa552b-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101745, "uuid": "6372b6b0-1ab9-439a-8d32-066c42f1fa78", "comment": "Malware payload (Coper)", "value": "fc2cf8abbcde08a7906d9eef12895f51", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101745, "uuid": "0b78a9bf-8d29-4976-a947-38968c87d784", "comment": "Malware payload (Coper)", "value": "c15a7113d21573038a1e256871fc641d5a94d8e1ea164307ad22e97e7df29aa6", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101745, "uuid": "9a131fd7-d4f2-4889-8636-3466c37198df", "comment": "Malware payload (Coper)", "value": "af9e604fda1e57d22de9a1470113fd08d756721a", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101745, "uuid": "8e7eb060-210f-4ce2-a1bb-08f2561f5f15", "comment": "Malware payload (Coper)", "value": "e369850bc3f075e1a683290d189917ed3ebd87bcb6c822a7ddc0f0c4d39d54a4185f2b449ab4d8a61b7064c515c82f5a", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101745, "uuid": "f659e945-9fda-47d0-895d-e84acd2b049e", "value": "T1A5451202B7D4C923E1BE1B398D6682D19571BE50DE41A3977A40B74D0CB23C6DE3AF92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101745, "uuid": "c6707044-7b40-4e51-b84d-9d5a1dc616f2", "value": "24576:cL6c5n2a24xlpoEkxnsMxPQ4GfIy8xdC9xU0MlXEjeW9Xa+OYGP:cL54az/oEkxnLQZQyUdexU0MlX2fX5ZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101745, "uuid": "9e5e96c4-16a5-405e-9061-467943bd6f2b", "value": 1176803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101745, "uuid": "b9dca85c-39de-45b0-815d-248545090a04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101745, "uuid": "814eb7ab-e786-4f0d-963c-6a42006d4e97", "value": "21b062b_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289b38db-0142-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151908, "uuid": "682b7251-aebb-4244-ad21-0a0f8d98aa60", "comment": "Malware payload", "value": "68131f50aefbf75773b9dee4b46d4deb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151908, "uuid": "b767968d-6a1d-411d-81e0-9be7c4cc2ea3", "comment": "Malware payload", "value": "c1f4ecec04a663ba9f73e54d247c7e76e93bb6c1e1948388068281181db4a14d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151908, "uuid": "685ee9f7-6b70-46e1-b8f5-7cd505059808", "comment": "Malware payload", "value": "c6cc15306790b69cfc74f0e40982b1baf7d1db71", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151908, "uuid": "19b8bf8a-50b5-4267-8dee-ce91bbd971a6", "comment": "Malware payload", "value": "994b9778c317b50e2a648df231fdc0e83bb132cb49561164d8b85a7822524f3a29a6c1da17d6fb953a7e7f1bf844b8cb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151908, "uuid": "34b62e71-1f62-4b97-baf6-b2b431118e25", "value": "T1397602001DE59EFAD57D923D9BEE333C04AD8B200602D4DBA95317CBC63F79166A252B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151908, "uuid": "3f837841-1cbb-4455-852a-3f30da0960dc", "value": "5835a00704808b8d6eff9e697fe9e4a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151908, "uuid": "6a4cf622-8bcf-4d6f-a50a-66ed3be8381f", "value": "49152:4jyKx/LidBMfOZGRNpBC/e34UpUALjt/3mwjzy5phHooKqtYh/KMMG3/Np9XCKQO:4ja+xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151908, "uuid": "5206dc3c-d148-435c-902d-3e0190b1ca2b", "value": 7340032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151908, "uuid": "c52a801e-c837-4711-8acd-3868ccfc61fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151908, "uuid": "e903e70c-9c64-4533-9736-e257bd7cb01d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5d4c87-0131-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144719, "uuid": "bbfdcdcb-0280-4966-a4cc-87bb403c5525", "comment": "Malware payload (Mirai)", "value": "f9cf2ba4e97f15ee52318486d908709f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144719, "uuid": "7996e905-aed3-4f06-86ba-cc4749335e40", "comment": "Malware payload (Mirai)", "value": "c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144719, "uuid": "ec828e53-6c48-46c6-9686-d8cbba2ccca8", "comment": "Malware payload (Mirai)", "value": "9fa848bcb9d854c0b145505e330b1adbebf3705e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144719, "uuid": "c7b48e08-2d35-44c7-b7c2-2009f56eaeb2", "comment": "Malware payload (Mirai)", "value": "9ec3260e63413f87468970cc30ee0446e6a17b68102fd0a2ef1576bdac154e6be40659f708ef72d3dcbea1f3a9197c51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144719, "uuid": "60f1f92f-ac42-4d72-9079-8e045b913a46", "value": "T14C51B4D510B18B743E65996AF3A44C1C3A84B49760C71F96AEDC38E560CFDA535807E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144719, "uuid": "27b4fd4a-5402-48ba-a71e-b53828f10196", "value": "24:ItkzYskc3kqOqsFk0VBkqeskyLkBTB5JkgAgaNk6XLkPTPNI8ksko7ksfkaAaXXe:iOhPZsFl/jIFfGXLaJ5PtJHOj2hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144719, "uuid": "b35690a7-34e3-43f7-8087-5f418ce5f5f2", "value": 2999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144719, "uuid": "2d8ce34b-89ca-4be4-9d7a-03cec07b1688", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144719, "uuid": "35a1257f-eafa-40cf-9ebd-1ba8870a4aee", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baffaac0-0126-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770140128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140128, "uuid": "7505a609-f77d-4336-aa09-4aaa69f8657e", "comment": "Malware payload", "value": "3797fdf15ec21687fc2ce697d75a25f5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140128, "uuid": "e8c7b24e-8f0a-499a-be32-ffd408be7563", "comment": "Malware payload", "value": "c3871dd901ea063aca86177df067f3d2a023fc6064d720ca5255e58e5cb02c2e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140128, "uuid": "c7ad78f3-77c0-4c15-b8a2-6431e86dfa0c", "comment": "Malware payload", "value": "0e153f6b6f61babf0150b4109ad318ed47d99cbe", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140128, "uuid": "0160cb2a-9870-4da2-9fa3-b69b85344485", "comment": "Malware payload", "value": "0cbc52b5ae65be96b492168fa9930dac4e208ea8c0773ef98f5014e38e7bcfab04418bc67da3166be63cf86623a14ae1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140128, "uuid": "83ac3189-fc88-432c-93d9-6950efa1704a", "value": "T1AE41755AFD0BA91AC5B1C2D2B9267E0FEBA4041715206068F94CD999CB349BCDB7C1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140128, "uuid": "dcb209a4-0e1c-4ba2-a993-65cab71da4a9", "value": "24:PXCjMmu5FgKZhs3TcGlIzSG9QdW4ahMYkb9/ROMx1AWqSMqgX6pMxZcrkezaGoH+:PG3RjcGGzpKdWzC71AWdMWQ4haGEs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140128, "uuid": "bbe57df3-b2c8-4395-9470-23cfd4456d8c", "value": 2340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140128, "uuid": "38a6907c-e39a-4e19-aa52-75ca9b44dd0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140128, "uuid": "1542f312-322b-4c48-9804-1759d2916e8e", "value": "quote3563.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cae241e-0131-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144721, "uuid": "2b087235-caba-4802-a7ba-155ec351da25", "comment": "Malware payload (Mirai)", "value": "d1b606ad34d3ac697764206ba8eaf47e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144721, "uuid": "3923596f-fae1-40a0-8332-b05183be1d4e", "comment": "Malware payload (Mirai)", "value": "c39ce9aeb58024de86d0df1aaed297a308cf59745d0c8589db81902cdb402bb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144721, "uuid": "280578d3-347c-4292-9429-3bb80c48ce45", "comment": "Malware payload (Mirai)", "value": "77f158333b00cd7f500c007de7b67aa4d6a80b30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144721, "uuid": "d8af24aa-78ac-4292-ac49-ca644a18aeda", "comment": "Malware payload (Mirai)", "value": "fa9d1c9311c935dd6c4cbdce9824c7ad6afe0df46d0449d7a2385988c12bc5e5d951823b0075d5f2ffeaca4e6bfb9c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144721, "uuid": "4609d154-eb75-436a-9ae4-c09817fdefcc", "value": "T18F9374097F901EB3ECAFDC374AAA274414DD562B256C6F75B930E828B50B64F26C3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144721, "uuid": "c1bc1388-ff9a-4b89-8520-8572faf1a20f", "value": "1536:+E/xOpx+5QWpaWITkJV5CvxUnwKe8gZriDs8F1o://xOpx+5QWTIa4QgqFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144721, "uuid": "99ab4693-1556-47d5-9b5c-3e81e5b16d97", "value": 89104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144721, "uuid": "8f296044-91ab-4874-88e8-13a4ead53878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144721, "uuid": "5441f46d-cfc9-4496-b6eb-dbd39dad4afc", "value": "mao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e589c99-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101747, "uuid": "3ce88a17-36ef-4daf-a8d3-d275fa46df1f", "comment": "Malware payload (Coper)", "value": "cfc4690ab2fd0c05ebac471a4ab30b1d", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101747, "uuid": "635cb471-9b64-41c8-aec2-7a814b0749c5", "comment": "Malware payload (Coper)", "value": "c4bf99a895492e137b3eb4a1425526f382163068ea5f1a11a5be7920ddb3f6b5", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101747, "uuid": "64bfbb62-aad1-45d7-aa46-78c8d3db83bc", "comment": "Malware payload (Coper)", "value": "bff9ca55c2fc2bf483f24188673a090ea02b4074", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101747, "uuid": "691927cc-ba22-4303-9e2a-2906029c30b6", "comment": "Malware payload (Coper)", "value": "31748ca5d2c120b20103efef7cf2e799ffa2cf4d2493a6d9d6c154a1b3f880fdadce4bcc12e2a8f14652e8b27df91152", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101747, "uuid": "f686d93a-6e88-4f13-bb76-921e5d0194db", "value": "T1AA451241B798D717E8EDAA744E67C3D1A2513D80CE11435B7A8A730C1EB23C64F27B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101747, "uuid": "76fe3270-9088-4fb4-b436-6afd4ea80595", "value": "24576:my+z/XOTLTyuX+Y8xrbszw6I7Uly6bs4ArYrn8DGce1Z4tFn/ErO5e:mJ/G+TYEc1mwy64lrunQGt12tlYMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101747, "uuid": "b550a665-3b4e-407c-8d85-74ee3b58991a", "value": 1176803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101747, "uuid": "5f1d5344-d37a-4814-93ed-dd8738cd7aeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101747, "uuid": "b4284ea6-9e17-4356-8556-a3e2dbe037b9", "value": "25f54eb_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdad72d-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770088167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088167, "uuid": "13b1573e-8a41-4fa6-824e-2bd4cb1b555a", "comment": "Malware payload (XWorm)", "value": "790face14452f40c78304ec337c405ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088167, "uuid": "bc1794ac-1ba4-483c-acef-07298716274d", "comment": "Malware payload (XWorm)", "value": "c59ca57605f1547bb03591cbd516c45857654c35dfcfe5a4105ffa1fa0d48b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088167, "uuid": "17c0ca8d-2d0c-446f-a353-52abb1a05f32", "comment": "Malware payload (XWorm)", "value": "55a47f3518e656f424d2f0ff2ae9918533c90c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088167, "uuid": "1ba353ca-e1e9-40f4-9fc1-bdc5d2769d7a", "comment": "Malware payload (XWorm)", "value": "94bbb0cddd66c3e2a52a9d62063b125127776a765a087a016ed5c8ea765c02b5d17c417f5c98f14ddae0072b0daf951e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088167, "uuid": "f2abd90a-ad3a-46ee-9ba3-f1f065037065", "value": "T124346A28F19EE13FD13089B52D141FDC11F985B9F0C6AA0AD2516B3A27B09B27F7D606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088167, "uuid": "9f3366fc-846e-4beb-a39a-77956ea87436", "value": "a60e2f996367d3f0f40289c655d2d075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088167, "uuid": "0ac826d4-7b94-4e9c-bd38-cdfb08e1d5e0", "value": "6144:VONUtemwXjg7WawYfQGqGgvyXe31bXbeO:5K05ESO3VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088167, "uuid": "8b9adaea-0667-4006-85aa-61574d9cc66f", "value": 235688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088167, "uuid": "4f2185b7-eab7-4a3e-8a4d-6e6010317d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088167, "uuid": "beae0e85-bf67-43ec-a93a-f37f9d1c2e90", "value": "importantdocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614b0351-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136971, "uuid": "a589f481-2356-4efd-8454-c849a0da55c7", "comment": "Malware payload (Mirai)", "value": "20bd7161dd852e442367032f15066155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136971, "uuid": "9184cd76-eaf8-405c-ba71-7207165dfa7a", "comment": "Malware payload (Mirai)", "value": "c62afaff80ce42bd7e8f6f3b66e45da9a3b36d00fcd630936d28fbce2c9d8f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136971, "uuid": "a9dea355-c209-4443-b1e5-48f9caad436c", "comment": "Malware payload (Mirai)", "value": "d388d84db29cddba9e06b0bf9eb4a9ef44100737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136971, "uuid": "21da66fb-09de-453e-9dd3-d2fa0d5ff9ef", "comment": "Malware payload (Mirai)", "value": "2c5c8c99c37393d18345ed47ae9f6effdf1d6ce2acb9e98522949f53dfc771f1aaabc729671f625c9360fe602e45c1a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136971, "uuid": "06db312e-3198-4cbd-ae53-a03c7ac8c68e", "value": "T1C7D2E02CC81DB949EAAC2EFD54DA55A5394CB4C0A319E6CF0762C458FB17F4BBC170A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136971, "uuid": "bb35606b-40d4-4f80-af00-5c91477389d7", "value": "768:H1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNVJbcWWBQx:HbDs06t4BEub4sU/MbUVyQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136971, "uuid": "8dd45a0f-ee90-414e-9e74-d0511fcacce3", "value": 30600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136971, "uuid": "d57a1cb9-5400-4035-9dda-f1f0bb09e318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136971, "uuid": "b0e212db-3625-4c65-aa6b-6dee8b4a8dc3", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb81afba-00b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770091703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770091703, "uuid": "a3196801-7948-47e1-9733-b5e05141e0b3", "comment": "Malware payload (Vidar)", "value": "800772f0aa52d5031903790879aa96b3", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770091703, "uuid": "1fd7d5c7-b8fc-4df0-84c6-1f42a0b14e90", "comment": "Malware payload (Vidar)", "value": "c62c6219559e64910329006496ba8d9c4709092420ff026547a1737ee761786c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770091703, "uuid": "00020ff0-4e20-4293-8e03-f0aa8498971a", "comment": "Malware payload (Vidar)", "value": "2a4319f059c207728b0952552ea6cfa05586b4eb", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770091703, "uuid": "c58587f7-88ba-4f16-9cd6-10cd819ab544", "comment": "Malware payload (Vidar)", "value": "df068a23737a8b1d4e41b9d2f7efd789610566f4246bafb52633755fa967f82e3c43393aeb9f83cd9a0da09856a9e026", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770091703, "uuid": "ce0c89d4-805c-4ee8-a434-cdbbad87cb6d", "value": "T1A186297F729592A8C29D853FC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770091703, "uuid": "061ebcbd-439e-40b4-b462-1aa73e148972", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770091703, "uuid": "ac6c7829-2fa9-4676-959e-5efb11487445", "value": "49152:zNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg/Q49dpeMFL2jryV/:zz7Vp7rQ49d/6j+VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770091703, "uuid": "a3381c59-0641-4fe6-a7f4-398b2e28808b", "value": 8577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770091703, "uuid": "8fd8a26f-73eb-4bcb-b46c-fe3e7841947a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770091703, "uuid": "3de2ffcf-df75-40f1-99c5-60e189ca4bfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ae5cdc-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136891, "uuid": "2c48f20f-5705-4bb2-bc51-90629eed3c1f", "comment": "Malware payload (Mirai)", "value": "d19c89f2ea526a1d53d6497f58225d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136891, "uuid": "eedda537-6e05-4453-a215-3f0001fe58a1", "comment": "Malware payload (Mirai)", "value": "c6addcb5c29a71af7c97ff54bb61a8ff2b05449c778f96ab495d8ff1e46e3c61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136891, "uuid": "bf4896b5-5e27-4a2f-ac77-e35e33325bb1", "comment": "Malware payload (Mirai)", "value": "b8d130e12f220d8c3e2905e65d676ea879800798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136891, "uuid": "331dd862-923f-4539-af2b-a3d3c40a0071", "comment": "Malware payload (Mirai)", "value": "70bbdcdbc701f8d90aa6eef3d596ecbcfdf26c15c74f5ec6370565e71d4aa056aa326ef67aa557e70bb11c668dbc5820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136891, "uuid": "c1d38ad1-bf60-445d-aa71-f306b599ac7d", "value": "T18F5338C4E2D3E8FADC10087D317AAF729E73F13AB135D99BD3D959639901A02E20625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136891, "uuid": "404cf76b-bb94-4bc9-952e-e3f2cb9f92a3", "value": "1536:0UEMAWwPQk161TTWKRmyaSkDu4eFOVfr:0UEMAWwr161TTWKRmyaSmu4aOfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136891, "uuid": "904fa7b5-cc09-43cd-92ec-f85c31181024", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136891, "uuid": "a37218cd-e09d-4bf0-8a8f-f17d5cee22da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136891, "uuid": "aa00b89c-5aef-4945-bec8-83b28566ca27", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732c6412-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770136571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136571, "uuid": "3bc703ed-5344-42df-960e-71286ba88a3c", "comment": "Malware payload (Stealc)", "value": "379682bb4d33c1f2667c0b1eae37b8ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136571, "uuid": "aeabdfca-69fc-484c-8db1-e787f46aed91", "comment": "Malware payload (Stealc)", "value": "c7916a6101d5821e506dcd49e9917c08cc1bbc285d68f12d259299ca0a86ea51", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136571, "uuid": "7ffda270-c9cc-4145-8537-05638fdb6e15", "comment": "Malware payload (Stealc)", "value": "4ce2ab0b6364b96d5ae856a6a47fdb93e66d3d7e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136571, "uuid": "3ceb049e-ed8d-41c8-b8b3-15f7e5482156", "comment": "Malware payload (Stealc)", "value": "5c0858ca9ce005c27962b9ec629c5adeab5e623168544002fa1063ced74b41f10983085d17638b4f700f4b545011b98c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136571, "uuid": "8da12003-cd68-4701-ad4f-989310dd6d70", "value": "T1E1164A92BE94CE61C5DFE23AF86191D56230B409133532D72B261EA65CEB3C4173FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136571, "uuid": "5ccd053a-7568-45f1-a367-675f3f3c1af9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136571, "uuid": "58689f1d-cdea-4b6c-a9a2-5b935824cfa6", "value": "98304:s8kpcB6XzQoV/ZkxN0iu4F0bTLUenbmV3:Wnbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136571, "uuid": "c36aecdc-ed73-48db-becd-57fc36108336", "value": 4112512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136571, "uuid": "1e0f05aa-28de-4b72-baaf-8835a6989188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136571, "uuid": "b298113a-11c4-49ff-92dc-7ee4aafba949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffb83a9-015c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770163168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163168, "uuid": "4f7513b4-a9a0-41d1-a12b-4516c003d0a5", "comment": "Malware payload", "value": "0922d4093f3c730b7c1c1bfc981040f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163168, "uuid": "6671f4a6-cee0-4a4b-9b0b-7b464e106a78", "comment": "Malware payload", "value": "c94589ffb489005153b92495beb6e1cf8de8660d6ca43d81562899d19a8445b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163168, "uuid": "53bd69cc-5d69-42b3-8132-7120dbc547eb", "comment": "Malware payload", "value": "13fe9fd606ae8e0dd04f8b12c9e54da1760cb286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163168, "uuid": "100ad3e6-bf48-4d30-aeb8-040d7dc6d236", "comment": "Malware payload", "value": "f093c30a736c3a53208f4c723c2c694160cefab4a91087ab3f535b6512902180fe1086fa3a794f4c7d7fe13cec68c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163168, "uuid": "72575035-110c-4a68-be54-8d2cb7486eff", "value": "T17313C646AC918E6346D953FBFB6E01CD33262BA9D2DE7002DD115F543B8A96F0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163168, "uuid": "f8e6a968-bebe-4344-8341-a4349d667c1e", "value": "768:Nj9qqQyNEn0boLS/++fS1ONlNwdo4YrX4NMahiq15mNu1tnxv5ykMmM:t9ptsiojLeNw246AFb/1tB5+mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163168, "uuid": "ef45a744-7488-4fee-ba4f-05a29dfb3387", "value": 44623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163168, "uuid": "9fa66caf-e57c-417c-9f1e-8f5fd05d4a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163168, "uuid": "3dd4efbc-714b-4f42-a4a7-ce0cea2cc055", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895143e6-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770143480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143480, "uuid": "eb58007d-e2c2-407a-b33a-f02f59d1d533", "comment": "Malware payload (Mirai)", "value": "b01df170d23043a7bd87e38022196d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143480, "uuid": "712941ef-5cfa-4871-a351-f0f4d8a7d9fa", "comment": "Malware payload (Mirai)", "value": "c9a5b70a4996672bdf307d2de8afec6bbe5f136149de33936dbd145d6ad82509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143480, "uuid": "0ef0511f-d602-475e-9116-4ef82a6dada0", "comment": "Malware payload (Mirai)", "value": "aad54e4baed78d1a56aa3fb9516125b652ae169c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143480, "uuid": "1511a1f7-8a90-4e58-a670-e7b750fb9320", "comment": "Malware payload (Mirai)", "value": "68b0ae3124925a386429eefbb8178a48e3e593bd6eb1586b3abc946c421137f75d6aef5f43f5c300ec729fc000f681fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143480, "uuid": "91190f6b-67b5-4482-a880-d8a071eeae6f", "value": "T1A3932A82B741CAB3D1830AB213E79F250532F5BB1A1BAE06F3687DF49A150C57226F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143480, "uuid": "09219eae-b306-4622-902b-6561fee085fd", "value": "1536:ptpnMUcOk9mijh7kU3Uc/pbhNVfvFxIAFkxzp599kBmvHgyfyp3mJ7uVjEqeVlvs:HpMUW9mijh7kU3Ug3Vf9xIAuxz/YSgxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143480, "uuid": "e6736b68-a489-4a8c-b0af-d7713d90c5ea", "value": 90447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143480, "uuid": "aa495482-b08c-4bef-9039-fa7af9cb617c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143480, "uuid": "47058873-8e7e-4e9c-99bc-f4b1fee6c962", "value": "pXdN91.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e30ad8d-00fa-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120994, "uuid": "2d74005b-e03b-4920-b32e-cae35fe604e8", "comment": "Malware payload (Mirai)", "value": "631c2108559a2eef867c3bcebd81cefc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120994, "uuid": "32e307cb-3ec6-4e78-b77e-28ec41ffb0fc", "comment": "Malware payload (Mirai)", "value": "c9ddb41ae3612864c9cef07da4512ccb04981be9ec81b7f74a96c92cc4f853ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120994, "uuid": "f0635a17-1685-4e2c-899e-b5589eb8ae39", "comment": "Malware payload (Mirai)", "value": "482a59c4ed2ccbe47c01508962c6ac4f4c168784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120994, "uuid": "be486659-428a-43a3-b5ea-ff9ca73e796a", "comment": "Malware payload (Mirai)", "value": "97d7751e981a437fdeb08d8ffbfb193edc394e6f79984eb3bb47cd4ced863a64756193e6c130d57d7968d159824ec81e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120994, "uuid": "6cc0505e-ef79-44b0-9a96-eaf0f30dd604", "value": "T100631742FC81D917DAD4133ABA6E91CE332173D9E2DE72079E126F113ACA91F0D6B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120994, "uuid": "90b5c978-100e-4050-9675-29ccef21f018", "value": "1536:roIeAZhchfqsmbJIBRghfxXNT2zgpN/Y7Fw:rTemhFJ10zgpN/QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120994, "uuid": "5d977cf8-2648-445d-97c6-ddd57dfd179c", "value": 68588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120994, "uuid": "2c392e6a-6384-4625-badd-9fd38a635375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120994, "uuid": "dbea6a0e-625c-4be4-8af7-b5fae70f9826", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db2ecb2-0105-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770125664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125664, "uuid": "55da42c6-2477-4fa0-ba6a-b20f4a6cab87", "comment": "Malware payload (VIPKeylogger)", "value": "00007b961ae96ab358b1ec9195e55231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125664, "uuid": "b9031edb-11e2-427c-aba3-66077bee5cf7", "comment": "Malware payload (VIPKeylogger)", "value": "c9fe8a53f318210648f805094af93245fb05c4bf3e36d07be96c07ad434eb096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125664, "uuid": "6bca1024-51d8-4c08-9e41-50701b6e0a06", "comment": "Malware payload (VIPKeylogger)", "value": "c9ea890f78823c6fba067fa4a6175bacb20e26da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770125664, "uuid": "74b6809a-9ca4-4763-80e4-da19488a15a2", "comment": "Malware payload (VIPKeylogger)", "value": "4a3aefd1b0f4ff51d5e3201836c6c9e158f775f536e4adab474225561fcdce76e66451930206d4096b450d06dee7045a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125664, "uuid": "6fb0fe20-3610-4fbb-9490-681d6838a56d", "value": "T1D654237619793BBFE8DFBA341420F160574A05ABA7F45B346B02A3806B973195EECC03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125664, "uuid": "232a3be2-2617-445f-be41-dfa9d099813f", "value": "051cad3135c349095999b0202ddb44ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125664, "uuid": "a1f6db09-eaca-4b1d-9201-5adfa008f35b", "value": "6144:vX1e6noWyYRRUZJHwGQubj3TQSRvohyraJ5E+a0Tcb/:fobYkbHrQuZy4+a0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770125664, "uuid": "06853a48-faa5-47f8-bc6b-7179cf8dc487", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770125664, "uuid": "28d2b663-2534-4702-b3b5-401db72dc1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770125664, "uuid": "0f1d16aa-f3ec-4a29-965f-677708123015", "value": "Copia de comprobante de transferencia 02-03-2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5baca96c-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101743, "uuid": "36adf118-59a7-4c74-b5e0-c50a6b877372", "comment": "Malware payload (Coper)", "value": "c11ff1a0b8be80cac7d838b5f4237822", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101743, "uuid": "f3c3bae5-0c51-47f2-a278-e1bd8656b94c", "comment": "Malware payload (Coper)", "value": "cac4a6a67213b3ddf66647c62db64f918132f8e21ee6bc1def13b82b2d6d6d1b", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101743, "uuid": "ea92fb00-1d7b-42ec-8235-050a0f3b0189", "comment": "Malware payload (Coper)", "value": "826976a6e5f248002c8e630ca010b3cc1c11e2f8", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101743, "uuid": "5bfd7900-a9c9-4008-9feb-a2e2e89134ae", "comment": "Malware payload (Coper)", "value": "b4bf5839003a6e56a5aa61a5499fc66d0356e8f718c7f590262310a29c0ea7d003081da794441246788bc9b2dc84f195", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101743, "uuid": "96a90c93-bb46-46e0-bc88-332edd0b0c4b", "value": "T12F451243F39C8B13D8AE97748E5BC690A6357E44CF1267676A40731E0CB37889E22F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101743, "uuid": "73529746-2fb7-432c-8d40-9c426035cb68", "value": "24576:8CW/LO0MFI+3ICKKWwcwFHWvNXvhkNUGGBQHnRWC8hia7oDHnlwSEU0:8CxjICvWVwYFBa2iaEDFfP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101743, "uuid": "c9c94c64-08c0-490b-9a77-50dfc65e1ad0", "value": 