{ "Event": { "published": true, "date": "2026-02-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-09", "timestamp": 1770681782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "895e696c-9798-4d7e-9ff8-4adef0be25f2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2199e630-0582-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1770619189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619189, "uuid": "8380c6c4-daf0-4d9a-96e8-03fecaac9c47", "comment": "Malware payload (DarkSideRAT)", "value": "ae8f347e5a86651e3b020c3e7f8ca0d9", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619189, "uuid": "c8879bd1-f83b-47c8-9225-d8c5889a2585", "comment": "Malware payload (DarkSideRAT)", "value": "0005626a93719fa8620cf1ed3be816cbb80f11d4b8e99985f25bb7e3175af6a0", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619189, "uuid": "6d69fa97-c717-4652-84d9-4fa9dee58b76", "comment": "Malware payload (DarkSideRAT)", "value": "904b567ad0517797e4ce8fbb50aaf2d130c9dd2c", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619189, "uuid": "b8a1616d-2a0a-4318-b8d6-7ba0b6b88205", "comment": "Malware payload (DarkSideRAT)", "value": "b26d141a278b8031897d6e635b2