1172707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101743, "uuid": "5005e296-95a2-4ff1-a461-d951c99fa6ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101743, "uuid": "b134c3cc-361e-44c6-87cd-b6de42917d77", "value": "1a93d09_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bae7b0-0127-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770140580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140580, "uuid": "8d9b8afc-08cb-4951-9b28-6d70f65d363a", "comment": "Malware payload (ConnectWise)", "value": "644adf0a7890bb39aff0d87d663ca59a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140580, "uuid": "3907c8b8-9491-4f20-b534-cc213fd4a182", "comment": "Malware payload (ConnectWise)", "value": "cb9351ec45f29c0b90cfc62b6d297be4c3f57221558295a679a36e3b78edf84c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140580, "uuid": "4957e1a7-925b-430a-8489-2aa75410436a", "comment": "Malware payload (ConnectWise)", "value": "660d95ca4b98b8713909ea00a4f4afb842d2b351", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140580, "uuid": "22c9a36d-40cc-4f31-82b6-07943d54b0e4", "comment": "Malware payload (ConnectWise)", "value": "5e7139c789e2768a42c78f930a5b71a22165aee1846c9759bb2a0bcaa95a79afd69bfac3559b9827b8a7289456b7971a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140580, "uuid": "ba175c5e-13a6-4b4d-9e90-ea35ed19d334", "value": "T151D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140580, "uuid": "0b7085fa-ff8d-4d16-afaa-94a12cb66b82", "value": "196608:VHxcp9ym3nltDUJVaHxcp9ym37Hxcp9ym3GHxcp9ym35Hxcp9ym3WYHxcp9ym3WO:HGplpRGpFGpUGpLGpWmGpWqGpWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140580, "uuid": "ad19f3ea-b307-497d-8f48-db9eb6cc7a4c", "value": 13524992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140580, "uuid": "6d9a6c0b-e9fd-489e-958e-56d4a64e9737", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140580, "uuid": "fec9e2ca-469f-4e44-b431-885e7f85ce3f", "value": "ScreenConnect.ClientSetup (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d32de2-00ab-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770087351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087351, "uuid": "a78c6dd0-92cb-45cf-9348-eab76811753f", "comment": "Malware payload (SalatStealer)", "value": "b386cccc086b9f7476e556a8c619f33c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087351, "uuid": "6d433574-e43d-48fd-84e4-c0c7fbdb28b3", "comment": "Malware payload (SalatStealer)", "value": "cc46de968f628c28a3dbb33194cd7ad2b09cb63b1718a24738d2306da7060deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087351, "uuid": "8a3940d6-5c02-43a7-a163-d21ae4d25792", "comment": "Malware payload (SalatStealer)", "value": "8d4795339a171a244b8555b61b0c7bd2e02ee097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087351, "uuid": "5ff7ee07-b1f9-4bac-9b43-42af6a96f56b", "comment": "Malware payload (SalatStealer)", "value": "5ad672c9aa3b230ddeaff33fbcb3d2d292d373b7228d7e42db36b15e00ae248cf36fdd84d5de60cb3031eaed10aa15a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087351, "uuid": "f928333a-1ad1-42db-842c-022d5c6b0d0f", "value": "T1C4E5330B0B609E4ACBCE36354E218EE3D4E839315EAD0BB6F5D037848E175F86D960D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087351, "uuid": "e7d3f2da-89e1-4249-8809-010ded0dbb3c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087351, "uuid": "9a5a5732-c4da-456e-b545-19277dd56edc", "value": "49152:ShMy7WSTzKuOxln4/6x18H5L1+/GBUttJbX9xZJvOnIDzI3nNdA1Ttuu:EpDuxlnI6xIz+OBUttJzLZnzI341TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087351, "uuid": "d85a7879-fa33-419e-9d5a-f91cbde9dc1e", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087351, "uuid": "393a2895-a16d-486a-ad8f-e85f46a3bebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087351, "uuid": "40acd3c8-1ee9-4e86-b755-5b596ecca841", "value": "driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18c6761-0100-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770123845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123845, "uuid": "af4f7061-8472-43a3-8c84-3df6882d9bb8", "comment": "Malware payload (AgentTesla)", "value": "5b4bb519e558fa8bc1ae5d632ca5509c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123845, "uuid": "a69be8b9-3f26-40ee-a6a8-3f9cea5aa132", "comment": "Malware payload (AgentTesla)", "value": "cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123845, "uuid": "2147edc4-0d83-4876-90e8-cbc144803c6d", "comment": "Malware payload (AgentTesla)", "value": "544f512d1c7f4bead62d9559f0079b94687053a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123845, "uuid": "5342a07b-f13b-4308-9731-02fff1fb584c", "comment": "Malware payload (AgentTesla)", "value": "fc694f7f62125f3ba12764197e894b24a60a9669b7b129471c61c26fa60e0d1b32d1a7ab4bd0de5d5840f350a8fd4f77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123845, "uuid": "b49f6406-3181-4053-8004-1066d6ecdb91", "value": "T14082663BE55CDFF40B2E21E4508B3D016098A7A5B53A89BDD8D6C158BF267408F978EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123845, "uuid": "f259f6a7-ac73-4b73-a648-9275dc9b5ae6", "value": "384:7dRs4Gs8hlJcAPhrObmsKg/1h9xuBoCHiQJPxj+mHK:7c4FiMTa+jCRdVdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123845, "uuid": "bab2c186-3f6a-4ffb-b57a-492feccfea44", "value": 18481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123845, "uuid": "175c7dfe-6fe3-492e-8a5e-2e4ee75c11ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123845, "uuid": "eff6d07c-738e-4489-bb12-ba0690099b6c", "value": "Booking_580_322.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f4015e-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101753, "uuid": "25869d1d-5bfa-4e4d-ae37-4749c197d3a1", "comment": "Malware payload (Coper)", "value": "3e0bd7d98b26df917b4e99acae9df311", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101753, "uuid": "5277cd63-304d-4092-9933-e708540b4c97", "comment": "Malware payload (Coper)", "value": "cc8f90a002a2ed7579451d7b920ae3b44ac65bd12dbeea960dcad5fed6cb3ef3", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101753, "uuid": "8948f017-a01e-4aff-bb99-1769897d15c7", "comment": "Malware payload (Coper)", "value": "fb257874a7752816fee1c559654ded31f4cd5c46", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101753, "uuid": "12d2b353-35f2-4624-8cd2-11458b416b13", "comment": "Malware payload (Coper)", "value": "f7bccdf3cac6c13edaef46a19358e7311d240c12d93fe85f302dad1af7e95962cf2fd31f0afec20c1e2c989fae8d9b06", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101753, "uuid": "c565013d-7cca-4aa7-839d-e4a45a6a43ce", "value": "T1D2451242F398CE22E4BE6B345A56C2D596387E50CF01476B3A45730D2CB23D98F16BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101753, "uuid": "ef4b149a-dfab-43ae-a2d6-9099625828d6", "value": "24576:JSn8QhhEUjXUQrTw9QiBhR94Y5Ds/JBuvJrKNOAiK:JrQhhPr1Xw9QYR9/5Ds/PuvMNOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101753, "uuid": "ad740061-c0d4-43cb-98de-3c28da7f3d65", "value": 1172711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101753, "uuid": "c58a8570-0885-45b5-96f9-0b477020c4d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101753, "uuid": "3f600b8a-adbb-4bf3-bd39-6ae20f157bce", "value": "4c767b8_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d33926b-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128669, "uuid": "3d8195d6-593c-4a9d-ba42-918cd6efa168", "comment": "Malware payload", "value": "308e7d4b7a3e89dbc0f92f96d89b7328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128669, "uuid": "c3cd271f-975e-4fc3-bda8-bdc4c5706c72", "comment": "Malware payload", "value": "ccd248de0d17a3f4d90e0b0c26fa9816b1ff908be4510c266da7c0fef8a4a950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128669, "uuid": "cccbb57e-b64a-49e2-996d-f2720b9ca666", "comment": "Malware payload", "value": "d6141b5d1d26055502d1a51577235e19637f35da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128669, "uuid": "375a3743-573d-4276-8952-966c601bdba2", "comment": "Malware payload", "value": "9034add26d416202b84a2e1e382277143e639a364e60c399d0f41e6013460c712b33b266962d9fe6f3e0920d8cbf6467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128669, "uuid": "b2b7dc62-f474-4feb-ba37-3cf253d9b663", "value": "T1A576236E214D3368D01EC3745433B884B2EA501D5FE8A69EB2EBA7C0779E411DA47F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128669, "uuid": "9b7d9d64-2710-4d5b-90af-c0ae04e8ff7d", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128669, "uuid": "10360d7a-31bd-436f-aa30-4a07bc5faad8", "value": "196608:VC0cmA4z+hO0mvf9pAP+b3Uep+YGL85sBXOs4Y5Z2:VC0c0p39pZfJZmB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128669, "uuid": "6ad28966-e049-4edd-8407-feafeea6a64b", "value": 7784960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128669, "uuid": "cfc443d8-7fe7-45a6-9f43-af3e4bdec83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128669, "uuid": "c96856a5-bc90-42f7-89cb-ac8cf7ded370", "value": "SecuriteInfo.com.Win64.Evo-gen.43519911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e2f0ad-00c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770099067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099067, "uuid": "8898a5db-f6ac-4919-a987-53293e8b7204", "comment": "Malware payload (Mirai)", "value": "1fc061e1c0624309c1af7b0e562f466c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099067, "uuid": "57133db1-6e09-460d-880e-5b43f99636e5", "comment": "Malware payload (Mirai)", "value": "cce4435d0041bafa709a37b44f5bae69c328c703f208a460d5d715191212005a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099067, "uuid": "a799324d-4ffe-46c0-8ed6-18ae34305d01", "comment": "Malware payload (Mirai)", "value": "3684b2464a624ecd51348d257a156dbba7b60a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099067, "uuid": "5a8f4294-5f76-4903-b06f-2df4180dc9de", "comment": "Malware payload (Mirai)", "value": "2e9fcfbbf1421957ae0d1ddba68ace928499041b635cd27482de421670c169b3a6d6872104d3954dc758bfb8bd0819f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099067, "uuid": "45797e64-d776-4e36-9322-2e910daa11f8", "value": "T17963028DE82A2904DE99A0FD954D07BEAA1DE0C362D80F9C7B00DC8793171977A5E27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099067, "uuid": "ad51419c-1908-4731-8f45-22a57aa5a7c7", "value": "1536:kVHfKPBWjkE0XhS74vhUGnRIG998asF9sftIz/RgXMo:k2BA90Q74vhe/asF96k/WXMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770099067, "uuid": "cc727be1-bb45-4c3b-9bbc-9dc48fe7e2ba", "value": 71564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770099067, "uuid": "29e82354-b1bb-4274-adc7-53c77a66deae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099067, "uuid": "8a219b93-7e05-4c8e-8b52-b5cc6048c917", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d006e72-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143487, "uuid": "fd66d881-0577-4897-a442-b538c9609b89", "comment": "Malware payload (Gafgyt)", "value": "4188dc1e3e1e026f9802d6c322d051b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143487, "uuid": "d7bc241f-147a-419b-b740-dcf25f708944", "comment": "Malware payload (Gafgyt)", "value": "cd97b6c4d6eae55fd1060de3bc9506d2f91e802dbd656aaa7d5f5b5e86f6c184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143487, "uuid": "c18cf267-a476-44c6-80d4-9c164ffc5c27", "comment": "Malware payload (Gafgyt)", "value": "9634626da0bef8c580e15e36afe2026092bbea2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143487, "uuid": "a84c1256-c7bc-4e72-9f4a-d123237a64c1", "comment": "Malware payload (Gafgyt)", "value": "65e4675626c9200e95890ee6c95729ed44fd897c10c8a0b1ad98e675e45ca9f94a96cfe16b16b139ea19c6b3473014ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143487, "uuid": "261f9108-166d-4d95-8b1a-d76c4bbc591d", "value": "T1D4B329377B230F23C0CA147111E31732AAB5D79934B95397BDE06EAC6F1AA843516BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143487, "uuid": "484bc27b-98d6-4535-b153-088ec6caf1b4", "value": "1536:hwjKis5qXieFw1joM5O1tMtM5T2yU8CHEmJ3bFDBqhbllovj:CUHjo8PCaHEmtbFDBcbl6vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143487, "uuid": "de97d7e6-bb78-42fa-b372-ab1c9bd226c0", "value": 117982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143487, "uuid": "b7279c9f-b7fc-4d5b-8612-b40ed4caaced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143487, "uuid": "c5d9b3d4-90a0-489f-9cf4-773ea2885625", "value": "pXdN91.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefa4bab-0140-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770151275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151275, "uuid": "73469dbd-2f43-416d-a8e2-a690c5d77319", "comment": "Malware payload", "value": "b461cf9f8b7c791af5ee3dfb082d7d78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151275, "uuid": "8c123a8a-648f-40c4-8486-04a21fdf2128", "comment": "Malware payload", "value": "cdbe882f3a1be5bd64940f9275103095768b8874e1e2ace5e190739535147c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151275, "uuid": "e91bfa8e-fd3b-4e33-becd-060d9d0ce163", "comment": "Malware payload", "value": "304056fd8831d9db4846fffae37361942b74c08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151275, "uuid": "a122e2a6-76e9-4675-b3e0-67eb2d65bc86", "comment": "Malware payload", "value": "e0ce94c7b697fd3221bf0e91887f1c3f3696c89a7e7845f3f8897e58d5e207724e301b3343be0a39f419a4d9c8bd9aef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151275, "uuid": "728e088c-f0e9-4540-b952-7fedfdf03e90", "value": "T109357C5BB2F3B4BDC053C03087DBD6A2A931B47552226E7B61C4CB302F66E641B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151275, "uuid": "a2655839-40aa-46a7-a3df-07a6becdad84", "value": "24576:YqCg74kXUvI1KoxhEaOgJcge0oz8ngR7Fi7DvEOrTk:Yqv74kXU4ugjZoz8nO7A7DvEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151275, "uuid": "e8eafee2-b78b-4e5e-a641-3f98eda9f54e", "value": 1080808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151275, "uuid": "d6e6d335-eaad-40fa-af8d-e39dd30315ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151275, "uuid": "2a90fbda-cfca-4397-9ac6-6dbf8d288311", "value": "recovery", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193f1184-0100-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770123536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123536, "uuid": "b1b0f43f-4fe7-4793-8070-a09d81b34310", "comment": "Malware payload (CoinMiner)", "value": "8dcdba887d459e586b78ffc1a650f53c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123536, "uuid": "2257cc38-6abb-47a9-85c1-75b9028ad165", "comment": "Malware payload (CoinMiner)", "value": "ce13a712e34736044b52f0de591c615014b3f784e2336074f9260ab161c99791", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123536, "uuid": "ead7a53a-429c-427f-9cee-ccf68d894ae0", "comment": "Malware payload (CoinMiner)", "value": "8d3256bb9441a34dfc08fdf7d1164d76ea64b032", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123536, "uuid": "c99b7ba4-7087-496c-8238-b66a88bf207e", "comment": "Malware payload (CoinMiner)", "value": "1f1ae2adde126fbcc0d74d4a41283c829e96b36bca35a4a3a129b736c46167d4ff1a90aeb9e74849d1d064091338f710", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123536, "uuid": "81161581-f122-4b4a-bfba-dbd7e857365c", "value": "T13DE523C3E18867F5D85AE138738BA952CE7375AA431490CF03905D71BA978D89E3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123536, "uuid": "892165bf-1458-41e6-b066-f174201fce5a", "value": "a04338e07c426b2fefa044b2835c73ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123536, "uuid": "492c4d37-1417-442f-b6d5-ee3e3129c07e", "value": "49152:c5OTfU/o/RUd6qJ2FhB+wul7xuPNIfRgOkrUwwbCEkdVPpxXiu9bq+:cBsRUZkoltu6fRC3wbCE6VPRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123536, "uuid": "48a281cd-7369-490b-af3f-4c0de736a4d1", "value": 3200512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123536, "uuid": "027cc416-d2f9-4e46-83f9-f30813c4eaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123536, "uuid": "140305ce-e080-4663-bf8b-f677ad906b7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9046337-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136796, "uuid": "160fc707-fd7e-4bc3-a1ef-6f4e36229186", "comment": "Malware payload (Mirai)", "value": "afe511f4676b1ee0a9f7ec58fdccdae7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136796, "uuid": "537166ec-5370-4977-af84-2fcf6045f43a", "comment": "Malware payload (Mirai)", "value": "cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136796, "uuid": "a9543a87-abfb-4651-812e-bc24733884da", "comment": "Malware payload (Mirai)", "value": "ac4690eda0783a587fac417b5a8809a69d79332b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136796, "uuid": "cb4e2096-b9ec-430d-8488-b2e65f83d6cc", "comment": "Malware payload (Mirai)", "value": "7a4e7e0e8bd12ca4e10ed2730ad31281f36ceec8b151f0789bc9b4c568bfdece0d1c233449107545a8abe3b1331af812", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136796, "uuid": "bd6442b1-d2f4-4c23-aebf-43ada2fe8c42", "value": "T1AB51BEC532214AF4AFB14DA6B6B644057489A0D5BEC70FC9E6FC34FE014CF0A6C916AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136796, "uuid": "b25170b7-bcf5-4c71-aa9b-3cdd2fcba482", "value": "48:vzyu4z3U4z584zHw4zBw4zdudzE4zoC4zR84zKu4zLM4zH+4z7x7Uf4zAu4zjWb:vzyu4z3U4z584zHw4zBw4zM9E4zoC4z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136796, "uuid": "c3741949-1f52-4409-aee1-2ca4fde2714f", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136796, "uuid": "6713f2b8-78f3-48e7-8817-8669b19e41ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136796, "uuid": "79072d9e-4399-445e-8cfe-7c157c99e179", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e85e5b-00c3-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770097633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097633, "uuid": "70697f53-1750-4132-9358-d2fb57949bd8", "comment": "Malware payload (Vidar)", "value": "72a7deedd5e43c237f85cef4f6380eb4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097633, "uuid": "d29a42f2-52a8-444c-8d39-93a20f8e2662", "comment": "Malware payload (Vidar)", "value": "cf4c62e6d5249365060a379619ed33d20768ee60aa8de4b9f4c59c2644ff5c42", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097633, "uuid": "c33009b6-ed9b-4cef-9362-650934a15a5c", "comment": "Malware payload (Vidar)", "value": "4e88c5e49a4faf44a4fc88d972ac265705765962", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097633, "uuid": "a1dd329a-ebe8-4fc1-8db4-fe9762c49a49", "comment": "Malware payload (Vidar)", "value": "5bb042a655a5e4b08b4f506a15af2c987bd07883f3e6ee16a9332a6a196d2c9a59a2f763844754e056d984622f25f181", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097633, "uuid": "6245d003-b456-46ac-8bf9-a0dde230c904", "value": "T13586297F729592A8C26DC53FC0A7CF40E4F372761B33C6E7129107A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097633, "uuid": "2266e883-6271-49e8-9cd2-631517ee1f39", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097633, "uuid": "9a4ff69a-5c83-46dd-bc32-7b81cc336768", "value": "49152:gNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgDQ49dpoMvg2yWL9T:gz7Vp7vQ49djYEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770097633, "uuid": "7f680d84-5dbe-4d2b-ba2b-9c8ff508023f", "value": 8530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770097633, "uuid": "78890045-46b9-47f7-81a2-68e7334a4be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097633, "uuid": "7346c3d6-694b-4029-a07d-e23fa5a24f21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce20e87-0128-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1770140990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140990, "uuid": "d44e8876-9480-4ea8-a233-0bd4aa3e2f5f", "comment": "Malware payload (Socks5Systemz)", "value": "fe2236f55ce7c7b601e21932aab61b01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140990, "uuid": "39701d0d-1a3e-4bae-adb7-8f9317b3455b", "comment": "Malware payload (Socks5Systemz)", "value": "d513c47068676c8b52911c1f649e35c77480809c94d3f9e2768a6701c0f2276d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140990, "uuid": "617ecc8f-aa3d-44e2-a3a7-1f2719cb4ae7", "comment": "Malware payload (Socks5Systemz)", "value": "c5be4e285c70ad8d62e790ff963528ba983cc6f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140990, "uuid": "6fcaeea4-2228-4458-955a-d50e1000a270", "comment": "Malware payload (Socks5Systemz)", "value": "0eb284fe4af6509f96cc2ce4fa37c399c54caf44df2c2efe03bea4848bdb8dc4caf06cc301dc097b588d233c0e86bebb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140990, "uuid": "d387881b-ca34-453a-b418-ed51d41b929a", "value": "T14E063348A5D6EAF9E86611708567D0CA9C307A630D38674DF24D2DBEAF134C48346FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140990, "uuid": "24736be5-3afc-4e5a-8b82-28188d00b447", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140990, "uuid": "f0ab4fb1-055a-49b6-8f85-718f22520250", "value": "49152:C9WVnwZ7rcxkObQfeg+dfqZSPybhfVVYjOaDProYw/fJ4RqKxdr1lswnn9wYU1Jy:MWO7rcyOfEZuehwjRDDwux1AJUgWuw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140990, "uuid": "2940cb05-076c-4b05-897c-fd7bf6bfdb55", "value": 3874556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140990, "uuid": "e1241f6b-87e0-4756-a6db-ff4dae2771ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140990, "uuid": "a5c6967e-2b3c-4fea-baa1-43ef821ba6b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4dafbe-00d9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770106955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106955, "uuid": "f0f2715f-5c8d-4db0-9986-f63d366370a3", "comment": "Malware payload (Mirai)", "value": "29bd9406a2d4f3f3fb56a221bea80140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106955, "uuid": "3c6ae561-922a-418a-9658-9dc9447d5aa9", "comment": "Malware payload (Mirai)", "value": "d58da9ab1b39d92a415aea6b342d9dda7772cc5ad477e7d167d9fded644b2254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106955, "uuid": "eee070c9-0447-458e-8ed6-9f0f91e3f74b", "comment": "Malware payload (Mirai)", "value": "93ffa011a88ae38db3ba9411bdc95737b94d9026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770106955, "uuid": "0e80d6ac-7168-4c55-b8a9-1348e76df120", "comment": "Malware payload (Mirai)", "value": "11a0b2b68f6d634b5c198be7d60faafdea9e3504352857cb6cf23e2332ca9e10d5bc0bb7532faa5ba710fc75560a9ee0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106955, "uuid": "323f247a-6a0c-49d1-8e26-276a92cc5939", "value": "T1CC146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106955, "uuid": "d4c48248-3ffe-429f-9bd7-e58a43b87995", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtR:XgLnLzt0ll7Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770106955, "uuid": "24ea6caa-afe6-426d-a4ef-903fd80c2b2a", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770106955, "uuid": "2348a8fd-7f6c-4dab-877d-504db1c013b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770106955, "uuid": "f9aab50d-4fca-4fa5-8fd4-3d3e5534befd", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b245ad-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143498, "uuid": "c9883511-98ce-4cbb-b333-22f1821f0555", "comment": "Malware payload (Gafgyt)", "value": "a04e1bf8a5164d4462f4cf1860f1acb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143498, "uuid": "b3687051-15a4-4810-9153-ac0ead38d357", "comment": "Malware payload (Gafgyt)", "value": "d625f251d5ed5c75fc05e4f3eeadd47d6582fd7ff7568a7aec624ddae1400a53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143498, "uuid": "46859f1e-d8ca-4a96-a43e-aa82b762edb1", "comment": "Malware payload (Gafgyt)", "value": "f9996cb678ce7bf8a59017e7b0e483be97746314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143498, "uuid": "bb2ac177-695d-444b-8fb5-8afd2679ca88", "comment": "Malware payload (Gafgyt)", "value": "da88a480bdae52c9bba70c68f4e87510ac5ac93a9ad4c3b13056dfeeace6b07faa3d531f6030538812704f5a2f1ed8aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143498, "uuid": "7d68ce08-bdb4-4dc9-8092-af5a386dda76", "value": "T1DBA34D03B71D0B43C49BA9F02DB72BF18B5DB9F112A361C16519EFD41772AB42122FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143498, "uuid": "89f0c58f-0ff1-47ca-8f8d-ad84473361d9", "value": "1536:zQNTfsifB8+AwcLhJkZJJ9qMR/tLXW3ZoZrfjGmJ3bVDNqSVlQyj:zW5fYh6J9nRFuZQrbGmtbVDN/VlQyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143498, "uuid": "81137953-7287-4d16-9999-f3fcc093a311", "value": 104216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143498, "uuid": "1561332f-a38d-4f75-97ad-731baa4070fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143498, "uuid": "97f5016e-929e-40b3-95f1-2169eb766d29", "value": "pXdN91.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c66847-0133-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770145786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145786, "uuid": "dab6b902-e0c6-49ad-b166-987778c170d3", "comment": "Malware payload", "value": "1954b5346fd9b192d1efe9b1c0049a50", "object_relation": "md5", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145786, "uuid": "706aa7d5-eea4-427d-9fb1-9198cc61aeca", "comment": "Malware payload", "value": "d63f35ea58cfc62c280c18845cb77ad804ce13735dd7825961b607fe421ac0e0", "object_relation": "sha256", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145786, "uuid": "77001e6e-b692-47c7-84a1-171adea88f42", "comment": "Malware payload", "value": "c1bd8e7c21d7ea44fd13c956134c8d465a941150", "object_relation": "sha1", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145786, "uuid": "c09565f9-4536-45b0-9c4d-3c048800b3a6", "comment": "Malware payload", "value": "bf622a6e645936d129a975ad4617d4eae54a295ac7eb350286effdecfa75045bfd3e733f51b9586cee5e3b2f07e11b62", "object_relation": "sha3-384", "Tag": [ { "name": "91-84-123-231", "colour": "#5E32D1", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145786, "uuid": "2ebe2969-22f3-4982-bb90-82b3fa35ad60", "value": "T1492174195949B508126E477BF74CAFBCD63255F062891CD4439EA6E804DA3C6DD0CC5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145786, "uuid": "6f5a2f42-6bc7-46b8-aa27-98d4fcef1082", "value": "24:rIqvpCEljHnXHu6eUAz3f16DiHUpDgVR30HzLwjNAMwaqHimHK2CcHK2Z:rbHFHXuMAz3MWHUpDeR3OwjNAMwaIisL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145786, "uuid": "ffa30bc9-63cf-4ea4-8795-e7ef56c8a339", "value": 1391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145786, "uuid": "bcbcf0b0-7a05-4fc1-bc06-e247273d663c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145786, "uuid": "71c2c8ae-9de1-455d-930c-4b557d9e6147", "value": "swq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1ddbd4-0138-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770147837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147837, "uuid": "ac924d9c-4b86-4c7c-b822-8be33b70a3a6", "comment": "Malware payload", "value": "55a4c55d51477498838467835e95fd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147837, "uuid": "cbee7a41-9d7e-4ec6-b685-96a1b9f1d2ff", "comment": "Malware payload", "value": "d7b9313f279a44552dcc0d36ab468a8071c3e3b0f7ce7b4cf9d9417930bea4f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147837, "uuid": "27752bc2-6f6b-4eee-b2be-8534c80e63c2", "comment": "Malware payload", "value": "7168caf6352b35ef2b3f713b9e975d59e992bded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770147837, "uuid": "c9b99f3a-fbb3-42a1-ba22-be0ff6aac7c9", "comment": "Malware payload", "value": "7463d14ca0697028a05753d2cf9ebd276ee9f71fdaf517dbf8046c7816333bea285dcc8a1a05cffe5b038684861238f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147837, "uuid": "d61258e9-23f8-4af1-bfa3-a7199b5f1be1", "value": "T14A4733D99FE00445CC67273E28A06A33A3E5BCB91D74C68F1BE035652F736DAAD35242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147837, "uuid": "75dca90f-0f47-419d-9864-a3fe53261621", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147837, "uuid": "b3bf9037-49c7-4979-95c0-0b89719ff54e", "value": "393216:9qV5nSW0w5XCwzBMvXU7DtpVuLBFVa1DPsZg2KeqZvSa4zK4gnZuHsF5laSjdbY3:9qVB0wgURWu1wLXqd4mZkEUSpbIxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770147837, "uuid": "1ad4d3ba-c192-4717-8414-1152076b7f2f", "value": 25258435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770147837, "uuid": "126c2277-a727-49f8-9611-e2458dc7ae6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770147837, "uuid": "e0d75c2b-9fc5-41f1-8216-5d6dc014a911", "value": "StakeBotPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c445c12e-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1770140143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140143, "uuid": "30dcf1e7-e43e-4d5a-ad76-3b460af1bb7f", "comment": "Malware payload (N-able)", "value": "f1a3195374b6d67ea986cb394f453068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140143, "uuid": "8f3f0180-eb26-44f5-9835-a3bc957ceb3d", "comment": "Malware payload (N-able)", "value": "d811d22c7fd6adc1e0258d0dce9f7b8d3bd8445ae19a439f40b2eaf5123bcb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140143, "uuid": "73ccfb93-7cba-4655-9356-00e8e5bcc26b", "comment": "Malware payload (N-able)", "value": "7be94fbdec30abe35ce1f3bb20ae863532e03eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140143, "uuid": "f68e188d-a0c0-43c9-af45-1e843e5432bd", "comment": "Malware payload (N-able)", "value": "5394544671972c74796138ab134b921fb4c0abdd5e1f887b44f7cbaad0fdfa52319ffe633d84d186734636a2823bdc98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140143, "uuid": "4860fe84-f132-43da-9589-cad09226856a", "value": "T147E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140143, "uuid": "e81c4fe6-77a8-4fee-8dc2-61120e554f4f", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140143, "uuid": "4540e228-931c-4b12-94fa-fa5a0fc949e5", "value": "393216:PzF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1I:9rRxvoC/7a0jUxX7h1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140143, "uuid": "b53e4c51-20b4-491d-b1d9-500cf2fab56f", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140143, "uuid": "f8b5e25d-1e15-4f3e-bba4-5c9a9113f110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140143, "uuid": "9662dee7-8990-442d-b9b4-8ed34f998c64", "value": "Urbanco.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6115146f-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101752, "uuid": "cc319068-37d8-4dc2-b2d4-d255e62ea04a", "comment": "Malware payload (Coper)", "value": "9b87709dfbfeadc6b0ec0c905020e19c", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101752, "uuid": "471bb9b3-5912-4bc3-9bd5-74aaacde6fe3", "comment": "Malware payload (Coper)", "value": "d8a1e20efc746499b3f5adb44b36838f8349da57260bba498b2b7e89633f3fd4", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101752, "uuid": "d835c71d-f823-4b22-9ee4-5e5b7bad8212", "comment": "Malware payload (Coper)", "value": "fc57bb77120880d194c45c28b83dcc92c50d9b4f", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101752, "uuid": "23308097-33fe-4527-931c-cd25096b5ee0", "comment": "Malware payload (Coper)", "value": "551e33716e2197157ec6188aa7b8b93aaf3ea572380af5de732bea5b9127483d34fdb5d4f0a210a505fe9cc81bf9b797", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101752, "uuid": "95b48bfe-5cfc-4836-9325-de638e5595c8", "value": "T1A9451201F789C623E4EFABB49DA7C6D4A6357D409F5062877981770E09733E4CE22B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101752, "uuid": "4fe84a24-7cf1-4f03-9784-614f6351ed4c", "value": "24576:qInq6jg8vHQwBFNaTdj1ls2N/bzOq45rbQmyXQD3/EhfO8:qz6jXvHFF0Zk2N//OJHRDvmf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101752, "uuid": "e53d01d6-e475-4e40-84ab-3aa3142b5a80", "value": 1172711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101752, "uuid": "41ef2619-e202-439d-bc45-b1ac9979cd92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101752, "uuid": "e486d7bc-5cf3-4307-9755-18e928ffea25", "value": "3647331_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3768bbf-00fb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770121727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121727, "uuid": "6df4da38-2748-4411-a002-8d4ed5b9f1e4", "comment": "Malware payload", "value": "9d1ad28ba8644e9a8b7e133960cdb512", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121727, "uuid": "91a3921d-67ec-4f9d-8a04-f72b00ee805d", "comment": "Malware payload", "value": "d944abab1481457eacf9f1d08f835980c2146ec91513e2eb94714c6abaec5f34", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121727, "uuid": "9ea5c151-f427-410a-acdf-8d76b85c013f", "comment": "Malware payload", "value": "65e8cadb4901556ff9da328d158bc02fa37faf27", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121727, "uuid": "07ecb270-a9e5-4c25-a3f9-e25f53806353", "comment": "Malware payload", "value": "8fa04afbd83ee353ed95da60ef71df05f10e12c9576721f228a9de80da487d35a1554bc8e3b08a9584c9219c77dddbe0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121727, "uuid": "f523ac56-9cb2-4947-b9a3-70235e4ddf33", "value": "T17AA4ECB62137CA20F125A44F452F790E0593F2DA8DF768D5C6EADD7481B3DB2AA2470C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121727, "uuid": "b623e982-b296-4f1a-a107-23857459139c", "value": "6144:mh1LGaOXUIkzq1p3UD4Cl44tfdil5ekizT9qr/S:NCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121727, "uuid": "9f12efaf-25dd-40ec-b9b0-f96dcddce634", "value": 459896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121727, "uuid": "97a88675-e01e-492e-8e8a-ad170a65d8c4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121727, "uuid": "67c4ba77-8f4b-4c2c-810c-adc5545c43a7", "value": "Registration_Form.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a601999-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139026, "uuid": "41542269-2b06-4df0-9f15-f9eb14e70009", "comment": "Malware payload (Mirai)", "value": "e3847fc088a5b20e4204345ccca7d49d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139026, "uuid": "53dd47e6-c503-45f2-9b0e-4fa55f04ede0", "comment": "Malware payload (Mirai)", "value": "daa7c53f104fd7f8e266d5f4768f8d90ec6561d8f9eab0065303fada8fd0de59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139026, "uuid": "3c3fe5f5-1489-4714-9943-d6381572f839", "comment": "Malware payload (Mirai)", "value": "430d6043eedb031588386638790f122481b31630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139026, "uuid": "7302e0e1-1ce8-4b49-83c2-5237547406a4", "comment": "Malware payload (Mirai)", "value": "476e67b947a9375541badadc7e9ad572de94ede4e00145385bb85cb171a260f5b33912b385922924f5a8352300b2bc2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139026, "uuid": "c72b8634-0543-4b43-8606-e745988905dd", "value": "T11C93B44DFA64AB29C7E232FEFB49128E33271FA8B3EA7015CD315B5533C8B965525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139026, "uuid": "548c810d-3e06-493b-9235-7442963e597e", "value": "1536:fUnEExt7qxYmE9vnmI8ZwYLVXJtqx1Z8VsYBaMtNtjGvLvH2l4y7fi5kg8G7Qlv:fe7uYmSm9wMtC8VsIaMtNtjGsQkg8omv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139026, "uuid": "410eae8c-2763-459f-8669-23ef20121ed5", "value": 90804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139026, "uuid": "63f1e999-4496-42c6-acd6-7aefdec2efb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139026, "uuid": "ac6342d3-4c1f-422c-9910-435008f193a9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7c24d6-0158-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770161662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770161662, "uuid": "1372e6eb-4deb-432c-b742-f9301cc08032", "comment": "Malware payload", "value": "cca8b01702327d6523494bbac5140e25", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770161662, "uuid": "222f9161-3563-48fb-a136-8aa75a8f1847", "comment": "Malware payload", "value": "dafe76fa2fb61a285d0a949a3c56cefe4789de22591ba88ae70e35b0cd5cab78", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770161662, "uuid": "3b0cfefd-5b8f-42f4-8002-1fdd89a7a8de", "comment": "Malware payload", "value": "3b3382ce93449b3bf05e8e821e127578ba7b86a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770161662, "uuid": "e3f09b66-3d3b-4f15-8d85-bad30448f2f2", "comment": "Malware payload", "value": "1bb28f92ccf49efc7085c35992c8687c620cd73ca9ae0d390e953ab23f9310baf0eff277c209af4c6fe0eef82465a513", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770161662, "uuid": "7ad902cb-f552-4b4e-bae1-9a0b81d1b568", "value": "T1EEA6CFCAD16E44D2DC053FF9A8142AC78B2547328A7400283A6FBD495F775FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770161662, "uuid": "0f75d259-50e1-45ff-bb26-080789c7c21f", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770161662, "uuid": "eba6ca37-3b4c-4d6c-9fd8-03c8fdee3357", "value": "24576:/o8xwxmU63efaNQha1CmC98n6PSPtIXLup9r1E2Z7FeFBAj1IySb1I4pUwQaYNm+:/o8xwh63ePvmpg4ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770161662, "uuid": "7c3c959b-1212-44f4-9cd2-5472cdf30b4f", "value": 10363769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770161662, "uuid": "f0f928e6-618a-41a8-b34d-2fca51ea2fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770161662, "uuid": "5eb8d9f3-40c0-48df-aa2d-5c8fd47b89eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121aa742-00c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770099042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099042, "uuid": "27cddf43-bce6-48db-84a9-36c474afa5da", "comment": "Malware payload (Vidar)", "value": "d6ffc87ac2f8177eebf1a8022c63b9cc", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099042, "uuid": "4f1ce6cc-aeef-427a-bd67-f3eea0c01d60", "comment": "Malware payload (Vidar)", "value": "db02efeebae7ac8bd9db32aec51e25880a36094f9a871d1df7463fb4c3b9b2bd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099042, "uuid": "b206e460-e0f2-4616-a4af-ce645011f108", "comment": "Malware payload (Vidar)", "value": "f10fb981892b320dd32e1347841060cafbdb7141", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099042, "uuid": "1efb36f7-b7aa-4c17-ae92-9c4df3df49cf", "comment": "Malware payload (Vidar)", "value": "1d0ccd2be04f6e66f57529e022c4944713c357bc8648a1863984ebc43f6c9de978fabcbd41e7f6f4ddd4244c5bbc82d3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099042, "uuid": "819f3f10-dc56-478f-b214-dbec786cb096", "value": "T1D086297F72959268C26D853FC4A7CF40F4F372761B33C6E7129007A98A868D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099042, "uuid": "6e00f477-ecde-47a7-a27d-bc29b4404df4", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099042, "uuid": "84eaf9ea-bd0b-4a47-8fde-2660b551d1ac", "value": "49152:FNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczguQ49dp1Mye/0xRz6:Fz7Vp7SQ49dFBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770099042, "uuid": "6475ca2a-1167-4fcd-bad8-2d67b2c5c061", "value": 8513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770099042, "uuid": "3c1c271d-2c4f-4943-b00e-f7075824df13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099042, "uuid": "91bc1808-b920-443c-b801-8dd258361c89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07552fe4-00ae-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770088287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088287, "uuid": "d43bc29f-e1de-4367-952d-90866b94d214", "comment": "Malware payload (XWorm)", "value": "e03d218324aafdd7127131413c7ed26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088287, "uuid": "592cb469-2db8-4986-b00f-7fe63f186d53", "comment": "Malware payload (XWorm)", "value": "dbc31a4c65b7cee1bca3e93df0e2f3573c652a2af20ec93b11d7cd1a737ba2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088287, "uuid": "0e65d13d-290b-405f-8cfd-a536bd85bc22", "comment": "Malware payload (XWorm)", "value": "c3456352a99d6efc6cc5b7825afad901733b7684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088287, "uuid": "414d0eff-da82-42c9-9867-0a9ea6bf08bf", "comment": "Malware payload (XWorm)", "value": "b40d51a9f2d9872fd265309e32c1552d4f8253621eeb46571c8414c0cb97271fe48f4a7c760bc96d746cc5899b0b3b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088287, "uuid": "cb57b33c-8f7d-4d20-bd9b-dffc8e1b52a3", "value": "T1E2348B39F19EE23FE07549B42C150FEC51F941B8F4C65A0AC2556B3A27B01A2BFBD606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088287, "uuid": "8217a13c-14a4-4a72-86c5-8a7791a4d8f7", "value": "a60e2f996367d3f0f40289c655d2d075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088287, "uuid": "0362e909-f7ac-4790-bc9c-d7c49d9733aa", "value": "6144:VONUtzGf7E+MhGNUFMQ2lgYY4xw01L6spG3:5zmMMU3P4x17G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088287, "uuid": "8e83fd49-632f-49ce-a85b-75838fc97bc8", "value": 239784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088287, "uuid": "ff3147f2-ff93-4e10-898a-3061e39572e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088287, "uuid": "0a8d3a43-a358-487e-826e-52eefbaa2aa0", "value": "IMPORTANTDOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bd3d9b-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101793, "uuid": "813f3757-3577-4101-8bc6-7136a9e2ffd9", "comment": "Malware payload (Coper)", "value": "b9a25605378af5b64ca6c76168f4a08e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101793, "uuid": "57a2a650-2799-4e03-a7b8-5a10ec304ff2", "comment": "Malware payload (Coper)", "value": "dbcf1e78a34e742832a2dbe46eec985ede3ff659c7f5801611c3b22b5a5cd379", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101793, "uuid": "3a77a6a2-f240-44e4-960a-11bd93d7f530", "comment": "Malware payload (Coper)", "value": "7a449259b8552b1dd05f49755ca35cf675b7b111", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101793, "uuid": "458d962c-7977-4f4b-ac9c-c7e36149e48a", "comment": "Malware payload (Coper)", "value": "85e9351646993ab61b3cb9d45a23684ee4000f3315f02a76cbb878a9cf1d1ff36ec249126f877fde71cc62a3779dac03", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101793, "uuid": "deb42b3d-29ba-4527-86e8-b346ad31e8df", "value": "T114452256F395CA13F4FFA7344A9683A9D2347E80CF9216672A84332C1D36B95CF21B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101793, "uuid": "00e336f6-d566-47e8-806e-11c58b66e832", "value": "24576:ewRJLETeaZ0dji4ClAvZ5SkkZ6lKlfZHZZn1XxlO3LRizddHb4Klq1P2mqpOzYA3:ewRJLETe11f5aiKlfBKLQdBluiczrvLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101793, "uuid": "ada6b995-84bc-415d-8852-26748cc13003", "value": 1172695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101793, "uuid": "efee35fe-0b51-4591-b7f0-fd3fd14ff87e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101793, "uuid": "8c3788f4-822c-4886-8ab4-d104925a9908", "value": "e5b7d3d_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e110d3-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143260, "uuid": "7d51a1d7-b64a-4877-bf7c-72548a982aa4", "comment": "Malware payload", "value": "b10aee4547facc32e21a3d142b212cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143260, "uuid": "063a5510-4a0d-4785-8dd0-e5c440e7a242", "comment": "Malware payload", "value": "ddbc9f5c76d36a10f8dc630346c812cd3990b80e4a9c7e4c068994c019abec62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143260, "uuid": "d1cb056d-0a27-49e2-b501-989708d9227a", "comment": "Malware payload", "value": "bfe2d112b06791e90368f1143cf59df783c23af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143260, "uuid": "f2afc5a0-cd4a-49a2-820a-e396ee8be71b", "comment": "Malware payload", "value": "176d408adccbaab63ceedff67bae582d5ab96e4ec1b4fdaf5d2a6e57443baaa78a2ce5bf1eb9e96aed1e8232d527316f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143260, "uuid": "d8c881f9-d7b1-42e8-9f3f-bc659e736602", "value": "T193B3F142E65065BFD10FC1B8076BAB3B7736714473517A66BB00AC30AD27E612B4D7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143260, "uuid": "4539dc53-2d94-4d90-b9f9-a1f929f26bd5", "value": "1536:NovYbQVtiDorvtZM/5DNO9xpFgEAI74H21PCQZ4UiklowUZS64tEarOD1d6F8:Nov4QV8UjM/5DNggEA/HoR4UiHHZfBS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143260, "uuid": "de0d9e80-8159-4cb0-9015-af460c5ba18e", "value": 115521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143260, "uuid": "bd2ab068-791a-411e-bd12-90214db2b7ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143260, "uuid": "240d8eaa-2120-4517-bced-399f55e7955f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e2477b-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101765, "uuid": "a95276a1-7537-4d9c-8c67-1434290732bb", "comment": "Malware payload (Coper)", "value": "6ed118a6fe687d67a8b1f4aed94e6750", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101765, "uuid": "89fb150e-28f0-48a2-b008-4a57114dfcce", "comment": "Malware payload (Coper)", "value": "ddfb37acf2abc5458c9a7003e4f0559b615bf5ba0334a3801b1e3bb694733c79", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101765, "uuid": "d593574f-b341-460f-b16e-90af248fddbb", "comment": "Malware payload (Coper)", "value": "7997c83a6f04df9d8c68e0ee488a30921b80a3f3", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101765, "uuid": "e6f16cca-1708-42a7-9341-b94b3da13813", "comment": "Malware payload (Coper)", "value": "d729916db4f0f564d29cf44cf506dcf7059c98ab3acb67841ac198dfef953f11b95c110f77b06c4723b52b7e559432e0", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101765, "uuid": "ff76d24a-65ff-4291-88b0-abe04e42ed65", "value": "T18F451241B7D8CA03F8AA5B788DA6C2E596317E80CF4012676E85774C3DB13D5DF22A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101765, "uuid": "72deede7-2f8a-4574-ad31-d1f96b17c60d", "value": "24576:OqZCk1eSZMDr2sDlRfpLw3X1y8adtjerpQnpELMs/I3nbOZJXp:O6e4MDr9lRa3XM8aDjerC+ursJXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101765, "uuid": "0f505b5e-8f57-405b-86fa-20c92f011b8a", "value": 1172707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101765, "uuid": "03713b2e-8788-4c2c-865d-4806e8cb6e6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101765, "uuid": "d4d936e4-f79b-4470-9865-9f3601bfc7b1", "value": "72e2e23_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01e32af-014c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770156430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770156430, "uuid": "eda4c1d8-b956-43c3-85a7-a053b87bf533", "comment": "Malware payload", "value": "4e737b1ef1251e83f56c378a9b80708e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770156430, "uuid": "1da2874f-c686-42bb-a045-62087dead9c4", "comment": "Malware payload", "value": "de351e994518cd6183a46bffc9e95bb7c8674d3a95679562bd600f5bcfab7e17", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770156430, "uuid": "7f1b276e-a26e-4ea1-8ef0-bf2c64ca87d1", "comment": "Malware payload", "value": "b5e9dfd698184d31f7d74febd6aa82dbfea91ac0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770156430, "uuid": "df464308-5906-4921-8bd7-5500ccef3574", "comment": "Malware payload", "value": "ce89d66da648626a2cd7653bdaa4456fe6460e9af1e6e222c9368a524ed570ac17b48b6f3d9e74f241af6c892301174c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770156430, "uuid": "6fa73f1b-6bf5-4038-82df-947b12fd37ef", "value": "T15104138BF2F01C96C93C853EE0DD0ADA792FA45DC81E58743A9A15D7ED20762D4EC389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770156430, "uuid": "17c0fea3-a425-42c1-8c1e-38a6db4b0f07", "value": "63ee9fa547a86ba45dc5042f3465b31f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770156430, "uuid": "741dc101-99ba-4b83-83d2-c8c2149cc2f5", "value": "3072:0zz3TAOnjtvASnpra9OCQF6PF2dK3skY6zreXqQPektg5jnpz6PzG7iDF4Un7GNf:0zlnxvVpr0OCq348Z6aPVqJYPsQd7aj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770156430, "uuid": "bf49aa37-535b-4ea6-9363-9ffbe63b7bbc", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770156430, "uuid": "8634cb1e-16a5-4209-9dd4-ebb4bf0834b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770156430, "uuid": "5326e452-78c8-4ab9-9479-17968bbac653", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919fa170-0102-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770124596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124596, "uuid": "e9620ce5-257e-40ba-aa94-a1f64711a466", "comment": "Malware payload (Mirai)", "value": "3925e67b4772d8a92548865b4d744fb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124596, "uuid": "c8da7d1a-5bd2-4164-94a0-fa5893342353", "comment": "Malware payload (Mirai)", "value": "deec88a868a286b246006ac6b06fb480f445501dc9ab1546e82ef49106b33e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124596, "uuid": "547d5358-7d33-4563-86bd-9663049f4b6a", "comment": "Malware payload (Mirai)", "value": "60051964dfb16655ee100abc4d4ce7e2317d0696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124596, "uuid": "5159611b-3b7c-4c36-86ca-bd62adf0b5c9", "comment": "Malware payload (Mirai)", "value": "a869bce09253cba2a378ab84f90ea38ee747c285be3791009cc4d1f2df3a79bb627f21c5d55bc3656fe3d6195e8a50e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124596, "uuid": "ea3ab8b1-d1cc-44ba-843a-ea36dd651b03", "value": "T17763080BBD4480FDC599D538437BB57AC16731BE123CB2DB2BD8BE165A42EA11E3D848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124596, "uuid": "b883a433-a0dc-487f-aa3e-bc48f6082940", "value": "1536:b0VwDCwOJs2eItIglO8K8i2ySIHzbDS9jVY/4:QVKQs2DtIglO8KSIHzbsjVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770124596, "uuid": "f1ce728b-12da-4980-9253-2105cb486679", "value": 67776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770124596, "uuid": "dd94b976-e5d1-4cd0-b64d-847c9c46e0dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124596, "uuid": "8db7ca91-335e-438c-a0bd-cfe3a6ae1dd9", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a4fca6-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128677, "uuid": "7709cb84-471e-4629-b9fd-9b9ef9baf4c8", "comment": "Malware payload", "value": "2d03dcab96a9baa3bc6f1e05cb1accea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128677, "uuid": "762bf3af-8f01-455f-acaa-857ee508dfda", "comment": "Malware payload", "value": "df8f0f61a1af0f3768ea07700d60446969c4c6a95a1ecb131844bd6665c8c45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128677, "uuid": "21ca5fec-d54b-4573-aabf-7b6a027be2c3", "comment": "Malware payload", "value": "49ad10dfe25738073d7a13a4c11123dc781076cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128677, "uuid": "1491ea71-5e69-4675-b9d0-934e13eed079", "comment": "Malware payload", "value": "2450017f9fafd000c3836196599e1d61c58368446e1f38bff525be18b0833c42a53c4c82d1c49ae3b0a50ea3c64bc05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128677, "uuid": "b97e2b0f-6d50-4a2f-a562-aa7f271da79a", "value": "T16376236A610C3398C05A87785433B985E2B6511E05F9D5EFB3EB7B9037EF410DA4AF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128677, "uuid": "c00b3572-a2c1-4dab-a41f-8315e399cfd3", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128677, "uuid": "d8364557-6d33-4340-91a1-88e9210abe9e", "value": "98304:6YMpo6Zz0Wi+bahtkvNlXL/ywDc+XZIVG1zX+SESnoRyIcFM4Qg3GTAGYDrHI6vx:6YpQoW7cKx/Dc+X0G13VFnQgWTAphNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128677, "uuid": "7ac977d7-ffd2-41be-8947-fee79357ec13", "value": 7751168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128677, "uuid": "3638571d-4adb-4e1d-b482-da5ce6a1f203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128677, "uuid": "eac27461-ac3c-4813-91df-073f75a2cfa1", "value": "SecuriteInfo.com.Win64.Evo-gen.82992279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e3ddb7-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770137029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137029, "uuid": "ae929cfa-8ef6-4fca-a5bb-1984e0ec3b4a", "comment": "Malware payload (Mirai)", "value": "3cde0b0808024a8a81e5c76191034537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137029, "uuid": "ddbb591b-3f8c-4945-8848-899d9e6bde55", "comment": "Malware payload (Mirai)", "value": "e04f005ffec7e118ea111a08b604f03feda554b4ca2d304eb7e29e4200bb7451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137029, "uuid": "c008d829-43b6-454e-bef3-d7b198376ac7", "comment": "Malware payload (Mirai)", "value": "58d5a600c0c517dc78c6d1b77d4aa45815d26313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137029, "uuid": "9a0336ca-ae70-4f5e-8a77-ea4a492d5c6a", "comment": "Malware payload (Mirai)", "value": "56bc52302edeff5c7e381d2c2a75b7028651380f18f6af17050bc6e694993e38d5094cc9da140f16c2ab1702c7260405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137029, "uuid": "19ecb4eb-aae6-4f56-a475-8756efb12d6e", "value": "T16883D60ABB604EFBECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137029, "uuid": "813fc8d9-2bad-470b-ba07-f6edf46c736b", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137029, "uuid": "0e23e9a4-8c42-4b47-9e61-f16d19351c14", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137029, "uuid": "c5e1c9dd-9d69-4c12-9650-621ac62addb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137029, "uuid": "cdfb64ff-4825-4bc8-8d31-0871aa9d5056", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c0aba2-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1770151278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151278, "uuid": "63462bb9-dbae-4bc0-8300-600d8218190f", "comment": "Malware payload (N-able)", "value": "6527567c8b0fb7d3d93b71449a902247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151278, "uuid": "56f844fa-8fc1-4561-843e-06c3b83d8003", "comment": "Malware payload (N-able)", "value": "e077ae7e52e44bfe55a9d832e623af103ea948d6ae01d21217f1edae2a274650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151278, "uuid": "3ce8d918-6c9b-4cfb-b213-5a7ee6a796c2", "comment": "Malware payload (N-able)", "value": "d3d33ce7aff17706a75878535571d062ade372d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151278, "uuid": "22934e38-c6b9-4554-a47b-51dbe62a73a1", "comment": "Malware payload (N-able)", "value": "dda458684441fd00ed09930743d01772371a935d856cb31fef856052c2c41c2a5d24fc9cb45ff76948a9f9e5a59e720c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151278, "uuid": "5527c1e3-a1d1-445e-b7b3-9bd8049a5ccc", "value": "T152E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151278, "uuid": "5c3692d3-24f6-49cb-a5c2-7076a971c633", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151278, "uuid": "ba2d0ea3-b888-4e7b-b47f-4402af57d216", "value": "393216:JqF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1l:MrRxvoC/7a0jUxX7h1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151278, "uuid": "c514fd9d-4c36-43a9-83cf-26cc3634845c", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151278, "uuid": "693cafbe-88be-47b7-92c7-897bf3e10137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151278, "uuid": "7fcdf9d0-4c89-49c7-aeec-bc1e3ae1436c", "value": "XML030220262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16a88ec-0120-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770137562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137562, "uuid": "2d3a50d6-03ab-4e4a-be4f-f684e8c46d11", "comment": "Malware payload (Mirai)", "value": "0e48b98fe3085344c63667962ae32c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137562, "uuid": "520fe368-874c-4bce-9b6e-a987c3f2bf25", "comment": "Malware payload (Mirai)", "value": "e0f1f24ab8bbb2d4518ae08b4441cb03760b684bb71825f07a3f513fd880d3e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137562, "uuid": "01e3bd47-5b6e-4258-8e87-36904b61e7cd", "comment": "Malware payload (Mirai)", "value": "73c6d10a832e9e4b4d51b51f4b520c4b42c8b6db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137562, "uuid": "5b05d2e6-a7ff-4548-90d8-143e5b5cc1d5", "comment": "Malware payload (Mirai)", "value": "04808adab4665e82ace6d3078b9d02dfe288ff96149e31797affecd935b9c8fb5e1900e4f69593d191ca803a5f859e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137562, "uuid": "03ddcb6d-188c-4f13-820e-91965538a4d4", "value": "T150165B65BD5EE963E6C877307B7582C4323EBC489F819223A604BBAE5DF275C8F12111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137562, "uuid": "4d587932-4bed-4adc-85a2-c9f976c7a1fa", "value": "49152:rW1cQB937QDY6Q/kHgJUddtG5E6N6PIoOFOglKRz9B1:QcQB937QDY6Q/kHgU8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137562, "uuid": "d9477639-100f-44c6-8426-12c656f5f4fb", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137562, "uuid": "d2f6c674-e0b5-44c7-b898-11f7296c62da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137562, "uuid": "b5607da7-6a0e-4b92-9571-483dfaf871b6", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74efdbb0-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101785, "uuid": "162823e4-3c72-4de4-8d1f-67272fdfac86", "comment": "Malware payload (Coper)", "value": "9c503fa95245a13938c26c51846a027b", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101785, "uuid": "cbe2f16b-5ebb-40fe-8fa7-568574bf5db2", "comment": "Malware payload (Coper)", "value": "e104e343d5d6db290a76ac90d19917ff88d000bd891be7b9cdab1eb66525f8ea", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101785, "uuid": "2b8b674e-a063-4267-bca3-0e643a6f8f2f", "comment": "Malware payload (Coper)", "value": "78ae183f261364fcb146db5c09d0fbfc63968c37", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101785, "uuid": "b52ba046-b498-4c22-94fe-90357ba25bfc", "comment": "Malware payload (Coper)", "value": "d8e4a0613e68bf53b4b4df6304dc1db166c2657ea354345f0a82a246df7a47b3a70936e854e0b2082b253fbb0808bda6", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101785, "uuid": "8de4d2f9-acf6-40a7-973c-a7ae275c7943", "value": "T11D451202B79CC623F4EE2B794DAA82E062713E44CF016697A956731C1D726C5CF26F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101785, "uuid": "5100bafa-ed1c-48b5-8b50-f760dfc868b0", "value": "24576:cnno9eZhhTGDjTV794fCou/E8HF6J2WdtZMOYoHRCbGlQ:co98hEq/aAfdtaONCKlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101785, "uuid": "304496a3-2c5b-4528-a85f-e5900e22b4cf", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101785, "uuid": "17a08a40-d729-4792-8dd6-9211c5e5b1ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101785, "uuid": "b2b5be80-0a44-45d4-bf45-ca0cd883bd22", "value": "cbd82a6_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ba3346-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101754, "uuid": "4b7cc3a8-deea-4a89-a3b6-64fcdcdfe62a", "comment": "Malware payload (Coper)", "value": "8d54c6e89a4eac9b73a01c7b96a66278", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101754, "uuid": "de5b12bc-d67a-437a-b15c-e3eb1f28bf9d", "comment": "Malware payload (Coper)", "value": "e1201982a431915cb6422f29e25d9eb78d50d6a9eeea8202b1070423e9fc8b89", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101754, "uuid": "06aa2d71-1a7f-4f8b-b4a7-43b62bfc9a68", "comment": "Malware payload (Coper)", "value": "25ad1da700675b49c249450fc416e7411935e41e", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101754, "uuid": "3f233acf-1ee5-420f-88bd-c016eb49e0d8", "comment": "Malware payload (Coper)", "value": "6d0feedebfefea82a10fab99813ee74303d30e35c3bc5908bda0264e299aba6b244700810780ca04edeb3fac3254e1ed", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101754, "uuid": "dcd1b041-412b-427c-9418-6e68aadd813c", "value": "T1A2451202F38CDA16D4AE6BB84CB686D493307D84DF12C76B7A41334D0D726D58F61BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101754, "uuid": "b55d9304-d093-40e5-9f06-e022068e1cf2", "value": "24576:J3njaICWhGiTE5Fj5i7J6g4mghtMyVVyN0Q1QRAAj5:JTrCUGiw5Xi8g4vk0QoAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101754, "uuid": "a0d0d1ed-14c4-4d11-9616-5a076f8c4b76", "value": 1172691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101754, "uuid": "63d800cf-4774-4b23-a2cf-6fce51c29785", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101754, "uuid": "5ece7144-81b3-4e5b-84a9-7b2e515cbfe4", "value": "4c8a04e_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62c2c61-0118-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770134160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134160, "uuid": "897ab2af-557d-42cf-9604-81010c9ac102", "comment": "Malware payload (Mirai)", "value": "6ba9504b59c42040801dcc0fc2a041bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134160, "uuid": "e9a2fd01-f537-4fcc-9f1a-29397842c719", "comment": "Malware payload (Mirai)", "value": "e238ce237fde11ef1ac858b2dddbe8658a2109bc3f44cac4b10b4e803a92368f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134160, "uuid": "710183d4-29fc-4813-a599-b90b79f1296f", "comment": "Malware payload (Mirai)", "value": "08a8255c15ec341137bf80736d3fe289cf7117a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134160, "uuid": "e1a8f595-e764-4d77-8beb-b7a918459b76", "comment": "Malware payload (Mirai)", "value": "1fe7d7c10af3e2a7e697c4c441059ab11eff6137ea3dbbd5f8a7950f0ebeccf347d1d1919c83e8262e7c7c3b87e25621", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134160, "uuid": "be8d7e76-87c3-4f0f-af43-79ed1332bc8b", "value": "T103B3F146E251A1BEC19BC178478FD72B7A35745417946F0FB269F8322F72F102AFAA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134160, "uuid": "526be902-6fc3-4e85-862c-934e79ad59c5", "value": "1536:NovYbQVtiDorDvF5GJkExoCpSJuWQ726Xs0zW8FagOzjz9fSsC+/8xg:Nov4QV8UDv/svogWcDcZ8yzjJSs86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134160, "uuid": "f9c3ad69-637f-4c3e-820e-8668d2fb69b8", "value": 115521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134160, "uuid": "5d6edf40-08a3-4b8c-a561-71dfed42cd7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134160, "uuid": "3b7ccf76-1da7-4802-9e76-516561da18b7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288e7e5c-012f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770143748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143748, "uuid": "48aa6ae4-7178-4216-852a-c835d91ff434", "comment": "Malware payload (Mirai)", "value": "5aa264571c837179e6bcba297299a1a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143748, "uuid": "af516a49-d01e-4d0d-82f1-b998bd292352", "comment": "Malware payload (Mirai)", "value": "e2b29014d4de16f628b0785438dd2de9a4003af819e7f9a266bd751415764b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143748, "uuid": "c92e4fa3-f700-432a-89e4-965d86847cf4", "comment": "Malware payload (Mirai)", "value": "0a727a8dcfb6fdc3fa3440975e1ae079ec91d187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143748, "uuid": "2c6d8901-a1d4-419f-87f6-a47c36db9048", "comment": "Malware payload (Mirai)", "value": "a9f1f75974199e56e319263a844d10bfc590576416caae1e4a788cd47591fdd2ce36a924f3f8bf5c0f13011581e4504e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143748, "uuid": "b48909fe-313b-4a20-9230-881cd2955508", "value": "T17D634A12E83D1E17C0E4A47E12B78B69B2F5674F18A4879D3E350F8EFF615D0A6062B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143748, "uuid": "bbdd22da-4d9c-4588-a92c-976fc3940933", "value": "1536:AB0Y7wl7LHPj/Nfi+FpFoi38UCaIYq0izNs:fuikypFxsUMYq06Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143748, "uuid": "80ffc1b9-806e-48d7-83f3-c701f96bd8be", "value": 67536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143748, "uuid": "8bda8e62-2f36-4b4c-8a60-0cdb40a9f6d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143748, "uuid": "90144929-52a3-4dcc-a6c0-7df23c9914c8", "value": "mao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37204ef5-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139048, "uuid": "0d601578-b5bc-4d53-ae30-674e9604075d", "comment": "Malware payload (Mirai)", "value": "0236f216414a193c39919ddf7b6ac834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139048, "uuid": "7b1c90e0-981e-4b0b-a37c-f29b9f86eb79", "comment": "Malware payload (Mirai)", "value": "e3ff2c09b17840bae3a334cd7fa9929917de4b51e284ac7aea02c1c24a4d4218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139048, "uuid": "d227791f-6a0b-4312-bb5f-9143a542e8b1", "comment": "Malware payload (Mirai)", "value": "5f0224a1ac003bfba7bb082f8b9c9a937b28dbab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139048, "uuid": "8a295f34-0e62-43f1-a0cd-0be3a19e6220", "comment": "Malware payload (Mirai)", "value": "b23178239a91b88272d32b70041ba6bd1986b3ebb3a0659656c82996fb1373bce7d1d096acbec85aeded8224f5f60dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139048, "uuid": "344da6b8-c42b-4527-a5a9-88327946b349", "value": "T1670317D6F400AD7DFC4EE37B80170A19F532B29849921B376263BDA76CB21E44966F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139048, "uuid": "89341a7c-83f9-4409-a67c-3a2b8881ad87", "value": "768:gLVoBEOekf/vmWFkteoTTOIUV/2vIuI8++OHCVuVXGE2nAw5en+Rfw:gL6Emf/ruHTTwVevBI8++OauVXGhnASQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139048, "uuid": "ba828778-b971-4455-ab59-98e834178987", "value": 40460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139048, "uuid": "2d987f24-65c3-441d-8c77-ffa9ad141f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139048, "uuid": "0996db50-91a2-4085-b47c-a5446bc544e5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6cdf5b-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120727, "uuid": "47e0a4e4-00ab-496d-9cb0-7d9c3f299c30", "comment": "Malware payload (Mirai)", "value": "9a116ed67a57492b57928dfebf8ca976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120727, "uuid": "c6748923-d33b-40b3-b959-cf817c5994c9", "comment": "Malware payload (Mirai)", "value": "e40c0cd39b6c1dc46d498c8825377fbd027676188b6f69f6d0536191fc194ae2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120727, "uuid": "dea70f5a-496d-4bd6-8345-143ec92d4bd0", "comment": "Malware payload (Mirai)", "value": "6f9034096e02c3122a9e166fc4d0d10e726d500b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120727, "uuid": "0941d255-6b3c-4d6c-9c70-6ee6ecc6cc98", "comment": "Malware payload (Mirai)", "value": "7d542678d63153977b55999cffa5a76af2c4539286017cf40fbfc2c69fd3456490a1b286d768bda2a86f1c7bfe35f9e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120727, "uuid": "d52a924d-83ca-4727-abb0-47b448fba89e", "value": "T1C293520D7E358F7CFFE9863457B75A299248339A32D1C684D2ACE6021D3024E752FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120727, "uuid": "922ada1a-d308-41d4-8051-f42252333298", "value": "1536:nfYB3EFckJz9aMpWs53VLjJ9drT7SC+N+++aOvmGpXwtsFoe:fi3EFcw9aM7bjJC+++aOvmGpXesFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120727, "uuid": "1bff4924-8130-4de3-beac-4af0c66f79a1", "value": 93212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120727, "uuid": "a8b396bb-09f5-4582-856b-5b74c4ec7124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120727, "uuid": "dff50cad-b5b8-4b6f-9979-d94b1b4d33ce", "value": "mao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf67098-013b-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770149228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149228, "uuid": "12c9711e-5bb6-432e-a7a8-6a8324015644", "comment": "Malware payload (AsyncRAT)", "value": "647a28cfd482fb005301fac1d9f79318", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149228, "uuid": "38d2196d-6ff5-48ec-8794-27e6db438137", "comment": "Malware payload (AsyncRAT)", "value": "e41aeb358c78936589b8362d6e4da950db682588a536dc048fa063b5d051d4e2", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149228, "uuid": "accdb4f6-29fc-4c84-8ad2-ee24f9034bdb", "comment": "Malware payload (AsyncRAT)", "value": "9c1a9951a51a61ce5eae1bcc7385c466840b3074", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770149228, "uuid": "93794bbd-e6e0-46b5-a344-b539ec9adfb2", "comment": "Malware payload (AsyncRAT)", "value": "c1683135fd36c654270cde7295e825c0dc1190ce435dcde692049aa0a2f8ad93a6521874181601416f621178c766441d", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149228, "uuid": "bf3f3082-887c-4266-b95c-a76547337ddb", "value": "T19B055F2260092857D9CBA53BC8F7992F27109E15FC502683EC6F3D86F376B07DAC9646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149228, "uuid": "ec0cef0a-2c8f-41af-8beb-6efed882fde0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149228, "uuid": "dd69e020-0c19-427c-b626-2a57e9440b7a", "value": "3072:olSMfkS9GbbJJR9Gk411ejd6sMm+fKopu+CHjbhxHNgFTqSGqfo+MQCpq8rvdvea:MvkS9kbJniuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770149228, "uuid": "4c11e58b-ca26-497f-b1ff-e630cf47fad2", "value": 835073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770149228, "uuid": "314ccb52-fa37-440b-b85c-df08213dbaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770149228, "uuid": "5f4db54a-3ca6-4c5c-9695-4d4422949a65", "value": "e41aeb358c78936589b8362d6e4da950db682588a536dc048fa063b5d051d4e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f874127-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128673, "uuid": "6a8e2bc0-6c79-4eba-b6b5-2288b5712717", "comment": "Malware payload", "value": "80cad92694b83743195c751317a23f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128673, "uuid": "ccc1dfd2-f3b8-44f9-b7bc-a5a9567aa41b", "comment": "Malware payload", "value": "e41d3aed5f1a523583b29a66a8d8293db8a9d8a1d60ee66772908439b55bea61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128673, "uuid": "fa8965fb-c67a-4c53-9ee5-ac00dfd8f727", "comment": "Malware payload", "value": "a377da2b955385fd87856fcd6075cfc20620e722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128673, "uuid": "f0fdaa40-ad5e-410a-b934-c6405a3f2561", "comment": "Malware payload", "value": "ee730c77c2f3d0eb9fc8d889bd465839745d1653a20f095fe93d8d55729f846ceb98540eb9d24aa0fcef4ee6911e7799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128673, "uuid": "b22cc086-eb55-44d6-877c-22aa7dd70870", "value": "T11A7623FE614C37ACD01ECB74D433BC45B0B6116E19EA54AB76CABBD4379E0208946F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128673, "uuid": "a57175cc-93d7-4c5e-b05f-8cd489d75da5", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128673, "uuid": "c1df1c19-445a-4f03-ac5c-4562ebf66a88", "value": "98304:+Wvai/TlW4kynO29lL5J7uBPIHkyj9R834d9UaI2wsITpUaE7L8YyJlvb35y:+XiJWqO29B59KPWkiX3I1C7QYyJlz3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128673, "uuid": "5dcc13c1-5f5a-42a4-9d67-86048aa00407", "value": 7777280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128673, "uuid": "ed4cd700-0d1d-4d78-9902-d4711386c0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128673, "uuid": "3c144c4d-7a66-4b1d-806b-96c4df3f9b81", "value": "SecuriteInfo.com.Win64.Evo-gen.57957669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96c948f-00cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770102866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102866, "uuid": "d7eecbbd-deb2-463e-ae36-548c2ff4573f", "comment": "Malware payload (Mirai)", "value": "a543d7f8dcbc1c17983bc22f9c2718a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102866, "uuid": "674d97a1-f90f-4fbc-86ea-4b929cb46335", "comment": "Malware payload (Mirai)", "value": "e5d4ef758f9133a7d386fc68cd9d6a7ea2886e35665613ddae543b6aa98f13ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102866, "uuid": "1637b246-3dc6-41b6-bca5-74ace68999b4", "comment": "Malware payload (Mirai)", "value": "3d66b72d01f0aac84efbcf5a131c6e46b400bd3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102866, "uuid": "5f2cf6f0-8457-474b-86ba-06ae4aefab13", "comment": "Malware payload (Mirai)", "value": "9c74f63dee35cb79e0855c5bd048ee83cec4ae724bb02a14da1b18947b9d204c6c2faa33562d568c490a17fccd127bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102866, "uuid": "b33a70d7-ebaf-4e4b-894a-a01507d2d4a9", "value": "T15A042A46FD918E22C6D523BBFB5E41CD371A23A8D2EE3103DD156F24378A99A0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102866, "uuid": "4cc383cf-6c1c-489f-9545-3385cd08e09e", "value": "3072:6ovTn5zKDIw/+1oYfpYG9hBrc4Y6Y/6/Hs9Sm89f4wbZnk:6ovTnviIhc4Y6VHs9y9QwRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770102866, "uuid": "5cd0b88e-fd1d-4b98-9f1c-0ac53fb6de1a", "value": 178240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770102866, "uuid": "1c3c6fc8-7d55-4cac-ae75-287ff235ce57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102866, "uuid": "e83196ab-197c-4108-9f4b-bad18d13db45", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380ffc8b-0134-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145921, "uuid": "e8b19a0b-8c57-401e-b94a-c54945b2c0da", "comment": "Malware payload (Mirai)", "value": "a43e2d42f8096f48b45aee49ba2e9b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145921, "uuid": "c8054563-a53f-4708-9483-93c62fc0e4b7", "comment": "Malware payload (Mirai)", "value": "e66306f6a71cb948e0b5f4e55e5159a2380e8d61d3923380ce25264db244aeee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145921, "uuid": "fa84e244-afa5-41c8-8d89-5ea858ac16d4", "comment": "Malware payload (Mirai)", "value": "49310085b271f93eb8f324b7bd48cc053b6cef3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145921, "uuid": "bec533cf-8082-417a-9685-b40fcc4313d2", "comment": "Malware payload (Mirai)", "value": "2f0aa8e292dcc698698dd2b495c3162162a9abb8c59feb551779a867b9097b27364b049464a03d12393f87eb4ecdec8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145921, "uuid": "9e5c5721-493b-4be8-8bd3-7effbafc3026", "value": "T143433A4137984E03C0666AF8293F23D8C3FEEE8115F8F284261F9A0B8675E775559F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145921, "uuid": "6733e0c4-d304-44a2-af96-26172376084a", "value": "768:/8qomMXR3O+1malRlm+RMWf5tcRpCSvVERrGoaTDbbzpUnAVt85iYrGl1GFvm79f:0rbS+TAFEZsPvanJiYrisFGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145921, "uuid": "7f357895-0655-4a9b-a54b-d803ed19df1a", "value": 60408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145921, "uuid": "fea5b61e-2443-45ff-ba7b-11a7e8f1584c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145921, "uuid": "e1546d9e-681a-4608-bb9b-24caaea0f223", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9280c6cd-0136-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770146932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146932, "uuid": "28826378-d8a8-42ea-bd25-4311b71b9a40", "comment": "Malware payload", "value": "aa72d3e585eeff688334bf5595295323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146932, "uuid": "fa95b162-2e38-47e3-bba9-54be6733fcae", "comment": "Malware payload", "value": "e6ba1ec4a6c42788ebdb8869b7e8cac6d8adffde5a17a3223810266a551241b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146932, "uuid": "a16a3ec4-eb87-4bf4-83b6-00c97afc0719", "comment": "Malware payload", "value": "01947073cc3e772187b130a8ce17e7a162a1db42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770146932, "uuid": "f5d29704-fd3b-41a1-a8e1-70506e15e94b", "comment": "Malware payload", "value": "b38f16c91922122ceb8b5ef200a529687c244cf1a85f8de219c4ec69e88b6928f077c42377bf32a90b84ca80a4a0cafe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146932, "uuid": "241272de-d67b-4e86-afc5-9471862362d7", "value": "T14D4302F690D87DCDC19A5334460B06433EC66774A09A762AB6C4F6A88BF2340CFD9BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146932, "uuid": "d06b213c-15bd-4b28-8700-f71bf5fc097b", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASA3enoLLkg4azHL:CM5az1Fy0oPgdZX6hTo8RQYsLGazHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770146932, "uuid": "42dde11b-0e13-496c-9c11-8038b6e6e6e9", "value": 60399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770146932, "uuid": "39649664-5ab6-4bc9-8a5a-8668e869c7d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770146932, "uuid": "481b4070-52bd-476d-a2df-b714462d79da", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3c8b09-0100-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770123678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123678, "uuid": "ece5ce14-7ae7-4e38-9a9b-58dd701b7bfa", "comment": "Malware payload (Mirai)", "value": "de899f73beb443e4670ad8f8983407ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123678, "uuid": "3ff33e6d-094c-439d-9a51-67a9399665c5", "comment": "Malware payload (Mirai)", "value": "e756a7caf506a44545930ba42f95500c01128d2d980069cffed3b6811da9e552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123678, "uuid": "a5d8fdd5-6b47-46a4-a107-a843f6536e88", "comment": "Malware payload (Mirai)", "value": "14355d0cde0be7602daad3a4e9c4494c0b88bafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123678, "uuid": "178f0985-0849-41ca-b78f-6a2aaabd8dc3", "comment": "Malware payload (Mirai)", "value": "09619d8bb2ee480253fa43ef26855450b190739415f4402215cc0118c9d8ade7451d76db2abf5fa4f2886b2f08728faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123678, "uuid": "6b1b0d34-e614-4953-a689-3e707ad8195c", "value": "T13353394137984F07C5A66AF8293F23E483FBEE9011F8F688161F960B4674E771459F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123678, "uuid": "1baa3e79-234d-4274-b1ec-4bf6e03786dd", "value": "768:ozOuSQ+590IwFznS+630IR5IRFpu2bWRbVpbii8dah47nrGjmP7bzpUpmbK4tXfI:Mc13wRqtX8dahE5vaoXIjgr4HD7FGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123678, "uuid": "982e9994-76a2-4d8a-9910-999156c4070f", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123678, "uuid": "7f41bb74-918d-454b-bff4-dcae9c9161e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123678, "uuid": "27399400-2842-463e-88b3-10cca917bbfa", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d229de2-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143514, "uuid": "22211cff-cfe8-498e-a7ad-3173adfc582c", "comment": "Malware payload", "value": "1f686c8d7ed8b6f0e9b2a56c16cddc05", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143514, "uuid": "b065027e-fba3-4206-94cd-b8676b77718d", "comment": "Malware payload", "value": "e7a0beca973d5faf3390c75dfee16c4b2fe50920250b110ec41103cbb8a5a614", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143514, "uuid": "038d5731-9634-4e14-bf33-7b1115613622", "comment": "Malware payload", "value": "3dbb4857f357f36f0e81ec18067b6e6de9b6484a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143514, "uuid": "2cbf6f86-244e-4358-b30c-c64dc44aa597", "comment": "Malware payload", "value": "71ba15b09ed6d975b8329ede3e47e18b36d7fe42bc47e0a0e539282c4f5272a2ca8cdcacf893fd9fed38502f54d4dc13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143514, "uuid": "0d02b842-8165-4680-a7e1-b7022f93cd1e", "value": "T11001E9BF3311EE82CB3C691D32177554B1F787799B3E8A484A4000E6C489A7C309B93B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143514, "uuid": "cec3da9d-4f92-4c0b-a2e3-470d6baca5e9", "value": "12:SdT8w8T58z8VndT8N8K8K8wdlO77XthdlHG7ggdl6dJ70eS6dlh87azT:7TTiIw255MOPXtlHG7g8ox0eSmh87aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143514, "uuid": "6f3d050b-67c5-4057-835e-ba96e370aa2a", "value": 695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143514, "uuid": "56c6261b-ace8-4bd3-bbb4-ec7b7ecf49c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143514, "uuid": "8f017ea9-de0e-44c1-8ee7-716514f1ebfd", "value": "ph.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afaf1c4-00b1-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770089581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089581, "uuid": "cbef81bb-6def-4810-855d-8093d2185819", "comment": "Malware payload (CobaltStrike)", "value": "6aed7e49bd6c10c4eaee34f8c0eaa055", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089581, "uuid": "d8a92fbe-ccd2-48d2-b264-016c7feae824", "comment": "Malware payload (CobaltStrike)", "value": "e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089581, "uuid": "f0a06382-02d9-4c2c-8820-3c8f2939ef12", "comment": "Malware payload (CobaltStrike)", "value": "9fbf2195dee991b1e5a727fd51391dcc2d7a4b16", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089581, "uuid": "a778444b-a2c8-4d9f-8a5f-318896795326", "comment": "Malware payload (CobaltStrike)", "value": "b7a04bb639317923c83dec2cbec8e0078abfc5878069bdc7728cc6d10cd8a550fe6c4fed2b322b130d33d018693e30b9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089581, "uuid": "df88b32e-b176-4d10-8e91-7a0f1e82b927", "value": "T19A82E73BE31348FDC916D67496FB6B32BCB23D6345A1573D1360D2F51E21AA02DAEA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089581, "uuid": "afadc5d0-3182-4644-9071-98c97940de02", "value": "7d68a9be287b7923792fc63f65e9343a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089581, "uuid": "f2cbfc5e-5d72-4658-bde4-ae254f097223", "value": "192:W0X9M+VvDVyaLjIy/hZFLKHGGfet4Cc0iIpqqDF7FR1DMjjhh:NHVJyawy/h7KelvDZh+hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770089581, "uuid": "faae4872-bc5f-4c3f-bd46-2b393e5c955a", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770089581, "uuid": "81f11d0f-3dd2-44db-afa9-02bc06937da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089581, "uuid": "bfa46be7-ea27-4697-b102-40ed57e04ddc", "value": "_e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83613c42-00f8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120278, "uuid": "53cefd14-8062-48aa-8f42-df2927193319", "comment": "Malware payload (Mirai)", "value": "950a686200c237c8a63719a014eccbfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120278, "uuid": "c078812b-2555-411c-a203-0f4895c2ea0d", "comment": "Malware payload (Mirai)", "value": "e829fb7b39b54bedb0bc392689ae97e266d7dba40d758b4e57ffecb3ea7fbdb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120278, "uuid": "ba5f16a1-bab0-4270-b940-5439b149be32", "comment": "Malware payload (Mirai)", "value": "a02d90c5306b845fe3c1cef488d321d81e486a9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120278, "uuid": "7edb3f47-aa7e-4e54-bb14-a0046cbca7c7", "comment": "Malware payload (Mirai)", "value": "7033ccdb85a9a14eea4eb51fa4cb8743eb0d923119cc1db266003e20032d5e4af85a3284541d6025da2a4c7e54543408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120278, "uuid": "ae1557f5-35ca-448a-9456-3a8a9e85331c", "value": "T1A5633BC9F401AE6CF94FDAFA40214A0DF511A25891430F3BAB6BFDD36C720A59E17D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120278, "uuid": "f2ee4d46-c237-4c88-9396-8b3e3ef32d82", "value": "1536:dM6MnehHm8Zft9BML0e4vY89RErmi/pDOp:dw0m8ZF9BMd+R2/94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120278, "uuid": "49c681b3-6247-42c8-a3c9-b380e3beaa7c", "value": 67476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120278, "uuid": "c9432e43-ceec-4cac-9578-a4fe7342eb90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120278, "uuid": "0b281a90-adad-4630-a851-9345b6688e3b", "value": "mao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bea8a96-011e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770136425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136425, "uuid": "7caad882-d137-4ed0-a1e7-2a75084923d3", "comment": "Malware payload", "value": "61d0224cb40184c31686180efc371d37", "object_relation": "md5", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tiny", "colour": "#EAC5C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136425, "uuid": "c668403e-8078-42c7-9268-8abd068f13bb", "comment": "Malware payload", "value": "e89eb46a4bd46b2afc00ca271ecfb342321d6de42bfa106832846248d0f7d253", "object_relation": "sha256", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tiny", "colour": "#EAC5C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136425, "uuid": "75350802-d650-47f6-9794-d09af3823157", "comment": "Malware payload", "value": "c27511e5b05829d50b2511a5ae95cabf39917b44", "object_relation": "sha1", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tiny", "colour": "#EAC5C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136425, "uuid": "6a3d8e5c-4979-45e7-b086-1f2d9f8ff618", "comment": "Malware payload", "value": "5750ab13f6b8499a3e36fd84bbb3434b9bb0356e0ac4824aef0a1b825b41d7f5c97afe7db6e1c57ccf84b66886eeee4f", "object_relation": "sha3-384", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "tiny", "colour": "#EAC5C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136425, "uuid": "450fe494-f447-4b1b-864b-ec697a52462f", "value": "T1F714091BB7A318F8CA1BC03486E7A7B5A531B4550325BE6F0695D7323E74E280FA9D34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136425, "uuid": "c733524a-90f1-46a5-bc50-b7b904ec6f80", "value": "01edae0198bcf77ec2c9309f79c94cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136425, "uuid": "285cb530-d991-45b3-ae71-e694c0b32e2b", "value": "3072:Ujpi77HK3hmg+MCk3Q2xtLNgQS9cEg+KldUN1Rq1r:UFiCmgmWxYQS9HgXUN1mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136425, "uuid": "d10770da-d01c-400b-8f0a-f5afdac97f3c", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136425, "uuid": "06f91c5f-4d6a-4b0d-be79-df1bb050fa68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136425, "uuid": "4a85ea3e-aed5-4fb8-9ed9-20fb9e4e0010", "value": "e89eb46a4bd46b2afc00ca271ecfb342321d6de42bfa106832846248d0f7d253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314da0af-00c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770099095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099095, "uuid": "0152bd4d-7b69-41b8-b429-ca6d7356f9a6", "comment": "Malware payload (Mirai)", "value": "fa87ec1ddf8f545adb1dbf2f76f12760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099095, "uuid": "7e4bd553-e96d-459a-a788-32e70d0155c8", "comment": "Malware payload (Mirai)", "value": "e8d4dc3fe29cd37e26215e8937aae5f2cca4ccd6b78eba7ed8f8454594d3c1b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099095, "uuid": "cdd82c30-1199-4fb0-bca0-2666b44fff34", "comment": "Malware payload (Mirai)", "value": "2046db2bbf3ef20ebc1ba26cd1fb17f2d79dafae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770099095, "uuid": "e2a3b042-97c3-48ad-b6ce-67f42242703f", "comment": "Malware payload (Mirai)", "value": "2ca9cabab0665e473f69847a3de87a2d33626f52f05ad8250067b025ed06aed11580e78b2ddfc1078a0411c0e5683347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099095, "uuid": "4bb1a098-76f0-4313-88bb-9bc7bd4aa813", "value": "T12134E509AFA10EFBE8ABCD3702EA1B0139CC641722A83B757674D914F54B64B5AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099095, "uuid": "28face98-1388-4ee0-94e9-de72176adaa3", "value": "3072:2nQQjlzJR5QeMbhiO9KwQz7jV6zzIvuhoDwbZnb:2nbPMj9ZQzN6S5wRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770099095, "uuid": "24f6951a-1133-4a98-8cbe-8a6e4e89d8cb", "value": 239156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770099095, "uuid": "aa7f93f1-1f53-4a99-82f8-21e243288ab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770099095, "uuid": "1cf82622-c2e0-4b5b-9978-c9d0af984726", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360b5482-0134-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145918, "uuid": "a8f54d98-2b49-4e7f-82f7-dc57f934b781", "comment": "Malware payload (Mirai)", "value": "6e5c924a14fdebf288203016b8251d0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145918, "uuid": "ed799504-a60c-4fb4-8829-34ec21063206", "comment": "Malware payload (Mirai)", "value": "e97ad56b6016a97f178de57313157738a26612d655bf8c30850fd9b38fd304fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145918, "uuid": "5e80656a-ae86-449f-80f0-793ba6690da2", "comment": "Malware payload (Mirai)", "value": "635d6bd324b5b139d3b6d21745d7370ed2d5ed38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145918, "uuid": "16b1c6f9-000b-4bef-b8d4-bad7422b3fca", "comment": "Malware payload (Mirai)", "value": "8b4edbb6012903a56732e5c230fe3a41be0ad084a6245fcc9a17dc32ff527b1067d9b0bd32b2c77bea147c390469d6d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145918, "uuid": "2b12178e-f8e3-42f7-be39-46d7b2d64c4d", "value": "T1A5F249638C3BAFD5E14652F8A9B14E741B13F81A9E270DFA6A15D9E54003CE8F5087B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145918, "uuid": "87bf4554-8937-426a-a4e3-fb30c5bc5a81", "value": "768:Cz2PgUC85NNe5UFtBBwtYn0ojPoV6CJSY:Cz2oU9gWbBwtYjkV6CJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145918, "uuid": "9d83ef94-09a8-4319-96bd-5f75b76e5890", "value": 34437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145918, "uuid": "c34a16c8-9293-4a3c-b837-6271c74ee509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145918, "uuid": "3daa7c90-e50f-4182-90c9-6a8c0eeac97b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2b8b0d-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770120536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120536, "uuid": "f0ef98fa-c953-4f4a-aad3-eafd97fc26d7", "comment": "Malware payload (AsyncRAT)", "value": "b02c5d1e645233af0c5bf06928d6bdfb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120536, "uuid": "71e7563f-ab8f-4c39-9f61-b81172a9d8a2", "comment": "Malware payload (AsyncRAT)", "value": "e9d4d400f9923f1e84ab5e8b7edf5f9a8042d54ff6ec8df8e5412bd984835274", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120536, "uuid": "91133c37-e053-4e83-b761-cdab185cdc2d", "comment": "Malware payload (AsyncRAT)", "value": "587f4810d12622787482eca8cb29bfb071ad468e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120536, "uuid": "83ec74be-8d18-4d1e-b27b-f645c25f99bf", "comment": "Malware payload (AsyncRAT)", "value": "014dee5580201e28a42e41e426655094e894b2b72e5beb2d8cde48e63593cf27cf3aa77bdd48c3aba967aa359a607615", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120536, "uuid": "d6101b45-eedc-41e3-b546-e3337bc5d62e", "value": "T10FC22B0473F48262D1ED4BBE48339604D375E68B5D13DB9F2EC494AD2A23BCD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120536, "uuid": "f52ddcf7-4f46-42d5-83b6-6b24c207800d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120536, "uuid": "80734ff8-00ed-4591-b18c-a82878a85312", "value": "384:uQaA9XyfjjzgeRSQkeKwMymrJhxYHqqbuUsJQxnCJf+BWfXWb/Qu+:uQzMjjE9Qke3MyCJhx+FbHBFB4u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120536, "uuid": "77759880-80e9-4103-83e0-bdf3b08827b5", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120536, "uuid": "1170bb19-5652-4b7d-899f-b4830424efe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120536, "uuid": "5b39fc4a-1eb9-4a86-9917-9eeecc165e40", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03843787-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136813, "uuid": "df5b898c-8d5f-4baf-9d8c-7f7a6c9c2611", "comment": "Malware payload (Mirai)", "value": "047966b2c20f2cffffca8e41a6683874", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136813, "uuid": "819ee003-a2bc-4ce9-bae6-63021bd71382", "comment": "Malware payload (Mirai)", "value": "e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136813, "uuid": "806ad7ad-7d33-4d25-88e0-6bf19768b047", "comment": "Malware payload (Mirai)", "value": "b8e0eb1ab2ede04db3e8f085a2af13ff4c20f279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136813, "uuid": "c49e1484-9b5d-4995-bd80-b9be172a6651", "comment": "Malware payload (Mirai)", "value": "3d5d2d659355880b7a2cb21e70886954872b0957ed4e1bad76a32bd7b4790568bba095b431973695960bdfe6a3b0abe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136813, "uuid": "55303880-93d8-4b58-ab08-91f75267f883", "value": "T188D2E192E3D197C0C5AA42B11E2FFF5F4CB1335D128CA6725DE833331A85F6A19A90C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136813, "uuid": "25965138-68cf-494c-a838-e42b1d5c08a0", "value": "768:XlPK4ZSlTXdRSRYuLgq4JhV2SGmBSefzbigwnbcuyD7UM7K:XlS4S0I2Sx4gwnouy89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136813, "uuid": "6badfd73-dd03-42bc-9683-114c12572b68", "value": 28496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136813, "uuid": "c0d1b615-15c0-4e4d-9b78-1d45b46bf416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136813, "uuid": "de9c4e05-4e73-4533-9897-2ec296e033e8", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a2d7fc-00b1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770089727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089727, "uuid": "63109520-251c-4d65-bcf8-fd336613a6a2", "comment": "Malware payload", "value": "a6487fbf732770f7ebf1aec9324157f8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089727, "uuid": "1229ac1e-1af7-4476-bc1a-f97724f488c9", "comment": "Malware payload", "value": "e9e9b6b8d6597bc10168304dfa63f25652533b9a9a8ae3206ef0c6b558dd6fec", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089727, "uuid": "0de0bb16-7f7b-4b83-b853-5bb977683363", "comment": "Malware payload", "value": "6d884e2894d6cfa4427f123a19a49f86dd52d9c1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089727, "uuid": "94dce3da-1e6a-469d-b2c7-3e2e6aa6c558", "comment": "Malware payload", "value": "c37a91f9fa7b5a121fa3b7b17e48f1f4dca30c94728018aee7ae92ab76dc07fa59eff7202b2be77015574e00fc05e979", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089727, "uuid": "a74c150c-36a8-43b3-945b-4de0c8df615f", "value": "T135D46C91AE85CA53C9370EB547B6C33883B6DFB8BD534707A4BB7E2DBC366452901242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089727, "uuid": "9e997ed9-02c4-415b-b9dc-fcfa0aab1833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089727, "uuid": "f8dd7a2d-d3c0-4772-843e-ece75ba5e965", "value": "6144:5dSf9cg/62WcaLDC02yzsXjCn8o0CC8OhrhajycWaMN+VO3YHlZWHEnlKS:5dSKgGLex08oBLO2WaDnll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770089727, "uuid": "f06ef646-7f20-47eb-9a59-bdf60d1c97d2", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770089727, "uuid": "6b44b102-2c6b-4e68-a39a-522b19f8738f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089727, "uuid": "94fded69-66cd-4b8a-bda9-554d32de2ab4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d50c97-0097-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770078761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078761, "uuid": "196b3654-293d-4943-86f7-fdc765d303e0", "comment": "Malware payload (Mirai)", "value": "04f425ea8d9a1d3fc9d5c15f394a6476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078761, "uuid": "6dac6fa7-850a-4a6b-9e0f-e6373da7c98f", "comment": "Malware payload (Mirai)", "value": "e9fa792a3a1b76a55dd8204272d6add22e45a8b337c63394afaa9ebd630020fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078761, "uuid": "5fa22951-f9c1-44fa-a3e5-72ca0b908811", "comment": "Malware payload (Mirai)", "value": "c05c1f35d8f5eacd74e9d5497e1182a38e66092d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770078761, "uuid": "6dc9cd1f-0438-4b37-8f7d-2767b399340a", "comment": "Malware payload (Mirai)", "value": "15f32be135a12ed1003defa4a5fc295b0aa1f4ecac66759860c5b0a96dd482592205e7a6a3965d5def5a018fa9a0b0c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078761, "uuid": "caba7e4c-cfd4-4d32-b8cf-8ff7a7545f6c", "value": "T112530261615A4171C2981DB99868D3F2E091CBB8D3CCBED76D3113BE280B13735FA993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078761, "uuid": "3fc95b33-e533-4a5f-8ee0-f3fb44caf1fa", "value": "1536:qvOrNB2Cz5lBt1l+sedT7QEu3mj6oWO3lNvDqL7Zl:qfWBksedTsVK6Vyl547Zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770078761, "uuid": "ebcf1703-83ca-4d41-8019-0cf54c3a6d32", "value": 63904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770078761, "uuid": "94905a14-bdc4-4902-a8e4-a552cfae5d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770078761, "uuid": "a122454c-2be1-4dfb-bbe7-4d47b768b12a", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924c1c84-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143495, "uuid": "f9b72002-ab36-4f00-8fe5-d5d293e27ba5", "comment": "Malware payload (Gafgyt)", "value": "47579097def7019e0b199f2a227c6a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143495, "uuid": "3b7f818b-2eaf-4ae0-9cfa-6d01070b27b0", "comment": "Malware payload (Gafgyt)", "value": "eb0ddf7aecca70388736812cd2e93a7df48f9725c46abefada7f227d7ad18ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143495, "uuid": "318c46d0-7ec3-4ada-9d24-0af40ce096b5", "comment": "Malware payload (Gafgyt)", "value": "526a1e0293fd464ee9bd86084c99b4a7f0f23005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143495, "uuid": "5d20cef7-3c57-4760-80c4-adbb6d9119a4", "comment": "Malware payload (Gafgyt)", "value": "20c17b748adc2ebca1fc7b30b42b54d795322772e1dd6a5760a289b5cb1f96037d867974af282925568b4c95c3ac0bf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143495, "uuid": "370214d8-3cbc-490d-a06d-a1c28bee085c", "value": "T1ECF34A09F6508B57C1E22776F68B424933238BA4A3DB33159938ABF43FC27995E32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143495, "uuid": "090e851c-45c4-4951-a6c8-5d18bc5a3558", "value": "3072:HkXYjEawHL28VaaTc0e1YjEsEyFYBKM/9fTjZmawW1IQyo8:HMoEawHL2Aake1YAsEymQM/9BmawW1nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143495, "uuid": "4c1a8dfe-a936-4a8f-9ee5-da0894c0ffc2", "value": 167843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143495, "uuid": "20f337eb-b39c-49fd-8898-bcbf8aefc44b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143495, "uuid": "18641144-b619-4349-a5c0-9e9fafdcb7a0", "value": "pXdN91.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f74d37c-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770136646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136646, "uuid": "0d63d51e-5cef-41d1-ba04-e82e67902f35", "comment": "Malware payload (PhantomStealer)", "value": "f1557405ac36aa0506b9b7f0df7a680e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136646, "uuid": "47a1f5ab-dc8f-482e-ae91-9944b29de1f1", "comment": "Malware payload (PhantomStealer)", "value": "eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136646, "uuid": "cf972617-e00c-4630-874f-7052b8cec51c", "comment": "Malware payload (PhantomStealer)", "value": "9a44ffb33b4bb3c14d56328c144e098f6cc77b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136646, "uuid": "1612bb5d-50fd-4ff7-ae5b-e95d2685b421", "comment": "Malware payload (PhantomStealer)", "value": "62f59d36c2933340f02a1e2a40c2e1783504712b37a9f537c7766e4ab8cc5fc302296bfe7440005b3d3c1a071522105e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136646, "uuid": "6ebc0daf-36b0-40b6-9938-8d22b79efd6a", "value": "T1AA6523996045CD13CAEB133016B2E7715379ADADAA13D3218FE9EEE73A013B07D18752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136646, "uuid": "bbc9b479-55b4-4d78-892e-775275fc25cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136646, "uuid": "454e5a2a-c1f3-4526-b7ab-47db80b0981e", "value": "24576:RddNizyYim+BpbFmbjra4oZqHyKZG0EnEDsi4VfPuw61ZD0QK5ZNx6I1HAEfYx:rSZgxmPra4ocHrGqcVfGwc10f5ZN5hAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136646, "uuid": "6ace9d4c-9f01-4200-912a-51a51f1ea1f3", "value": 1542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136646, "uuid": "62b427c1-af2d-4d4f-a9a0-dc9dec60e5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136646, "uuid": "d670141e-9c21-4359-9db3-d2ca976b6c4a", "value": "eb39e97c5c106d34d5ac48ecd629614df3f798ff936535ba8a18b2532712590f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d86859-0132-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770145191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145191, "uuid": "b511b75c-fcc6-4c2b-9a4a-8793e3c9c7e5", "comment": "Malware payload (Mirai)", "value": "951d68fca6484746d106a1f539077dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145191, "uuid": "9e4d505c-f863-4974-ad38-bcf5b6ecb0d8", "comment": "Malware payload (Mirai)", "value": "eb83574b4e79b73f2669e257643a06811b5a3d392ebc8597130bc8102b4a6b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145191, "uuid": "46374676-62c7-4683-8e39-c05f1f647abd", "comment": "Malware payload (Mirai)", "value": "b6fd62d93e273abea44b5b3d6a2b76319b2c0bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145191, "uuid": "1e286be8-ffbe-4711-89ca-e3748c950fc9", "comment": "Malware payload (Mirai)", "value": "39cafc4719d4892c4b4e16343ec22eb510bdd1ed30f1d33b3cb3e0bd3e8795d50d122acf620b9949b1963f77d37e2a59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145191, "uuid": "684a67af-d775-4176-9697-fa8cd0e5f445", "value": "T16B83404D3E318F7CFFFD823493B75A659209339A7291C584D5ACE6022D6420E742FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145191, "uuid": "7641aa99-bee6-4c94-8b6f-c0f673d88111", "value": "1536:A6TEgHEeGxdltYYcd/d7LM9NADfu9QPJzthXbPiOr44FofCX:lwgHEeGdtYpvLMuJzthXbPiOk4FYCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145191, "uuid": "545337c0-b384-4319-a44a-f6cc93ba9393", "value": 85008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145191, "uuid": "ea6f8900-2b7a-4b1a-b42b-6b44bdbf2aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145191, "uuid": "108af7b7-c9cd-4597-b93e-d8a82cffc06a", "value": "mao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8545afa9-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143474, "uuid": "8b330511-9d54-4032-9c5f-5d16dbd1495c", "comment": "Malware payload", "value": "d746f7ba66f84352db290e133f8654c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143474, "uuid": "c0a2c0b2-8890-4f9f-a004-35c1a78985cc", "comment": "Malware payload", "value": "ebcc26011a79474355541004a3a3b9d80ad3d8dfa5c70f89f3b07c12d5dc0a0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143474, "uuid": "8ebaadcc-a2fc-4233-bdbe-902a127eb35c", "comment": "Malware payload", "value": "72f8f7062ac39ef0f9edfa5d36d7b33c9528f2d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143474, "uuid": "c2d70a41-cb3f-4b1c-8c65-f891b71252bc", "comment": "Malware payload", "value": "b0bf73d67d541afde10d448e88f61f310eebfee5406ff4075b38e5a5b4b7b180ddbb834a3f1394388e5823b8a07f5303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143474, "uuid": "d5d6cdd8-17fc-4791-a5e6-d30f2ed9f29d", "value": "T1B204E049FEA54BEBD46FCF30024F121B25AC49DE86E2933E2178C86CB259685D1E7D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143474, "uuid": "23945f33-7eab-405c-984d-4a7573f5d8b7", "value": "3072:oDTIzc663gmsJPnCFq8jSplW9Rs6YCg5eXBuynTsJm8A5A6d8rGIt6ZYSth7i9R:rzR63r6nC8ZplO/lcyT/A6d+GIkYiliD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143474, "uuid": "905d717e-08b9-4edc-a6e6-f29f22feef4e", "value": 180237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143474, "uuid": "341fc881-5f29-4f97-8341-346db11c804d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143474, "uuid": "118d0f34-3c80-4664-9f06-125337baa570", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a40faf-011f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770137027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137027, "uuid": "2d1b08a9-a18c-41b2-991b-a33a05cf78e5", "comment": "Malware payload (Mirai)", "value": "34ca46929f48b583bafe407811c36244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137027, "uuid": "a4a4acb9-c2cf-40e9-b799-371163847890", "comment": "Malware payload (Mirai)", "value": "ec3d8b1d25e5ec315d568330fea1b232b33cf86e72fb166779ed9eec48f9ad36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137027, "uuid": "d1908db1-dfeb-429d-b951-dc52cf846e2b", "comment": "Malware payload (Mirai)", "value": "d299c29dc1d19856b7849f72041885fe76f0efa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137027, "uuid": "23e6576c-c35f-4583-a814-4d24854a0a1b", "comment": "Malware payload (Mirai)", "value": "715dcabe63a3eb1c50f23778b760a205998829931395292e9866ce10a3b7a60a275606f96f94a66556ef7a2b0f842bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137027, "uuid": "2cc3d5a9-7f0f-4297-8252-c779b7b20400", "value": "T1B8633A47A64550FCC198D17843BB7636C863B47D137EB2A63BC8BF1B294AE605F2D40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137027, "uuid": "a8446338-6f0c-47c9-a659-a31cb14b6dc8", "value": "1536:GZ9CBJ9BdpojMJ2yFRPMMCajVLzhCi20hZ0j25s0zLmju:pf9BdpAMJ2yFREMj/CiRb0y9Lmju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137027, "uuid": "71f110d3-a6ab-4195-b835-97754eb52bd1", "value": 67360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137027, "uuid": "ee5d6dc9-c18a-45ed-a013-2e92779f10b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137027, "uuid": "5109b7d3-9fda-42ab-9be9-2df1a5693a4d", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981621a6-0132-11f1-a129-42010a9c0007", "comment": "Malware payload (Sazoora)", "timestamp": 1770145223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145223, "uuid": "f002b8c3-555f-4976-b73a-61e8d0f85150", "comment": "Malware payload (Sazoora)", "value": "176bcd107f362818222aae3b88eb4418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145223, "uuid": "30c219a6-2f92-4003-8493-7c6e9618232f", "comment": "Malware payload (Sazoora)", "value": "ec4b7dadd05d47dafc327563e32c148c1e5897ad7a6867084917aa642044c2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145223, "uuid": "24f90d20-fbb3-461a-b9e5-338d79d9c5f7", "comment": "Malware payload (Sazoora)", "value": "67314caa0d581df0f8f01f6213d604eec1695d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770145223, "uuid": "98149e59-7576-419b-a347-0ebe59ce6fdc", "comment": "Malware payload (Sazoora)", "value": "07c3df4a28f5125564a3c053a27aac84f2ecdee3e30a4f048783ad941ed4ad050e8acc08d717adf5c770bf4162a99bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145223, "uuid": "4afae64e-7212-493e-9015-461110751577", "value": "T1C156336179C788B2C6B727779A4ABF13D438B4251B018DDF574482AD7CA05E2EE307A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145223, "uuid": "f784de8d-36c1-42fb-9f52-f796b9ebc155", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145223, "uuid": "18b71ff4-5724-4518-92bc-462aa7676972", "value": "98304:kuWJXcGT5HMPWuPoGuAejO9i7B/csB5oQLu/Y1LMN3mHkbF:kSG9HCryO96B/NnioLM7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770145223, "uuid": "d1fa8361-f170-4f1d-a001-8dc8469553f7", "value": 6199100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770145223, "uuid": "cd717596-3b16-4e23-bb80-f25d62d8da1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770145223, "uuid": "aadda177-b0a6-4e62-96ab-a1f9f6b23656", "value": "176BCD107F362818222AAE3B88EB4418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e21100-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134167, "uuid": "e1e61774-da3c-4a8e-bd76-9a63715ae68d", "comment": "Malware payload", "value": "24f011c2aada8837564020d68cb2ab43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134167, "uuid": "36c2fe50-24d9-4e0d-a2c3-3fffe2497386", "comment": "Malware payload", "value": "ec52ec8d2a5041958889ca523117d7eca660f30ebd7b3a525732761e70e0c067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134167, "uuid": "9d7fab7d-9b0b-441a-ba8d-6ee7aefc7dbf", "comment": "Malware payload", "value": "7424cea10b16d1b2be07d7681c2cdb61bf317c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134167, "uuid": "eca8a2d1-21db-436e-b285-0cf7e99aa211", "comment": "Malware payload", "value": "89b244dc684de654a60c464df05475f34284183bb7fa39078769d1cb5e69bc8720fe8203233c4c47b4071957df05340a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134167, "uuid": "dd02033b-04d3-4751-ae73-0559e37da145", "value": "T16BD3E0A5F8C09F27CAE6217EFA5E010937120779E3ED7242CD109D7537EB5AA4E3A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134167, "uuid": "8e1238b0-0a2f-4b36-ab0e-f5aea7c4df52", "value": "3072:7D0ownSrawts6Cnc00+2MLKl83y4cP01Gb3s650JSbzQrdnYF:7xwSuwtPSI+nu63ydP0sb8VSbzQVYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134167, "uuid": "d5045736-f97f-4dbc-b548-e0f5461b5108", "value": 142049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134167, "uuid": "d95f568c-5424-4a7c-a81d-c4a0099c50e2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134167, "uuid": "94ce2bf6-5700-4124-bdcd-c6b49e8af4a0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7a5dc6-0159-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770162140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162140, "uuid": "504410b6-f920-4e2f-a97d-3ab1941655f5", "comment": "Malware payload", "value": "54b9463926fd4c0f8b25a4406ab977ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162140, "uuid": "4eaa4a93-e727-430b-a691-a1b123c410f9", "comment": "Malware payload", "value": "ecaa33aec25a96f15d89851ddb7524177404e4d21683608be2391950fde1a1b8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162140, "uuid": "6ffec7aa-95c3-487a-b1a3-eee6e24068dc", "comment": "Malware payload", "value": "65e8a182fb2b892cc07692cdefb35bd2aefdf336", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770162140, "uuid": "17d6ca07-064f-4194-a5a5-f559350c7bbd", "comment": "Malware payload", "value": "ad9399f79d31709a7ec9278327bcad7431a5ad82d91b4e1c94c792263e9e2bccc6c25e8e5bd4e68946b4968f66430531", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162140, "uuid": "fe2b9840-4294-41ef-aa70-0af7c6fd09a3", "value": "T1B1B1120682F888F2C00C03B80647C98462A4642497E093431FA0242FBC211AD88FAE05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162140, "uuid": "ea6dfbb8-034c-44f8-9a2b-fa632e789ce4", "value": "3:WlWUqt/vllnl+YZcFTS9gXeF+X32ZpAl4/l/i/FtldltllEPl5vxVlJ/llDtllFG:idqGVg3F+X32Q6lwR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770162140, "uuid": "c3330603-acdc-4f2f-a78b-19d14bf2e5e5", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770162140, "uuid": "fd164203-e011-45c2-8f0f-6fefac2c7244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770162140, "uuid": "b3a8fa3f-2e5a-4fd1-9411-12ca78fd9dc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b021f96-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128666, "uuid": "5674111e-e619-43d7-b3d9-c8478187477a", "comment": "Malware payload", "value": "4f7656581c5b69aae11f0a65efe4c6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128666, "uuid": "00cf0ef5-c4bf-4c30-ba8c-64e6f62564bc", "comment": "Malware payload", "value": "edb1b4068b2fa8ae3f6aaa78790b43f4039175b715ad501ec557f056199c46cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128666, "uuid": "9f7c8d66-23b0-407c-b53b-d409ae74ca86", "comment": "Malware payload", "value": "51d68de0cbcfa44d5101e3c24ce367e8bf739f40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128666, "uuid": "85deb1a4-225b-4439-82b0-635a18bf50b9", "comment": "Malware payload", "value": "c8b83eec307bbab79a763b4251a25c14750eabc5dda13fe7bb0aae26ac41e19d9f80c3cc9dd10bd6a410b1410bbe9d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128666, "uuid": "2872d6d8-d630-44af-a0bc-b4de2b0522d8", "value": "T1467623F9714C3398D05ECF358423B954F2B9101D06F9959A3ACA7BE03FAB414D62BB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128666, "uuid": "880e613b-8495-418a-a51d-6a42de9b38d9", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128666, "uuid": "470eee70-0572-4b36-95b5-c29edaf3a936", "value": "98304:EQsSYndmO6vb7UGMGIN2FcEaaVxhAcI3oMQtznpsKSMJ3aQdpIG7NMMA5UvPEHsR:5HYoOQ99HJa0ucITwNsKrJ3aoNPAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128666, "uuid": "deb69eb9-8bd3-4df3-b62f-25d12a97f18b", "value": 7766016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128666, "uuid": "2bcd3abf-1064-4b92-8bef-dae3f2503606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128666, "uuid": "e4c9d7bd-0d1b-420f-9743-473309adb44c", "value": "SecuriteInfo.com.Win64.Evo-gen.86492146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baef180-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139055, "uuid": "9104e4ed-d17d-45a4-9982-4538db6dc5d5", "comment": "Malware payload (Mirai)", "value": "401584c3e7e76bec2f88b5831fe77c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139055, "uuid": "4797d468-836f-4247-86b8-32e07eeea5e3", "comment": "Malware payload (Mirai)", "value": "ee642a602e977682334c82e27f57aeb54b3a58065b4a77314c2a6407c3e7ce2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139055, "uuid": "529712bb-a255-4ede-a55d-1c4f82e1fe39", "comment": "Malware payload (Mirai)", "value": "9903191f0841c4539b959f317cbe1120b0b943de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139055, "uuid": "e130148b-a999-4597-b4b0-a3083d5b5311", "comment": "Malware payload (Mirai)", "value": "66ae60350a420f015b1b3a1a70818d249cd6d844963124155fb34a760c3c03088fef3d8b63eac18eee8e20ca32db1c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139055, "uuid": "6fba31d7-3f8f-4dc4-9f1d-1fb577cf9222", "value": "T1FE132935BA35192BC8D8657E66F74718B2F5124A28F8C71B3D320F8DBF2068065632F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139055, "uuid": "fa3997d6-863c-4aa2-9804-632965d63f83", "value": "768:K8npDrhM32da6iSytV37Z4SFlxlna+vaO+3DcYW:K8pnhMcad337Z46LQ+AzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139055, "uuid": "a289b5f0-f1a2-46a2-8da1-ea92861a7140", "value": 44648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139055, "uuid": "f6966774-2c1f-4480-b5de-7a9d573f0e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139055, "uuid": "1314d11d-7f4d-4c60-9d79-f08533e7c4f9", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5db253-012e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770143489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143489, "uuid": "2ffd8969-abfe-41e2-aab8-2b6c5169dc2c", "comment": "Malware payload (Gafgyt)", "value": "a86a8d12c1943200e8c900b489d3848d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143489, "uuid": "dc1ab167-58d4-40cc-8352-4307223fa77a", "comment": "Malware payload (Gafgyt)", "value": "ee66069490e0950670a1175a79baf871736b3949ea7321ac5006fd951eec9c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143489, "uuid": "ef402c7c-08d6-4810-b5f1-132c0d1fc9c0", "comment": "Malware payload (Gafgyt)", "value": "0a062ac5339742244b5c15d159e9297b35c5b51b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143489, "uuid": "0799f9eb-ccb8-4461-891d-456131d25aec", "comment": "Malware payload (Gafgyt)", "value": "30195a8c1c4eb96799592c2c185f3e67c31bc64b81b895d0b73fb1fbac1358a4f88932c039c7fb613a3ea77555c4661f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143489, "uuid": "ab02ca66-7a93-4731-b9a7-0bf3c1001f57", "value": "T101B31A93F800DFB6F40AA77604D34B257630FBA24E53262672173AB6AE761D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143489, "uuid": "0469ebf6-5bd5-4a58-a95d-06decdfb8fae", "value": "3072:0Q4vCFYXgQF8dUXb9kiyXjOqjbQkmtbVDNcblQ2j:0Q0WYXgQ6dgyXbjbxmtbVDNcblQ2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143489, "uuid": "8506c274-da1e-475e-92fb-ecfe5006ebfe", "value": 109661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143489, "uuid": "e2beccb2-0881-47cc-9972-7ef81fa8d555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143489, "uuid": "92dee0b6-cb70-4286-85cf-f5b8683bac5d", "value": "pXdN91.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59d533e-00ab-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770087398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087398, "uuid": "63f5e201-fb55-4330-bbb4-a31b88076194", "comment": "Malware payload (SalatStealer)", "value": "ba6124b80adda51999cab40c9c77ef75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087398, "uuid": "7d18a680-4eb6-400e-a6a9-1fc2ef05f84d", "comment": "Malware payload (SalatStealer)", "value": "ef27506a6ae07e74ede47c5d7de24ab3740a74e8f65cb8387db40efbbf611d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087398, "uuid": "9e3360c8-3bc6-417a-883e-d2077946ad08", "comment": "Malware payload (SalatStealer)", "value": "23908b49b0729cba507d8b2050b1e8b41344bd24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770087398, "uuid": "f0048469-4178-4369-9378-f658151af697", "comment": "Malware payload (SalatStealer)", "value": "5063b36835eb47c1b9d1598cf7c9a68cf413d0fdb192d441079f48b4a97692371920c1ca0175111cae1a41dd2682117a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087398, "uuid": "a0d8f5dd-395c-49ef-8983-8e09d99cdf6b", "value": "T1C6C65A51FA8B94F5E9031831415BB23F33355E048B28DBEBEB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087398, "uuid": "3dc4928b-ba60-4cad-9201-dd79aef9bb62", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087398, "uuid": "199dcfec-3c5d-48d8-a030-1b1833ffec6b", "value": "98304:mPxpmXVk/PYVg+u3+x8zMutjOWRNuihu/y:hVk/mk4utS2nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770087398, "uuid": "78854b67-b3ed-4a6f-a065-7324bbbdc5a2", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770087398, "uuid": "6b3111ca-06d6-4132-a479-4a1b639d31d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770087398, "uuid": "4bfc0fa6-4434-4694-9488-427fc35c7601", "value": "driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922c4e63-00fb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770121591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121591, "uuid": "ad5978c2-f455-47ab-9ef9-89a4747cc8f1", "comment": "Malware payload", "value": "49c545435ef56a0702406d6a5267bcdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121591, "uuid": "e753a408-7b21-44bd-bd8f-33b035539549", "comment": "Malware payload", "value": "ef6215b09bf71a96268a5cbf538f7009f5ad5342e4234e154dbcd58796693a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121591, "uuid": "c657b180-611b-4b46-9f33-69b1854bdbb5", "comment": "Malware payload", "value": "e3707d8537a30bab7bc809c6cfaad60fe909774e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121591, "uuid": "caf5f596-5bb7-42d5-8137-dbcb4bf1dfbc", "comment": "Malware payload", "value": "6adc832b540d2328e2014cb76362e049ae5823ce225a81068e90d43f1b7a9f4b06e345af58f007f9d21be906dd6e7743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121591, "uuid": "36c32607-07f1-4404-9477-fa4d5b988910", "value": "T1A0B423ABE141F9F3E2E539E66F07C2884195D97E6C24761ABC2D3DD2030C5B24E16FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121591, "uuid": "5d16c379-b99d-400d-b35e-13fa07f2b08d", "value": "12288:Txk7p6cy0w9RAohiTORUVa7uMyYDFu4fScQelD:Nk7O08RA+UVa7uMC4q1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121591, "uuid": "f30fe486-1c20-47a7-b603-c69df07997f0", "value": 528571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121591, "uuid": "00ac549f-2b93-4c81-a183-1b1e28cf0a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121591, "uuid": "4634a5fb-6ed1-48e1-be77-81ad0620d356", "value": "bizy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac04ed00-0113-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770131942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131942, "uuid": "5d197393-bf3c-45b6-b132-ed286e05bff4", "comment": "Malware payload", "value": "42bd1abbe27c654c85662ff833279c1b", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131942, "uuid": "170234f6-07c8-45a2-a3af-5aad576691b0", "comment": "Malware payload", "value": "efe22784f2f3d290abf1d3370cf1e47293657c496b1d8e38043d32d57009697f", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131942, "uuid": "17e3ec55-dbee-4d0f-9714-381b2d6f0c12", "comment": "Malware payload", "value": "da8942dc9ec3e5e8c290f494abbea8146abb1a10", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131942, "uuid": "6b379edf-7eb9-46d0-9fb2-275022d4410d", "comment": "Malware payload", "value": "fb02cd9ff9eee8d1c4c8f67c58f3782b42e614eb166ecf079ea7c0c99bcf6eee28b869407f5ae6c8df6756ed8f633ba4", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131942, "uuid": "1ebe6a6a-2997-4b27-9168-3b4cae0687ae", "value": "T18FB43D00F2C6D1A5E89F02B91BF8F160945975718B3CA1D7B6C89E9F6F905C32E369C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131942, "uuid": "8f660a81-ccea-40a3-a7bb-2f115fe95078", "value": "94eef47f5cccd8f1a5335a319d43d815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131942, "uuid": "6163f791-c7e1-443a-8498-0f7dee6bfe76", "value": "6144:TeiXtrULwoMLjFzGo5yX9/NYODkGCYPjPWWfEIVI8lpDnSenZVax1v+tlYn7Wt+0:Te8UMPRGuzKEp5OS+dOmF8/M9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131942, "uuid": "e7530296-ac7a-4fa2-b068-185637bb42a9", "value": 536136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131942, "uuid": "28f45cc8-47cc-4e70-92a3-b6caa970fa50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131942, "uuid": "ad7343cb-2b2b-4dba-a433-dba0262c3aa7", "value": "Microsoft.WITDataStore32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312fcd06-0124-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770139038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139038, "uuid": "9e9aae3e-12ef-4d42-a68a-a6c3b7d0e60e", "comment": "Malware payload (Mirai)", "value": "9b0ca8a165e4e287e67b2136626de594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139038, "uuid": "6cbd6ab9-c448-4cb8-a296-37ea956e08e2", "comment": "Malware payload (Mirai)", "value": "f0b84abf1bb1452f759f679f2316aed68bf795a58d3f44fc01888d7778164501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139038, "uuid": "b96ebbed-a042-44b4-8bf4-dd8d6f1e1553", "comment": "Malware payload (Mirai)", "value": "3ca34a2d14d0775658fb3fda7d7557298b6ebc48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770139038, "uuid": "746eeaed-8ece-4887-b26e-e07985504c3d", "comment": "Malware payload (Mirai)", "value": "b775c1717c66b705043b7f4e8fbc15ce0a6cccf5197e64bbf80a25b1081005112e3c493d0ca6aced82892c750fc756b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139038, "uuid": "7b22e026-2f3f-4bbd-8ddd-753b8828aef0", "value": "T1A5632B51B9819613C6D012BBFB2E42CD372A53A8D1EF33079E26AF2137C795B0E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139038, "uuid": "26e0e144-e058-42a9-b9b4-115513883be3", "value": "1536:mTv0UeBXgHniKhq5kJEwOmzFXZCaWfvGu:mTCQH1q5kJv5IGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770139038, "uuid": "bf622b70-a4cb-43de-9da1-2ce22c339346", "value": 67164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770139038, "uuid": "0094e1a2-5ade-4679-8429-dd2b3f854ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770139038, "uuid": "65570e23-d522-4090-a9d7-c14f67822e1c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd10fd4-0102-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770124536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124536, "uuid": "cb0fe770-8531-43c4-ba94-51e9c4961b92", "comment": "Malware payload", "value": "828ff72e8d3dffcc232e6ae2ff100f45", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124536, "uuid": "be94eec3-fe03-4925-ba3a-4609092337e6", "comment": "Malware payload", "value": "f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124536, "uuid": "29ebc4f1-b223-44bb-9a86-cd253b79a161", "comment": "Malware payload", "value": "01a3230a0b7987e2ac597e33eaec256a40448484", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770124536, "uuid": "3293b7d2-4cc0-4de1-9358-9626a2d7361e", "comment": "Malware payload", "value": "4035c81f087814e60b2494ae9b072ee389f38b9c6dc467bcc50afb3abc450670af0ec53741cbe66a1972bf33b3088abc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124536, "uuid": "04c2a9ee-04a0-484a-ade2-1475c16dfe2f", "value": "T1C5A353AC018C15E9D29251907F1FF0406D6BF9351CF18CA431EFCEBB60AE69AC9E7A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124536, "uuid": "77e83298-9e5e-49d2-bca3-5b68f1512564", "value": "768:qAUgKfstEXYqwSp1pzpXpopFpvpapZpMwn7KprwswOgwdwdwQk9TLeAHRNLSJ0s:qAUKtEIqFTF5SbN8bC0eZfmSCy9fZvts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770124536, "uuid": "eaa7f8ff-7b6e-4783-8781-a203b4ce6e48", "value": 103624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770124536, "uuid": "e416d209-f41b-4d9a-a497-b6d46b2e4893", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770124536, "uuid": "43a9c0ff-95e6-47fe-9dc9-09c2b355966f", "value": "previewme.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0680083-0120-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770137560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137560, "uuid": "ef63d83f-1d24-4ae7-af87-191e4e0bc58b", "comment": "Malware payload (Mirai)", "value": "2314c3ba76829545bc50c4e97e8a2b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137560, "uuid": "de04235e-5ba9-4bf9-a3ad-8b6ea3197639", "comment": "Malware payload (Mirai)", "value": "f17560ad18d86bd84ce645ca24e248109800ae18bae9781870cf319300c26806", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137560, "uuid": "6afe9536-862e-4e1e-8a1d-fb1b79b7fe20", "comment": "Malware payload (Mirai)", "value": "06c92eede1c66e013dcef964d0a8e29e77385fb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137560, "uuid": "eb94d949-182f-4dee-82b6-baac2ca00224", "comment": "Malware payload (Mirai)", "value": "1a9cff303c169c9cd845f2399ddc28cc85edbf69e05928ab3649ece150024bf2a4e99b8f7130685184f583d507aa39d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137560, "uuid": "ad9202d2-419b-401b-ada7-9edd8042925a", "value": "T1FE261A57B8918683C4E4367AACBEC1C433635EB99B9722576D04FE3D3ABE2990D35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137560, "uuid": "ea900292-403c-4574-bdcf-a4812200a8bf", "value": "49152:OdbPwECXvzRG6AdgKjxpmVPdvtEmxxMAz0U1F1:gbPcvVG6AjxQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137560, "uuid": "f2f94f97-378c-448c-84a0-952ac527d130", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137560, "uuid": "d3c63c59-14e3-4900-a7be-35f91bf930ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137560, "uuid": "aaf47b6e-50a5-4dda-a45b-5d3ef341ffcb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63aa1397-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101756, "uuid": "bad42442-8cb6-48be-855a-2cb43874c69f", "comment": "Malware payload (Coper)", "value": "afa665ea3c593f8b731e20ce73c70c29", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101756, "uuid": "28945c37-040c-461e-9501-1dea100dbf62", "comment": "Malware payload (Coper)", "value": "f193b84bdbd573bf1e86522b857035d39a059f9ef350e403f72dd14449fba169", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101756, "uuid": "d03f449a-241d-4fa3-b57e-a17162f9e74a", "comment": "Malware payload (Coper)", "value": "2691c29e14d5d1f31a9e0ae3f558c38e2a918e79", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101756, "uuid": "b2a2404b-4e15-41b9-9e23-5b1b7d145dbc", "comment": "Malware payload (Coper)", "value": "53b3526f81b30ca7f29fa89bf81daa3144be8f66045bc1c5e4f40f4fbf8e8605435dddedd3b239062603146ecb6aaaf6", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101756, "uuid": "3c1df8b8-39f9-464c-bf54-2552e1a78c69", "value": "T132451282B7DC8613E8ED9B359E5783E59620BE44DF0097A72A817B5D0D723C0CE22767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101756, "uuid": "009d287f-1a3e-4f99-b9c6-9c234c81f4bc", "value": "24576:VGVgi0MrzqYiicJaxJk8ypBbJqo4sVSlJYYIgVnyBUKu1ikrgcJnN9sp:VWgqzqFicJ4k8uMsVSTbpVnyBPyjP9sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101756, "uuid": "e1222900-bcb8-44bc-9a0a-fab185ce54f5", "value": 1172699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101756, "uuid": "e8bcb359-e8c9-49c0-96ff-5b4b594ba347", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101756, "uuid": "89dd549d-bbf7-4f39-820c-c9a8d3e71111", "value": "53e28f9_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e80c109-0144-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770152938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152938, "uuid": "789c1537-55e2-46dc-893d-ba03d0c386f0", "comment": "Malware payload (Mirai)", "value": "18954f33b01308f27f1a01e2c2fe6598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152938, "uuid": "7a413fd7-b3d2-4ab1-8d89-8c27d4d67099", "comment": "Malware payload (Mirai)", "value": "f271b341ac651d6db74b9febd5abbee3391f6c53a340b48588f451f071d850c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152938, "uuid": "a4b2e1a0-a630-4730-a83e-99d3cf434360", "comment": "Malware payload (Mirai)", "value": "318123ed9c67c2090024ce43177f831dd40745e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770152938, "uuid": "e73d0ff6-c243-44b8-98cf-b3ec6d036cc2", "comment": "Malware payload (Mirai)", "value": "2b38ea6f46b27ed30de719845a8ab037fada2360097e454bdf6d0da2eeb92399c2e3198e9b91487129277dccc5fb4de1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152938, "uuid": "0ce4727c-7a7b-40e0-9e20-8d6e790b014a", "value": "T1F533950A2E11CFADFB6C873447778E21965833AA27D1D645E55CDA002FA038E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152938, "uuid": "0dbb1477-a0a3-48bb-96a4-92c64b41bc27", "value": "768:aPkmfAt3jJBWkEG3TQZRjLDOsowzFIZDr/1xpm2+MMK:AujXX9SOpwzSJm2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770152938, "uuid": "58d462a7-8601-48d1-99e2-a361cab47ba7", "value": 52900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770152938, "uuid": "383227c1-eaba-4e34-a901-296b74d4d479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770152938, "uuid": "2e384f2f-7b45-498e-90f9-a844a1d8d329", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40bfbb5-00f9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770120869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120869, "uuid": "db51d263-11dc-4b8b-8ab7-9ed06c961185", "comment": "Malware payload (Mirai)", "value": "5a444b11ae8463bc8cffb42d974b8259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120869, "uuid": "66093f13-4f81-4a7d-942d-cf9b977fbaec", "comment": "Malware payload (Mirai)", "value": "f28646911f9785e1d4dd5c5c78f6034281d92b89f167392e28a1e065c3580538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120869, "uuid": "7efc687f-63ab-4996-99bc-737a1199a4d2", "comment": "Malware payload (Mirai)", "value": "ec8b1f2cb3b599716848b9790165d22925a41379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770120869, "uuid": "72bbff0e-ee2e-46c3-b8ea-37a0e2add9e7", "comment": "Malware payload (Mirai)", "value": "0031519071d7c027fc9815fdfcfc0c088727edcb127921b8f567137e6febc6b953dc5d4a630dd97e428ef8f68d982eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120869, "uuid": "1da5876e-fa0c-405f-baa6-e98918885971", "value": "T19E636C8BEA8BC6F0DD460AB0157BFB39DA3698303234CEB3D7D4F913ADA2541945625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120869, "uuid": "98fe8b7e-0ede-46b1-8f58-763c2f855e61", "value": "768:oXNUiMOyfhjatzPnG9tagfXRigS0xIKBsCt/+wQutIyZXNPMOFrtSOC2UIbmcLtI:hOyf0y9tagfXRit0xKuSqtSkBL5J4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770120869, "uuid": "d3b1cec0-41f2-4337-8469-c1cf9ef80e7c", "value": 68052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770120869, "uuid": "08c9b844-e1d8-4c67-a07d-d0eddf63328c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770120869, "uuid": "15528282-f852-4146-865f-cbbc1a5ddde7", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714f8670-00fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770122395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122395, "uuid": "0b268728-b936-4c83-a1da-2d0777e04107", "comment": "Malware payload (Mirai)", "value": "96410a0cb97ee798b080c3f629ed598a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122395, "uuid": "7aeafc17-cf25-4031-9f6d-78153dccd03c", "comment": "Malware payload (Mirai)", "value": "f2c1f37756a4ec6be30f624c4f2817ae73bc1b23fc3679004c16b4692be6a87e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122395, "uuid": "110c20f8-e725-43ff-913a-79efff3f833e", "comment": "Malware payload (Mirai)", "value": "53d49f13a2e9f48b67a14aeafa2dfb7863dd6f7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770122395, "uuid": "170604c9-8f3f-46b8-bd81-e8c3c5327e0e", "comment": "Malware payload (Mirai)", "value": "9ab2b7bafc5391cdcce1c4bb0ad8daad1f931b90ee74ffb2690995b2f6b30f046ee81e4cb85bb834afd3d0f645283d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122395, "uuid": "84494a4f-b8e5-45bd-b8fd-158c7667eeeb", "value": "T1EBC3851BAB202EF7E8E7CD7B91A59B0A249CA44631843BF57578E410B69744FC9C38F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122395, "uuid": "ae41928a-a009-45ce-930d-22ac4d68d619", "value": "1536:mkGrSD0+Pv8XfBjsyY7vmFWeVE1tidTcqpkRKYSYLdK6cRswBNsDl35z:mkGi0cQ5jsh7vmFWp1tid6RxwJWDl35z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770122395, "uuid": "3ebd5ecd-7b0b-4810-96b8-e90d505550c4", "value": 128888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770122395, "uuid": "aa7ccfc9-e2c7-4732-a8b0-5302becd58f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770122395, "uuid": "dd62ae56-0887-48e5-9a39-232cd2add5dd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1574de-0131-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770144725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144725, "uuid": "0ad82499-6714-4c08-b4a5-be2d0c764cf4", "comment": "Malware payload (Mirai)", "value": "82af93028bbda723fb171e9160625e18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144725, "uuid": "95aa1127-e824-4dce-a0bf-81473444d1dd", "comment": "Malware payload (Mirai)", "value": "f2eb51eaf6ec0d4e1293922014c2df9fd4fa62ade85fc2e47c56269d37c030ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144725, "uuid": "b2548b9e-4885-4475-ad2a-9bee635f9488", "comment": "Malware payload (Mirai)", "value": "0d819c59c9bf70dededd52271d3ff0a6c7447755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770144725, "uuid": "3c27db54-6a0b-4466-8aa3-7c8ae43b6f9a", "comment": "Malware payload (Mirai)", "value": "8949a58620f4d5d87aa899b1d9ca94fe23866f9f7501e65146b8baa73b789080ed021240f955ca8d020a5e1dd4b31e3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144725, "uuid": "995ef36c-065b-4fad-8af4-29ed7ec25e92", "value": "T134532882FC81DA03DAD02336BA5E51DE33257399E1DE3347AD126F213ACA91F0D6B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144725, "uuid": "f4d6ddcc-7029-4feb-8515-1588fcb458fa", "value": "768:EZ7F/p1PW0C7vB6A5LLAcH2UO1ytmUA8Vg1xmKFDs/po7bHeBNu5bpsqnZUZ2Fve:ENFX/CTQA5hyKmUA8QxRg/MbpsCRFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770144725, "uuid": "10180328-43dd-4035-91cd-f61a51433d2a", "value": 63756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770144725, "uuid": "ac941014-8cf7-4a40-b83b-cda07d06fcd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770144725, "uuid": "8665afb1-4805-4941-80ae-484873a844a5", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe587d05-00c2-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770097291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097291, "uuid": "67a7953f-ec8c-44b6-821b-7127dcaa3362", "comment": "Malware payload (QuasarRAT)", "value": "b318bafab02bb998475959580b441def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097291, "uuid": "a74eb0f8-dcd7-419f-aa36-6e6694bf7d6d", "comment": "Malware payload (QuasarRAT)", "value": "f3366871ead6f09c1c6b84822e3d919f1fb382329fc83959187f2b9b408cace6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097291, "uuid": "3aab87ac-3817-45db-81e6-12792304908d", "comment": "Malware payload (QuasarRAT)", "value": "d2df2ef2e8ce048ffb096a721b0aba901456337c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770097291, "uuid": "f666c32e-5bc6-4f00-a242-9645229d6f8f", "comment": "Malware payload (QuasarRAT)", "value": "dc24860c10b3f04b5f73235025b45c373735d1e6f951d85f1c8eaec83cc25cca6cdd2edcc6a5e360acfdcc2e445604c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097291, "uuid": "4bd75638-cb89-42f4-a913-9956bbdaaf74", "value": "T148E56B0437F85E33E56BD2B3D5B05026A3F0E82AF363EB1B519167BE1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097291, "uuid": "a011fdbc-0308-45f8-b57a-89e4a837c993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097291, "uuid": "450dec8c-17d1-41f1-b67c-a2beae609750", "value": "49152:ivBt62XlaSFNWPjljiFa2RoUYIoG/wBxZEoGdFI0yTHHB72eh2NT:ivr62XlaSFNWPjljiFXRoUYI5/9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770097291, "uuid": "57e97888-7c8d-421e-b9ba-3047a64fc064", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770097291, "uuid": "c79399a0-944b-4ea8-8438-00c25d38cc8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770097291, "uuid": "e08b4d67-14e3-4e8d-b3a0-3dfd9b5eb8a0", "value": "rekt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330c7992-00df-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770109405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109405, "uuid": "91872d1f-70a9-44c4-8ebd-5ac5f6b5a5d7", "comment": "Malware payload (Vidar)", "value": "629dd241f826cee0055ffcafee535396", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109405, "uuid": "ccbc5e04-c3d7-4026-8a42-48ee26e8d35f", "comment": "Malware payload (Vidar)", "value": "f3592b592ab43f7bb79cac795aa9f5a7440d0bc2e33afca2e65e12572a6dd976", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109405, "uuid": "e5e6ca08-226d-4eee-8334-794e6239ba36", "comment": "Malware payload (Vidar)", "value": "44dbd6231af624768f8de932044b4fff6a289577", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770109405, "uuid": "a9903487-280e-41d0-8e93-00181a25d1d8", "comment": "Malware payload (Vidar)", "value": "81caa84989a4c162c3a4f32f7aa1bec5801446371fbc5c60a6f87c2038d22a3746c1ed851cf0ce102a0e3635462a29b8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109405, "uuid": "5e884e7f-246a-4207-bc3e-22976f45290a", "value": "T16686297F729592A8C26D853FC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109405, "uuid": "aafb72bb-aa24-4a54-b132-2293b5dec473", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109405, "uuid": "4372f760-6479-430b-a43a-ebd1c5e7991a", "value": "49152:KNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczg4Q49dpkMHF/UJjeh:Kz7Vp7kQ49dn6h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770109405, "uuid": "7c8e61b9-7ff4-4a4f-a88b-9963f4a6a33e", "value": 8530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770109405, "uuid": "f98566ab-656a-48a1-973c-087e47050c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770109405, "uuid": "344f1761-8bf8-4ed5-90e3-3aa4bd1ab263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94bdf48-0126-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770140152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140152, "uuid": "2d3673ba-dc84-4ef1-a0f0-e38054ef5728", "comment": "Malware payload (GoToResolve)", "value": "2e03e001da1fd0460f6ce085ba60be60", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140152, "uuid": "216c4a07-ef26-41ca-9f7e-ba3baa69cfd2", "comment": "Malware payload (GoToResolve)", "value": "f3b6d745c69a2337c1c7c25c07450988f4aa6c74e82b9f8a5ddb5bab56d6353d", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140152, "uuid": "e09af5e8-1013-415e-a434-4bb1e7dd08ea", "comment": "Malware payload (GoToResolve)", "value": "5f41f90c0d6de30cdd376bc82f7bbbf24bc503bc", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770140152, "uuid": "0de59dc2-1416-415b-b8cc-016785db4ab7", "comment": "Malware payload (GoToResolve)", "value": "a1e772a9334e611a25ffc2e1f91748ced0f4fa7c908f2b8bb3b3b2656ed5c3b19a8d1df8c07bb31fedebcc82a4f60e8e", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140152, "uuid": "c24af7c8-25e1-44d8-b76e-b45be64fcad3", "value": "T1883733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140152, "uuid": "d4df9707-e559-4541-82fa-303bc1292969", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770140152, "uuid": "40b611cf-01b5-4cd4-8be3-7bcbe858df60", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770140152, "uuid": "98b85562-0daa-49b3-bbfc-ca4b36d69886", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770140152, "uuid": "7850d71b-68aa-463a-8d20-af012b1366f5", "value": "Rsvp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ff7e24-00b1-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770089783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089783, "uuid": "7b9887d5-0f63-40fb-81c6-920a4964c0fb", "comment": "Malware payload (GoToResolve)", "value": "19fe381bd9c60745ceba51494fb7b12f", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089783, "uuid": "e41bf2a5-2cec-4e3d-9012-74c49540b48f", "comment": "Malware payload (GoToResolve)", "value": "f3c65dcbc4e28765a1ebdbe77f7c363c30c61639862f1db4fcea1790ed0fd59e", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089783, "uuid": "caedcb82-e019-40d6-b4ee-8f530bff190d", "comment": "Malware payload (GoToResolve)", "value": "10624b43f47c527b3505773c85ff0b7c7b5b3c49", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770089783, "uuid": "4201d634-8aa2-405d-8f64-dad697dc613c", "comment": "Malware payload (GoToResolve)", "value": "448f5ed1f227a51af3a1aa6ce22bac51b423c1cdb218171b9bb24b5d1b4fb6f99d58e1b022873d287ee48b4e90a04d1b", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089783, "uuid": "c2e23851-a91d-44df-912f-9afa2fb96c17", "value": "T1873733173988C571C6AE01B25468AB7E967C9D210F7105EBF7EC7E4D2B303D36A3264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089783, "uuid": "ab031f1d-8af1-41f0-ac14-e949efb4f5e7", "value": "393216:OuH6t/ADslrnxHHiACqwWFgvUX0TE5HkCshd2t1Q7tDjy1bpJs8zoajmG4cKhuEf:tH6ZGsBxFCQEUX35dsAtO7t419mz+6qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770089783, "uuid": "216c9832-2dfe-4e07-b4b2-036d182cc178", "value": 24526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770089783, "uuid": "78e09af7-3f0f-4621-aabb-8d9b72edffa8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770089783, "uuid": "78a589ef-7961-4e21-9183-c2201356664c", "value": "LogMeInResolve_Unattended.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2985ba6-00fa-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770121270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121270, "uuid": "b26926ad-db39-41e4-b016-692742efd2e2", "comment": "Malware payload (Mirai)", "value": "c04999b15ca2d6f03c37a3e67641e09b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121270, "uuid": "9f90bcf6-2393-4820-9264-e4edfd3fae96", "comment": "Malware payload (Mirai)", "value": "f419112ecb752170cf2e117417d2b1e3c18c80d14eedee75f7f80c81e68272a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121270, "uuid": "eeb8c42a-e54f-4d66-9666-dc9d8422438c", "comment": "Malware payload (Mirai)", "value": "4c5f62fc70891879f32a90e236dfc839b1d184fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770121270, "uuid": "79f8ffc5-3f28-4975-84b5-1464ea624394", "comment": "Malware payload (Mirai)", "value": "08547591a8ab5f9810775f2066713936fbf1331ad8d75dc8aa5612dd42e27021ed157dcba12cb08ca64772b91bed42b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121270, "uuid": "7f639df1-c079-4d22-9fc9-dc518af0b6b5", "value": "T1AE939549BFA00EB3ECABCD3746DA274415CD5A2621A83F75BA30E818F51B64F25D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121270, "uuid": "b60908d7-ee8d-47cd-9487-f4617ec6457e", "value": "1536:uz+hvk31PhGEnDtLIE4sx8BO+nGF+8HNZJ3N9SiF1:ZhvklPhGEnDelCNVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770121270, "uuid": "4f2fe123-b51b-4a24-9580-6aa3cc1c0eb8", "value": 93212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770121270, "uuid": "ea683fa6-d5e4-4619-9e9f-0e6e35a86b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770121270, "uuid": "c4c53dd5-dbe5-47af-9ca2-ebdd1125e391", "value": "mao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64a90d8-0112-11f1-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1770131503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131503, "uuid": "dfa27e72-5e59-4d85-9db4-71c8818f4e3d", "comment": "Malware payload (Efimer)", "value": "2ad853e7d7cbd737a426d53f3bddb6ea", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131503, "uuid": "f9d97365-70b7-44de-8158-ed4a7a63ec23", "comment": "Malware payload (Efimer)", "value": "f474493288afedb13f3d1c2674829890b8d312a57305e0f166c9b99a5701cff3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131503, "uuid": "53033b93-c4bb-4f75-9649-fdf1bed8c33b", "comment": "Malware payload (Efimer)", "value": "edd910f8b6c7a9a46060d25608c6e90ffeb9cc9b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131503, "uuid": "174f4a47-c0de-41af-8df5-3396468c6343", "comment": "Malware payload (Efimer)", "value": "0ada15727e26e621c2f30963aed51a22f7537eb081764793be99b1513f1cab06c7c069643835c5dd1b26b2cf97c15db1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131503, "uuid": "6193d48f-6737-4f93-9b9e-3c9ff2f2ea07", "value": "T14BD6334C6AE041FED9B3907CA9D26B81E47474770372CADB47E4C662AF571D08D3AA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131503, "uuid": "fbada315-258b-4d5e-8d25-9451c9cbb59e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131503, "uuid": "ee840735-ee50-4b47-9f7e-5429782ceea6", "value": "196608:JEQFOD8f1kja9+dTm0Cin+7v0YlXMCHGLLc54i1wN+HfPIcu9KYK39sI3PPkuMRB:qDIKG4Tm0C+ajXMCHWUjwcuI3/PkuUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131503, "uuid": "2b8707b2-60f1-4841-80eb-2e6dc8ea6399", "value": 12761088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131503, "uuid": "4bb8d65e-2bc9-40d6-a21d-fe9a82c52aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131503, "uuid": "03e3cbc9-c37f-4835-beae-508b0a954394", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb014846-00a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770083112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083112, "uuid": "f4f66fa4-cfbc-4111-be4d-bda43c2e7b84", "comment": "Malware payload (Stealc)", "value": "76565275b37afedf37d01a80121ae298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083112, "uuid": "a6676bea-9242-4f70-8e5e-7a3dc4a368bf", "comment": "Malware payload (Stealc)", "value": "f5558153c2b08cf60283e923479bab91b5de7c1fdd2810e259c7754e97fc1abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083112, "uuid": "65fcb78b-0ef0-472f-948e-9e858e5e492b", "comment": "Malware payload (Stealc)", "value": "ebce96351f4facf2629392c57c75d7e46abab7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770083112, "uuid": "8dc1d4fa-1540-4029-b5dd-baf728abef08", "comment": "Malware payload (Stealc)", "value": "9367fd08b7a4f86b66852a7268869a46a857345abc1fa8c75eb163421b1abebf6221c6231d1c81eb326251a664d96132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083112, "uuid": "9d66a1da-8fab-457d-86aa-b62441361497", "value": "T1AC461852AC9945ABDABFE13490A062617631359443313FD71ED81FBA096BEC4273F32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083112, "uuid": "24f84dd6-e42e-4e9e-8806-8fe0cac7c44a", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083112, "uuid": "5469d806-b82a-44d8-a9db-0c71cb8f2900", "value": "49152:v+z8N2PfVzX7gsbQCCrodb0RpQERF0/H//Vop6WxI76svS6Ns13IxzDPOTyOtJlp:E8sdujF0n/VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770083112, "uuid": "6aea4d84-60cf-4d41-b658-9f88c67c3273", "value": 5398144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770083112, "uuid": "c9bb62da-60ea-4d4a-9506-20693be3e224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770083112, "uuid": "0a44819b-8f5e-435c-b7da-00bf531257c5", "value": "xf5558153c2b08cf60283e923479bab91b5de7c1fdd28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a64e3fa-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128691, "uuid": "fa2485ab-53d8-42d0-82d0-6638b4f96ecf", "comment": "Malware payload", "value": "8425267c858281d93946b2fc76e28154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128691, "uuid": "a977bea8-2a0f-4837-a176-dad6af6d13b5", "comment": "Malware payload", "value": "f55e609705f4df21e8f950e5f07529b31c8b1d5984ac25e05ba14b89e8b1e6b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128691, "uuid": "b7101088-ac38-49d6-bae1-0b399dae0455", "comment": "Malware payload", "value": "2eaab9e5944aa1d7e737ee77aed1c8486623e318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128691, "uuid": "5a4160c8-448c-44d8-ba49-1ddcb02f9a6c", "comment": "Malware payload", "value": "05efd524fb778e8f9fb7fb852cbc3be17966997b36330f2ac2b654cedb9a61d9df80447f066856541bd0d346cbba466b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128691, "uuid": "b0144ac4-b2b4-4022-a7dd-6a72ac8bee33", "value": "T1117623AE654D3358D06E83744433BD09F2B9826C59E8D5AAB3DB7B9037E3410DA0BF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128691, "uuid": "3268cc30-620b-40d7-8c77-b644564087ef", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128691, "uuid": "48d536d1-3791-4b9b-a70b-9c874a829759", "value": "196608:c9PStADLIiTa16Y6nEg2sMepq9YORDspRmXd/ciXxCRvz:cjPa16mg2s3pq9YiDURmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128691, "uuid": "b5343e0f-fd5b-4f85-b5a8-3144ec471d3c", "value": 7752704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128691, "uuid": "a9da5b06-ee0d-434b-b01a-297ac6eeacc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128691, "uuid": "2d931b39-7e01-448d-92fb-c37e1b90bf1f", "value": "SecuriteInfo.com.Win64.Evo-gen.73954522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2268bc-0118-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770134170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134170, "uuid": "75ed584d-76a9-4b81-b2b4-b541e41694ed", "comment": "Malware payload", "value": "5a2abaf9b1d6b4800121d4c437b3ca0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134170, "uuid": "eda599f6-e8b0-4c2f-b876-9f7c949abe8b", "comment": "Malware payload", "value": "f63662ccabbe1ab19fcff423fb040c6e748345798b3d7d5bf511f97de73b21ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134170, "uuid": "518baa2f-9cec-45fd-8cda-37d964804c8a", "comment": "Malware payload", "value": "5ef5cf46e62f4e2fd809004b2e145b48309d6daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770134170, "uuid": "1b283b63-c040-4a14-8f5d-9a02aac9a884", "comment": "Malware payload", "value": "4d05a3415330c4bf85c2ef32327e3e7dc08baf2082a4efed39a8bce1084db2e429a0d2521d69f5372981baf2232afe1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134170, "uuid": "fd2ff11c-ee12-4a02-aca8-b05578896602", "value": "T148040182B7509FB1C275923100F38B52FBFA13E62AD056666B3CD9009F46B9CA54FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134170, "uuid": "ea113f50-57da-4dcd-b22d-0ada5b3ec566", "value": "3072:kgfKVeEOH4lcgjvpftVUKOHxdOHGMr8CxkGwnqWarCbgzROyB7Gc:kbNR1xftLKdK3FkvkCbgzRBBqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770134170, "uuid": "daba6011-4170-4658-b839-dbbcbbb4fcc9", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770134170, "uuid": "3a51643d-9a8f-4125-b6a9-eac0efd02997", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770134170, "uuid": "74706477-b203-4d3e-8988-bf265fc5d501", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef368ca-011e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770136806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136806, "uuid": "105eb84f-f5c2-4deb-bea0-a6a360a03a8b", "comment": "Malware payload (Mirai)", "value": "62d03948d342b31b9808a69f208dd119", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136806, "uuid": "8359e217-50b8-4fc1-bb37-a1ac25abb9c7", "comment": "Malware payload (Mirai)", "value": "f67c66b6e0cf80b0546171bc249b825601f1078f0df6fb18402441eba65ad610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136806, "uuid": "0ca201bb-c437-4c05-9deb-d2e64184df61", "comment": "Malware payload (Mirai)", "value": "2a9cc3b9a64e602f36985e9be494922c4c515ac6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770136806, "uuid": "8813e664-df0b-4af5-9c17-08e5a85ac351", "comment": "Malware payload (Mirai)", "value": "e128f7ea98040bbb3eb85d77928d4ec80e54f7ead3c3862130c9b6ce750bd262247ac0665f6ba361b6d10f209fe9a9df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136806, "uuid": "7390dece-abb5-481f-adde-607be7f42aab", "value": "T115C2DF84E185CC05DAEA24F13D48E6DBFBE42F2F29758EC06B9492C56E5C3639385DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136806, "uuid": "ed48cec0-79c4-4024-80d8-fb79de65447d", "value": "768:1VdafO76jpmNJJKehmA7trpfIX9KeA7PImgA4uVcqgw0reto:dam+AnKehPRa9adgA4u+qgw0rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770136806, "uuid": "6ce167b9-e7d1-4cbf-b804-b5ee35b53cbb", "value": 27556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770136806, "uuid": "9df89b88-c5cd-4112-98c0-65958520e95c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770136806, "uuid": "b3861fa9-feef-4cbb-80ed-cd670fc7e482", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ab656b-00ff-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770123186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123186, "uuid": "b6897949-9f75-40f0-b7e6-b18babe0acd7", "comment": "Malware payload (Vidar)", "value": "1446c7f617e54e5ad3314977e5fe03cb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123186, "uuid": "2b12a08d-6222-43b0-9d2f-7421d8706452", "comment": "Malware payload (Vidar)", "value": "f6f27e6e1f622b756c836dd34b9dc105d2fb8b0ea2ba09eb9c7d44810e69b7e6", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123186, "uuid": "82157df6-501e-4cf2-8f3f-08e3fe734caa", "comment": "Malware payload (Vidar)", "value": "578a187d47554c0db6ee1f3c1f8b773c6c98f448", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770123186, "uuid": "bf837074-eed8-4507-bec5-9a90a49b39d7", "comment": "Malware payload (Vidar)", "value": "3362fd9f4406d113724bb1cb6ce86f59a44078178defc49f66dcff79883457064848f71c23b3ffd617a08fe727e864d6", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123186, "uuid": "8ecb4eed-ec64-47f6-bff8-4dbd2a4e5d26", "value": "T14E86297F729992A8C25D853FC0A7CF40F5F372761B33C6E7129007A98A468D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123186, "uuid": "a25c49a4-c4ea-42c5-a8fa-f0d0cc380f67", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123186, "uuid": "30039e71-e6b8-410a-9132-aa0687f6db4b", "value": "49152:cNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgNQ49dpRMX3cx0vLc:cz7Vp7pQ49d4cEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770123186, "uuid": "f126a9e9-9dbc-4897-94ad-c43b8569cee5", "value": 8572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770123186, "uuid": "f5775ce5-e276-4bc3-ae0d-405b5ed1c300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770123186, "uuid": "edcf713b-418b-4f07-b8cf-1c85e8785730", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e04ebe4-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143274, "uuid": "a22962b1-c71e-447b-8b25-9f8d75bc32cf", "comment": "Malware payload", "value": "b6343e20ef5795bef9317b1f1912a6da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143274, "uuid": "30a890be-e832-4e2c-b52f-095da2342cd3", "comment": "Malware payload", "value": "f727c0262b9ccab3969e160f8558f112bb7c999473223d3944eb670014ae5a8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143274, "uuid": "82bf00e3-1c05-4cfb-b574-29d52977d8fd", "comment": "Malware payload", "value": "d7abf6b0f7101a157444eec99d78fd5898d7f814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143274, "uuid": "e1743151-3fc7-41a0-a8d9-1e2faeb74619", "comment": "Malware payload", "value": "1741e3be7325d4c3fbcefba4fe807affb0e1f02b1541965066933fe09951d4384d3fc59773a423fe8da640bcd41c64b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143274, "uuid": "5b6e634f-0e72-462b-8a7a-da356f9803a4", "value": "T13ED3E0B9F080EB22C1C3A57EF69D551873170379E7E53201DE248F24B79695B4E3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143274, "uuid": "a25f0a61-4b8f-412f-adf2-8c62b6bbea5e", "value": "3072:rponhnSMawhwacGWSGeThLtbO3RZ5SZ62plvmPnusKdxe2V:rUhSjwhwynTdtbOhZ5SZ62vmu/bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143274, "uuid": "7db9662e-4243-479d-b069-e91a241b2782", "value": 141438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143274, "uuid": "160c88df-0ff4-4d2d-9fdb-fd7b5134cf16", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143274, "uuid": "ba62eba1-027c-41ea-aadb-ebefd7140370", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655b83d3-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101759, "uuid": "59331c03-66ef-43ce-85d4-8b5e655c79f0", "comment": "Malware payload (Coper)", "value": "5c7d8c54ae7fe5320358989e903585df", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101759, "uuid": "a1f76ec7-ab4d-4df6-a653-f38bfd407bdf", "comment": "Malware payload (Coper)", "value": "f7a9da64386f6c02c3911c73ff6754118deb3cae20e52abfb85bbc855b404aca", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101759, "uuid": "fa85ba6e-866f-4d80-8797-69aeb4cd0bb1", "comment": "Malware payload (Coper)", "value": "16de20b58984c5b4848096965796f10e2b4a0b85", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101759, "uuid": "1a2e3794-24d2-4fa1-939e-bb9cb066ff22", "comment": "Malware payload (Coper)", "value": "6278e9d4bc0c2395b555c32022ea8bb14ce81171f2c1aae76330bda426b3df3bae298ec7a05eb814b32607c6c550c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101759, "uuid": "f70b5ac1-e21c-456b-ba19-c66bd31a8f82", "value": "T113451242B3A4CA07E5BE6B708C5BC3E091357E44CF0212976A91775D1EB33C68E67B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101759, "uuid": "916835e0-6bed-4345-9d35-fa61c91092be", "value": "24576:GBYo2ukD0HHnJM/SQewu0D15LVLQP10TDkHMZEU4SINKR3angdkLUhN:GBjHHnJM/+wu0bLNxEsZTVTdkLWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101759, "uuid": "9a03f768-2e4f-47a3-b30c-b238c4369947", "value": 1172715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101759, "uuid": "78e41e65-c04e-4a1a-85c3-f99df934b79c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101759, "uuid": "33db81f8-9d1c-4361-ad90-7548042dfe1a", "value": "5ecc3cd_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87454ba-0153-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770159505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159505, "uuid": "173c3fa9-1a06-4721-99e1-78a324d04101", "comment": "Malware payload", "value": "c126a40421282998d195a56b1deca44a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159505, "uuid": "27a6b353-d46a-4f25-bdf0-cb8c4eb78082", "comment": "Malware payload", "value": "f7be8d2bed84b6477e37a0ba20546cd6e88f39b71ab47783e5237112891f5882", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159505, "uuid": "040a05e1-e8fa-4547-87c3-5a0b8e5ef3f2", "comment": "Malware payload", "value": "b9b3157c79f39af8eee6417be27ad3f9a9c07ea8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770159505, "uuid": "77a399f7-36ba-4a2c-8c59-5c0e2dc74cfa", "comment": "Malware payload", "value": "f4feb2cdeb5a3ebcd3cca69b4aaf4ce248e3aec932f5f6707a43fad53657f4bedcd78d9dcef8489a97af617b95ecf188", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159505, "uuid": "629871e9-f133-4527-9399-a37f084b3aa5", "value": "T1B5C2286E07E605FCE91A82F5C8316417D370F44A2EB1668E4272D9D7EF426C2AD2C785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159505, "uuid": "1fad6f29-911e-4994-bff6-f7b9ca0db629", "value": "67b2e05b342c56b6c89451a62cc934be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159505, "uuid": "1a57a4ee-8623-4ca3-a545-323704d70e3f", "value": "768:JNIikyGe4EJYAAbFsukvZpk2AmzJKqYNd:X9GepEkAQ+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770159505, "uuid": "f59b67f1-7764-4294-ba13-db50ffe83b4f", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770159505, "uuid": "3eb20e8c-dde6-4e7a-81bc-424bc918825a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770159505, "uuid": "c2faee43-6b9c-46da-a351-af425aac722f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a2fc66-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128675, "uuid": "b22ec120-16f7-4653-9814-c21b1e468a94", "comment": "Malware payload", "value": "e53020f21a093b10dc156d7f073b9cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128675, "uuid": "bc6eaf08-e9a4-46cd-b888-f12dc5219d18", "comment": "Malware payload", "value": "f83134edd4211e5071de66d13b8b8e0fd0b33254ddb7faee5bbf8a87310fed91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128675, "uuid": "b291fb8c-a6d2-4861-bb5c-5ea644439952", "comment": "Malware payload", "value": "13e1173573496d648c673142e7742b9d389b3c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128675, "uuid": "18d07257-322f-466f-98e0-63dc36cbb862", "comment": "Malware payload", "value": "fa7efbab6f7d626435878d0296a33b585eea143ff29f6ff1f2e36ab07bfed380834754957b43f24651c6d598297d5aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128675, "uuid": "b0f4352e-ef38-426b-a869-c266cb6e711a", "value": "T15676237A714D3358D469C7744433A908A2BA425D8AFCD47FB3DBBA847BEB420D907E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128675, "uuid": "94cbd123-fe62-4706-a8d5-2d7076ba6752", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128675, "uuid": "3c3b4af8-13bf-4178-a612-486aa6543d5a", "value": "98304:TY9rO+MhCXPHZS0zfe1aK1zl1NCd3GebERawoNqGP0qxsHKkpP/d/E6+VknwN:TYHIWm1J1zxC1bE0woj23Zd/L+Vkna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128675, "uuid": "631ba7c8-4eba-4b2e-a7f4-171236933cbe", "value": 7761408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128675, "uuid": "bf96bdcc-ce37-440c-ad5a-93d33e6ffda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128675, "uuid": "892a7fe3-6754-491c-98cc-a736a3734a67", "value": "SecuriteInfo.com.Win64.Evo-gen.59895773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acc402d-00e3-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770111217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111217, "uuid": "dd45b19f-8c04-4973-98ad-1680da92867f", "comment": "Malware payload (Gafgyt)", "value": "b2be3355bef007d50ce496801780b8c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111217, "uuid": "5c62c11f-220a-4526-82c0-16c79f66c14d", "comment": "Malware payload (Gafgyt)", "value": "f85dfa80b8b20dfba45e8679316542875e00093242be3e5a3541f2baf89a31d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111217, "uuid": "83725476-ec19-4c5a-bc61-63e3fc3e1d0b", "comment": "Malware payload (Gafgyt)", "value": "3e83bc1e97fab11db9685c093d74f4c85bbac561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111217, "uuid": "cb12b96d-ee50-4454-b18f-411bc891bc0e", "comment": "Malware payload (Gafgyt)", "value": "7f20e5eb6734d14d3beaf186b79096a6a02dc67bbe0f157f59d12085fc94eb1a05f322ed652749854f149bf8fb67d8e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111217, "uuid": "82c428d4-e0c2-473a-8867-5d2f167f5f26", "value": "T188148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111217, "uuid": "29144728-d76e-4438-b6aa-3a209bdbee2a", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dj8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770111217, "uuid": "e4f5618e-d3f6-4fb4-a2f3-5ab6f1e3e66f", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770111217, "uuid": "03308a7b-bdf9-4dbf-b51d-d7e68a5439bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111217, "uuid": "df1ff635-8969-4f37-8928-0fcf6dcbc5e1", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b950baf-0129-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770141364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141364, "uuid": "82f3ca9f-84ef-4365-baee-ca3aea24566a", "comment": "Malware payload", "value": "95c4e8e4c71e1334b25d03c8e1879bf9", "object_relation": "md5", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141364, "uuid": "fb3d1c09-a4f7-453e-b805-d3441d72be01", "comment": "Malware payload", "value": "f8adab24b3352864dd42468f92d7bfcf4e4843f14b103818fd48ba736d64f844", "object_relation": "sha256", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141364, "uuid": "d30baef5-086a-4ed6-b8b5-9feb7dbb3f1b", "comment": "Malware payload", "value": "d889a1740e4ad6cce418bce2b2bda6de48d73660", "object_relation": "sha1", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770141364, "uuid": "4e389e0e-6163-4870-8ed2-62ff1f9c2a75", "comment": "Malware payload", "value": "ef39d7cd8a183dd750a6f4474d45dec4c2931eaf679aed4604b40dced7f516f3c69926039746505616f66fb3213223fd", "object_relation": "sha3-384", "Tag": [ { "name": "chess", "colour": "#B9C45A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141364, "uuid": "ccebaff1-cd2f-425b-9d1e-5f12faecbbbd", "value": "T10814191BB39318FEC61BC03982E79772A532B8151326EF6F0595D7322E60D384E69D78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141364, "uuid": "a9586a59-33bd-4a1a-bb91-9b0699305bb6", "value": "a6dd474b8a29fde95a1f1d38ac756f36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141364, "uuid": "6e08ce0c-cb15-4308-bdca-6d5cbb504a0d", "value": "3072:V8pQTHPeB8uKVWseOdPUWpwa4hIh0fpHIUNpA8Pk:V4QLlWs7tAhIhGpIUNpDPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770141364, "uuid": "aeab5170-b9f0-444f-a323-f0ac2f9b1b83", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770141364, "uuid": "40430417-5ec6-482a-8cd8-0cba727661e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770141364, "uuid": "198367ca-83ab-400f-8c3c-d0b2801f6861", "value": "f8adab24b3352864dd42468f92d7bfcf4e4843f14b103818fd48ba736d64f844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffb75e3-011c-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770135787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135787, "uuid": "191f4740-8bc6-474f-ae21-c8a4cad4838a", "comment": "Malware payload (ConnectWise)", "value": "f5921094cabf9f6099876437c24d9d66", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135787, "uuid": "b31bf22d-7eb2-48d8-818a-c8d6b743c58b", "comment": "Malware payload (ConnectWise)", "value": "f8bc8d622722c56b1a486955640a40343bd734aa9255f8620557dd72466241a2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135787, "uuid": "b6eead41-8a76-4e76-92e4-2729a158a8d2", "comment": "Malware payload (ConnectWise)", "value": "29077cb39dcbf525f2c251670c78763cd7c68299", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770135787, "uuid": "df4bc647-751b-48d6-b7d5-24aa6603ef71", "comment": "Malware payload (ConnectWise)", "value": "c7d1af99c1caca290e14305ca933fa0041328ae09a443d72ec8a796a2de74461b9fae5d26cfe34a25054cb0a73ea6ae5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135787, "uuid": "04d5d892-d2a1-4303-816f-0858ebe66bcb", "value": "T1E0A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135787, "uuid": "a99b9d00-5eb0-4f32-9b3d-94ef025b87ac", "value": "196608:rKaLNkbgIi4QdKaLNkbgRKaLNkbgdKaLNkbg:jWgIiHxWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770135787, "uuid": "74c4c847-2352-49f8-8eee-e2525bf21a51", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770135787, "uuid": "17e9bde8-be53-4f98-b96d-9ee964ee446b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770135787, "uuid": "ca81299b-376d-4295-b635-1c5c528ddd35", "value": "f8bc8d622722c56b1a486955640a40343bd734aa9255f8620557dd72466241a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9a63e5-0113-11f1-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1770131787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131787, "uuid": "932dad78-7d3c-47a7-807c-c0bf470dfc55", "comment": "Malware payload (Arechclient2)", "value": "e545648047ab49e631c283949b0bfa6d", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131787, "uuid": "d69d1821-87f6-4900-829b-3c121c7c346a", "comment": "Malware payload (Arechclient2)", "value": "fa002c3ab542a7567030f32290ad749bc68a36fdd8fc67448cd7904446b35426", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131787, "uuid": "5bb9e655-408a-475d-96b9-cb1b60863cae", "comment": "Malware payload (Arechclient2)", "value": "f22b2e965d9590fd2724ba66977c6f846b3e6c5e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770131787, "uuid": "7af46149-8273-4687-a13b-af6e010c870b", "comment": "Malware payload (Arechclient2)", "value": "cb9d3f446a330c04ce6aa30393944ca5803a912a71b654dacf7b46b8cdb2eda917dba0dd95c45ac8662eee1df0addc5e", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131787, "uuid": "a2b106c3-67e7-4c3e-a7a3-e71176c6b684", "value": "T156A54B21FF078AA34AD622E3C6A76558CD71D39EE76234CCF2D88287359CD9942C497C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131787, "uuid": "c0c7d4a9-9707-4bec-b456-196f7a0fd1f4", "value": "12288:bkqlywP15HS2KuDst+o+x8DYGeaz7TqvplYlxQWWgXuL5DvCd0Djb4DQJEsO/Gqz:wg15HSODst/YG3KvplexS93LSQdqf3h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770131787, "uuid": "957cb2ae-7c5c-465e-b5cf-0e5ca9a4741a", "value": 2211928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770131787, "uuid": "1a882e89-e82f-4a30-b3cc-be15eeb05c39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770131787, "uuid": "083af143-64bd-4415-ae7c-476e0daaefa6", "value": "malacca.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053eb400-015c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770163016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163016, "uuid": "73e7af31-ccc5-4c28-b986-40b1f8c88dd6", "comment": "Malware payload (Mirai)", "value": "1dc18a4e62b4550845d0a852933f15b4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163016, "uuid": "ae863397-b7b2-4abb-a31d-d94224790549", "comment": "Malware payload (Mirai)", "value": "fa87c723cba46f5e1d708d97d5eb79fd4f10ff0acebfc9187c8baa30f5bcbd0e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163016, "uuid": "394921fb-4388-4171-b4f4-a7f129aa73ed", "comment": "Malware payload (Mirai)", "value": "0dd8af70e041b7c42af26d71b398fe0a525979e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770163016, "uuid": "b7f03011-5e42-4fd5-8b5b-a6ec78c1d3bc", "comment": "Malware payload (Mirai)", "value": "55b05f047bbbe92cd41c0f45190cd25a9b42d8e12e61c9c3fd6fd96d87f0445df2f0a6980483ed53d39f236059fa9b2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163016, "uuid": "c138c57a-cc31-4610-b3de-77d8822dc28c", "value": "T14791C2E57478977A2DA1ED7372D6C582F18072AAE5C90D0AE3D2F0E4484DF61FC84A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163016, "uuid": "4418b1d2-5c80-40d5-b928-8415d542af47", "value": "48:vnuMV4kCnt1V4OnrsrWV4ZnCoV4HnEWEEV4Ebn2kV47nt1V4OnpZV4KnASV4pnQx:vrInD1c/AENEpbNarHjRBsTCrB793t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770163016, "uuid": "4d18bfef-f996-4efd-8e69-3eb3bf5ea670", "value": 4453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770163016, "uuid": "de8377f4-02ac-4eb4-822f-f378d7684f4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770163016, "uuid": "b5637d79-1a83-4e1d-a067-236ee1e4a79b", "value": "76d32be0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a86ab78-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101794, "uuid": "5713e666-109e-4145-8aa5-c1de9039926b", "comment": "Malware payload (Coper)", "value": "3a7894158568751a1368f8c4852dfd89", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101794, "uuid": "a09627fa-38d0-437a-b1cb-81f8eec25767", "comment": "Malware payload (Coper)", "value": "faa774978f43368357f553a1e45a2f9465fcfa50c6c09dbf6004304db03bc641", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101794, "uuid": "b4e99698-1091-4f19-80a9-161ee9cca41f", "comment": "Malware payload (Coper)", "value": "b976946bf4b7c14ab16b9a3902b741b3667a23c8", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101794, "uuid": "b999484a-8868-4099-826f-437ffc550a99", "comment": "Malware payload (Coper)", "value": "a424d8f3ceb4639e92b30207979fc41ff5193d6c579c7e1f54390b673f96b19d720b317716a1e66f1345747c65b16039", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101794, "uuid": "dfc28f81-02fd-4b86-a01b-edf7660161f6", "value": "T189451242B7D9CA62E8FA27388E1B83D496207D50DF01535B7E81730D1D736C68E26FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101794, "uuid": "2c8314c7-7acb-42c7-82a0-8ae051db033d", "value": "24576:yEqHqsHBdnSjJW/PdsPLCD5Gt8iWpPWvaOLynIiUeMrG:yEQqiH8JW/Pd4LCD5G4P8LjZeMrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101794, "uuid": "f1ffd9d5-eb04-4569-b2fb-2ac3ef3ee399", "value": 1176799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101794, "uuid": "2387ab8d-b9e1-4c34-9a86-8e3887aa6e2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101794, "uuid": "f8e355fa-a980-48df-8453-b5b47af48206", "value": "ea1022d_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6373b4-012e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770143276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143276, "uuid": "8d10bac9-84d8-4239-851f-0d9873768982", "comment": "Malware payload", "value": "038b0dde7698235ba60b00d72031c70e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143276, "uuid": "95d4b0fc-9dd8-494a-b3f3-693938be610f", "comment": "Malware payload", "value": "fb77dd5db6d1beac41ea306c85006ac160d60502671e07b1a94557a4add54b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143276, "uuid": "d0dbaee1-6c16-4448-8da1-bddb77668595", "comment": "Malware payload", "value": "954aaacbe604466552d5ba5a0d9c7b389b481502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770143276, "uuid": "751f234e-7c66-4d45-9965-f810e26c6b52", "comment": "Malware payload", "value": "75ce060335e945c25dd295a333460b6afa69f4b39c902de991b5aa6a02b7fcd560359b20f2d687644092384725748f61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143276, "uuid": "ad8a2a0b-5863-4a08-a7ec-182823127dfc", "value": "T1E6C30141FAE381F5E4874232486AEB9A6779AF350044CFDAD2447F65F8E2363521E29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143276, "uuid": "c304c7c6-e669-47cc-953d-9ed505042598", "value": "3072:rOlNTZa+Ef6jCnEwtQV3qJhKo/GMHO22mYAtkF31BcXKZJ:aPGfcL5KhKqU22DAtbXK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770143276, "uuid": "d90bc43c-e7fa-4d45-991a-c0713b205d74", "value": 126957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770143276, "uuid": "14f18cd8-2ac0-4217-941e-3f8419ff5aaf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770143276, "uuid": "1106e01a-3457-41f5-a4b6-81c2d066c123", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf4340c-00c5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770098253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098253, "uuid": "b7a469ff-a688-4497-84ca-e627ac1596c8", "comment": "Malware payload (Mirai)", "value": "b223b7a574e8952ad0d7550248d08861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098253, "uuid": "ed0cc4fc-a737-47aa-84d5-dd8856c77f96", "comment": "Malware payload (Mirai)", "value": "fc28869500ef2420fcf189475b71b3819c79b005a007e0fb12c7fd3d3a17a384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098253, "uuid": "c3a78905-3d9a-49d9-bfec-2f6202bec0a9", "comment": "Malware payload (Mirai)", "value": "f1918eb7f98852667775898ad6c83b94e3d2ada7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770098253, "uuid": "e03bd210-fbb0-4a74-936a-2b37e0acc09b", "comment": "Malware payload (Mirai)", "value": "2bd199afeb0270b30c24b0f6aa964b44ace2133b146ee831fd8959ceeeb2504c33dc44b3a928188d180b7f6c0306b486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098253, "uuid": "d1f9e833-2fd8-4fdc-8c37-c4bd42e9d137", "value": "T15E040846F8818F11C5D522BAFE1E118E33132B78E2EE72129D146F247BCA96F0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098253, "uuid": "1cbb228c-a847-451c-98ba-129a5382f5d4", "value": "3072:8kKpUwiS7Yy104ARUDvv+oXHdJALpnaUhpxJmWaHN9coE4wbZnP:8kKpT7YcdARYeoX92Lp7hpxAWatFdwRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770098253, "uuid": "ecab706c-9408-443c-b4f3-bc67cc3e1a07", "value": 188764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770098253, "uuid": "389d41ad-cdfd-4e9b-9316-660f1e1cbd43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770098253, "uuid": "d8951216-8505-41ca-8f5e-05830af9d11f", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ba832f-00e3-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770111336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111336, "uuid": "c5268566-8bb8-498f-8b7e-d5743c497edd", "comment": "Malware payload (Vidar)", "value": "c07678d6fb9b035ba14147a83cf876d9", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111336, "uuid": "a3697b5f-8184-4b16-ab3d-5d512e1363db", "comment": "Malware payload (Vidar)", "value": "fc56bf646d2bbee49b4679a1aa65f069fcfa24f4e0be7e354ad9acb5ed161cc9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111336, "uuid": "e32f9722-d42b-45c3-93f4-8c48c4420b4b", "comment": "Malware payload (Vidar)", "value": "d18c04257855cb0b03061f6a72dcfdd250c042f1", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770111336, "uuid": "e4c661e4-0f5f-4efb-91d0-26d5bd736f72", "comment": "Malware payload (Vidar)", "value": "6ce118d3a7661b44c6f4ab629dd41e300b9e449e4b0e6c2cf4b5a7f146e47664c40e49ee9fa5e610e41bac86388ebe52", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111336, "uuid": "daf893f0-ef62-46da-bf7f-2ad9b3d0fee0", "value": "T17286297F729592A8C25D853FC0A3CF40F5F372761B33C6E7129007A98A4A9D99E7E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111336, "uuid": "a0f402ad-8e60-417b-9d8d-f72d500bb986", "value": "f47ade0a3340a3f0a680f27aee4992ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111336, "uuid": "dc911c63-ee54-49cd-bb3e-35ba052551cd", "value": "49152:dNmsz0dK6ix/yNJb8eJ054ejlMNkrTeSvxlLo7MH5CjXmczgKQ49dp/MGYxHA4T:dz7Vp7GQ49dmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770111336, "uuid": "9cd2338c-f686-44e9-a06a-720de6ddae79", "value": 8544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770111336, "uuid": "bab75891-fc50-4b3e-a9bd-9457b960deb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770111336, "uuid": "f7344058-9265-4b03-a11e-fcb9c1029ad2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b6e297-00cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770102828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102828, "uuid": "619f2d1d-9ee4-47b8-8571-647d8870d164", "comment": "Malware payload (Mirai)", "value": "8074599d0e7fb51085462056a7085c98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102828, "uuid": "491386bc-675b-459c-8385-5455180e8a12", "comment": "Malware payload (Mirai)", "value": "fc95793bd7860271060530b9c522f418f3acf0fd56124dbce52d5e14a3ce0da5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102828, "uuid": "36f73f7b-0a22-44fe-8a62-a28f6ef163a4", "comment": "Malware payload (Mirai)", "value": "324cc72c9134fcb0671499c42322b2e054e76e1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770102828, "uuid": "c4828548-2ab7-4f60-8454-20e1cef434d9", "comment": "Malware payload (Mirai)", "value": "a52d47593b4562fc0b20f6cecc56a1dd1d5763682be870baa129d289d3d354057ef4a986afcd831e88cba3c62e0b6855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102828, "uuid": "7748c3d3-f51b-4bd7-b583-c4498f83ceac", "value": "T18053024222ADA467CDD41EB5F8F04C852D3CBBF8A4E935FA726D457DC8C8422B688D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102828, "uuid": "89cd3803-160e-45b4-a820-2c636d74cc22", "value": "1536:bRPjtl/CW74TC5t3kDdqd3nA2UYIDEdt7ftRyf0IFEPnA:btjtH4TCX3md0nBUY/pYf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770102828, "uuid": "ae8a9460-8f69-4399-a4d1-5945ce707374", "value": 64820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770102828, "uuid": "8e37e9bf-672f-49f3-a957-c7323d350362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770102828, "uuid": "0478cd23-45ac-4f92-adf2-e89b648b7e24", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0f226b-010c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128667, "uuid": "3750f556-12f2-4ced-862e-fb57290c8c27", "comment": "Malware payload", "value": "854b9f101e9bad5202520e52b33fb35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128667, "uuid": "815b5b4c-f8da-437d-be7a-5c4849423b76", "comment": "Malware payload", "value": "fc9b8839db9483094290903d2347d6fcbc12504e54c29194afd76a8b050fe1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128667, "uuid": "92a8cd97-8185-4a52-99a3-c4b70df73fff", "comment": "Malware payload", "value": "435adae2df5e736e5a6123dd151ab782871a322e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128667, "uuid": "e59bc59c-27bd-4ce1-8b6e-2f07c55a9bda", "comment": "Malware payload", "value": "00d6211cd1a60a4aa2963d3b9ae9d5d71b10d38d5faa8fec679f7367aad6b60d37513b54f79f110d6ca39762d66ef34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128667, "uuid": "0b0505c3-673a-478f-877b-4efa0d7cb055", "value": "T1317623AD625C33ACC41E8B784033FC06F279512E99F995AA76CF3794379B020DA87B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128667, "uuid": "a88eb359-f483-4a2f-95d0-921cebf12e72", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128667, "uuid": "ed0afdac-97e5-4baf-80d0-dc07a8639ff9", "value": "196608:pzbzGc1vjuYWYCaMz3UsjqJs5IKBrra06:JP/1aJtaetWGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128667, "uuid": "05ed112d-deab-459b-bf31-41a02c635e8f", "value": 7766016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128667, "uuid": "46883257-44a7-4efa-b609-cbb3e06a194c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128667, "uuid": "e041a8bf-4097-40f3-b67d-363c474d6aa4", "value": "SecuriteInfo.com.Win64.Evo-gen.99862754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc18397-00b3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770090631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090631, "uuid": "6db279fb-c182-47b7-ba7e-983d68d7d920", "comment": "Malware payload", "value": "e776de5a5ab104ba814d6a70c27ecc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090631, "uuid": "191ba61a-df39-4d81-a7ce-c000e5f2835a", "comment": "Malware payload", "value": "fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090631, "uuid": "437d0d61-7bb3-41dc-9ce0-dbb84d66932e", "comment": "Malware payload", "value": "9c0eff4deeb626730ad6a05c85eb138df48372ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770090631, "uuid": "90b160ea-c62c-4afe-b02c-28f64a92ce2a", "comment": "Malware payload", "value": "6c6c57e02a3eba3e641b93941fd57adb94a5615f60e0bdf41dca966e116e61bc6d47713ff3f8105ccccb85cb5bf075a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090631, "uuid": "173260f9-bed2-40d5-91ca-35dd6383a413", "value": "T1D3C3396873B9C0B9F1768278C5710A05E7FE784646209FAF03A4CE572F636918D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090631, "uuid": "65c74118-3488-4c81-adc2-5e984cea4b36", "value": "41473acd7feafd3d0f6d0317b6baa5e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090631, "uuid": "0b508dc5-0890-4d16-8aad-ebd38d650ef3", "value": "1536:jZl6m72TgIqeNom+InYAz0CJHFL+SG06U9vrkUdnkxzZywsWTmRrdF9dlYEIyW/q:jH6seKSfFHF67fKrk8kxJa1P7W/LpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770090631, "uuid": "2a0525cd-d673-49f6-8a81-9b8e8cdb8de8", "value": 120416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770090631, "uuid": "9263ea10-2d24-49f6-b54f-c4043d8b5e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770090631, "uuid": "cdac74ce-22ce-433e-b9a5-26f7d3d4e7ed", "value": "_fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6451a8f4-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101757, "uuid": "9be05b3d-0be8-4599-921e-c8edd0dcae28", "comment": "Malware payload (Coper)", "value": "f459cec769d8801a401d7d14b589c42f", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101757, "uuid": "6ad25da0-95bf-4ae5-99c3-ec2991a060f6", "comment": "Malware payload (Coper)", "value": "fce8298e4849d80d2191f1a9cf430fee0de57c6448501f544b17a0ce7c1f01d4", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101757, "uuid": "b6976db8-7267-458e-b3b7-0016bc218e83", "comment": "Malware payload (Coper)", "value": "005a46930f0416f624e861470b3602f4a793df1f", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101757, "uuid": "a840db8d-b38d-43b0-9c46-b33885f16b43", "comment": "Malware payload (Coper)", "value": "62dc26e62c7059b236f965c2d55531cf253ac04b62577bde5ca8d9d1dcbd5ede81e76988ac9b62fc21856d38dd620a4c", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101757, "uuid": "1b5dcfa7-11d7-4c2b-b878-afd6af1cd3c4", "value": "T104451242F3C8C612F4AE6B384C6B92E5A6307E81CB0152673A85735D49B27D4CE27B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101757, "uuid": "77c92ae4-39a6-4618-b740-899786dd8386", "value": "24576:8onBcEvkrXruX+kJ84Wh8HhKoIxASRS7KoDtxUupK1qlCNGfh6/UUK:8UcEvmXCOeto8HA6+O3pKUCEfhyfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101757, "uuid": "45ae1970-fae1-45d3-bcb9-c9e845a07bbf", "value": 1172715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101757, "uuid": "050732df-f755-4745-858c-abb145a4395c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101757, "uuid": "42107b01-dc0e-439a-939a-394db3171d74", "value": "5724fb8_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac2eca8-00cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Coper)", "timestamp": 1770101768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101768, "uuid": "b76e0c3f-d0e2-43d3-99eb-80b263cb1a73", "comment": "Malware payload (Coper)", "value": "0fe27fe047519780959e65f6c8c8c02e", "object_relation": "md5", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101768, "uuid": "cf0668a4-5a64-4993-bb57-630a2b48d570", "comment": "Malware payload (Coper)", "value": "fcf61a8a80a61ffb6c29ae60f334cbb9d9054026576a873b9d1a71013c8d0737", "object_relation": "sha256", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101768, "uuid": "83019c2a-2149-410d-af91-3417265c62a0", "comment": "Malware payload (Coper)", "value": "8383913046af5dfa7b2360f4e3e1893f80f92647", "object_relation": "sha1", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770101768, "uuid": "17dc5ea1-9beb-424f-ad49-e3b142b23fad", "comment": "Malware payload (Coper)", "value": "b2aea3711799b675961c9f1da60303396f7b568416e112edf98e64fe458a6a80fdda05d8413466c564b0c3720a3e1f27", "object_relation": "sha3-384", "Tag": [ { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101768, "uuid": "be88e241-6005-432e-864a-23f8641cfbe8", "value": "T1DF452201B7DC9A13E5EE26788D2646D596307DC0CE1092AB2B81B32C1E737C18F76F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101768, "uuid": "8958d708-0e47-407f-85dc-e7c09f81d597", "value": "24576:XZ/XEABhs2FmRpLWw5JeuPcOqeQyN34qdgpuB7WL9wMRpnPdqJ+It:XZ/Xfcr5PPcD+NHdgpuBWL9wKBdI+It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770101768, "uuid": "661d8894-781f-48bb-b23c-47e3526ab335", "value": 1176795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770101768, "uuid": "c97e8919-65a9-4e2d-9755-99290c67c571", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770101768, "uuid": "0c7be1e5-efe7-4497-bcbc-c3d895232ea5", "value": "8524dcd_foto_9W", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f180276f-010b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770128623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128623, "uuid": "cc0127d0-b38d-4b4d-a184-274112cee298", "comment": "Malware payload", "value": "f8d8f7cd9271e2b9184e7da99555f522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128623, "uuid": "73d5c21f-64d2-42f0-8b88-71b8997d262b", "comment": "Malware payload", "value": "fd4836adfb22704eda3f001a15d2a127bc18a17aef9b57ec0bf86e3ca8353645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128623, "uuid": "60e85221-4075-4cde-addb-804262339aa9", "comment": "Malware payload", "value": "4418fe34269f8fdd2401a0502e9d604af678c8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770128623, "uuid": "412ca820-aeb9-4ac0-b173-5e7e1bcda4c0", "comment": "Malware payload", "value": "8940aeeb54f5d3bfd753082eb4fdf64f86a5cad8a95e40ebaff04aaa58b9a7da131139b35bfe79ba71da1d0fb5ebce22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128623, "uuid": "f3d10633-d0ab-4ac4-b800-f9ecc3a2299d", "value": "T1CF7623EE604C33E8C01EC7349823F845A1FA901D4EF596E976DB7BD0379B821DA46B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128623, "uuid": "ab85cce0-142d-4bed-b5df-10d13473c001", "value": "8d65b9d7081029a76508e347044a63db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128623, "uuid": "55547bb3-0b1a-4151-b18f-86613bb62a84", "value": "98304:4qDLArC7V4UPdfW+6Jcb7aUwvry4XY+h2zaX8bYKWgFusSbTm/huhozjAY0p+DBo:tcGXu+icCrvrdXY+gUk9yxhCp09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770128623, "uuid": "0672b839-d8be-4d64-8ef9-8955b4444cb2", "value": 7765504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770128623, "uuid": "0628396f-4ebc-433b-a981-74b727c060f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770128623, "uuid": "a4def830-cd8c-400e-a182-a54d4b9a45ec", "value": "SecuriteInfo.com.Win64.Evo-gen.81388947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf7210d-0121-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770137687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137687, "uuid": "76688b2e-f2ac-4f2e-a8f1-eff422ea7d30", "comment": "Malware payload (SalatStealer)", "value": "b2dda91b3a3c9438225649c0abe7b390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137687, "uuid": "04dfa45e-620a-48d6-b36e-73957fb4ddef", "comment": "Malware payload (SalatStealer)", "value": "fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137687, "uuid": "378c5f14-64c3-4dc3-989c-58f7e55f1c2d", "comment": "Malware payload (SalatStealer)", "value": "06359e903da9070d854a10b9322ae666dadfa51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770137687, "uuid": "a58e28ad-bd5b-4847-987d-f473119b4c7b", "comment": "Malware payload (SalatStealer)", "value": "fc0bf2c45aeb89c9dfcba15190b26d4d95482ceb7f215ed13c67bd9ebc97bafd8861ee0961c3a731392a4a93153b839c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137687, "uuid": "5c0b4b27-66ff-4e58-a6b2-c2c7adb30390", "value": "T1A8E5339094A4D94BE63DD43176FC5B123AAEC822D4ED098BD8D1414582DBBF8B38F58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137687, "uuid": "3ab54261-e098-47cd-8a70-56a506eb267d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137687, "uuid": "d0a5c5e9-d634-4dc9-ab93-bc375b9ff7dd", "value": "98304:oX9L0PFi4l/AiKBIno8HAHUII7jONzV1G1:oX9sFi4lIiK6HqUtwRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770137687, "uuid": "fdf46534-b52b-4463-8c69-dd48545618f2", "value": 3298304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770137687, "uuid": "fddb8931-cf0a-4de9-a06e-754fd50a7015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770137687, "uuid": "1687b825-586c-4bd8-973f-ec3e14a9670d", "value": "fdc247689570055e117be90bb8d8ff47811e414c9ebf52d43fa0bce6f27efd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e13c26-00bf-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770095658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770095658, "uuid": "a51067bb-b9de-48ed-90f7-9b7872d2aed6", "comment": "Malware payload (Smoke Loader)", "value": "3cce535e0bed7a0d9471b09f4fb8d57f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770095658, "uuid": "f284b898-29a6-4f8f-acd2-70af7138174c", "comment": "Malware payload (Smoke Loader)", "value": "fdcc3d417094c32b9bfb9f012173ff0335f86518c789b0ef1d8c12504cd9cf5b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770095658, "uuid": "de3dbb3f-e034-462e-b41d-27c6214fd22c", "comment": "Malware payload (Smoke Loader)", "value": "4378110b951aeef92808c90fa78688d32accc720", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770095658, "uuid": "0a2c8f05-c560-4464-8f6a-0be6510fd46a", "comment": "Malware payload (Smoke Loader)", "value": "d1df3f4fc92470e2dbba6fcc6bbf936381180d5b080c64864a51c0d6c8108b20b269879b31117d0c13ed69d57b2a6138", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770095658, "uuid": "725e2314-ddff-4e69-9b0b-7fce8c8b53f2", "value": "T15126D012253C60E2F98952B2D04060091AA4FDF9468F04AB69B4BD493DFBFD73F5F866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770095658, "uuid": "63993535-7e2a-42a0-876e-4cc427ba9686", "value": "4fdab10359a081f74b3e821db34c941f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770095658, "uuid": "6f8c2f73-df4b-44d1-9a82-83f96c6834ab", "value": "98304:NFYBDHNOQFbpFiUgL/AjgjCDe9Id9V5zfJ/AdyAGnhIvk:/aDbTFiU7Az9qV51qXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770095658, "uuid": "54e6bb0f-b293-4317-b15c-914ba71e0380", "value": 4829344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770095658, "uuid": "95043c3d-de56-4184-92b1-72c6cdad24f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770095658, "uuid": "be487f06-e1a7-48b4-96e9-84f8c7c37ea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d491d3c-00ad-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770088001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088001, "uuid": "8ad092dc-4bee-4d27-a823-129409a417d8", "comment": "Malware payload (Mirai)", "value": "c7c7872a44aaea9cf981dbb14c78778c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088001, "uuid": "0ded9535-26fd-47fe-9223-c8a0b8c8722e", "comment": "Malware payload (Mirai)", "value": "fec0c195adaccc779c260cb13fc89d645f57b63ba1557c60699c8fbdb3d1fbef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088001, "uuid": "81472dd5-6042-48dc-a51c-03868073d6d7", "comment": "Malware payload (Mirai)", "value": "d1e0458f1f8676803d2642c179e417c9a2e1c824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770088001, "uuid": "99ae7a63-9409-44cb-8a24-9525ed895d18", "comment": "Malware payload (Mirai)", "value": "2964efce36e0737ce814b363b3e4044b349280d12d0916212ccd59d84ca573b7f5b9ad3e1708f2e9ad78d0bd2d8ab312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088001, "uuid": "8564ade2-cd0a-4aee-8410-526f4b1f9292", "value": "T14383B44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088001, "uuid": "3cf3af9b-b1bc-4d54-87c2-e4c13e2f6517", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+B:N0bY7lmZH0iL5iNl5GKjVXz3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770088001, "uuid": "3395c1a0-5386-4059-afe0-5485ed96921b", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770088001, "uuid": "24b50542-cddc-4e5b-8b08-61a8675bd806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770088001, "uuid": "d3443d6e-844d-46b5-addd-b34d0e47ae86", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cb6ca1-0140-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770151257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151257, "uuid": "90b7331c-ffce-450b-a2c9-281633fc0f71", "comment": "Malware payload (ConnectWise)", "value": "b434227054d945a7519025f4d80084f3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151257, "uuid": "9ae44b53-e3aa-49f2-a34c-c7350baf5bf3", "comment": "Malware payload (ConnectWise)", "value": "ffe6b7bc86ffd0b259981742759684adcdc101c87e47bbb50541ef8eba276731", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151257, "uuid": "aaae94a2-6c7a-4387-a611-51a6b2f79383", "comment": "Malware payload (ConnectWise)", "value": "6474f2fdc0d5a28b25dc37dac1139b27985971ba", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770151257, "uuid": "4210eaaa-5e62-447f-915d-7252bda12339", "comment": "Malware payload (ConnectWise)", "value": "f0e3442566cc586012040a10d205610b3f2152658bbdbc7537d4e5c47dd1286c97e8c765f9ae56193b6b5788cf8c2782", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151257, "uuid": "e3c4971a-bb04-4767-a32a-5019c22bcf11", "value": "T176A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151257, "uuid": "d7bf10ed-5b1f-4637-8861-61c93255a6eb", "value": "196608:gKaLNkbgJi4QjKaLNkbgRKaLNkbgBKaLNkbg:mWgJiH7Wg1WglWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770151257, "uuid": "64eb0f1d-14ce-438e-b3c9-4bdf17bda7b9", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770151257, "uuid": "bd9f10fe-69e0-400f-9b8c-28599ecbba50", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770151257, "uuid": "8037538e-4ef0-46c6-b80b-9578734edace", "value": "ssvwinery.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }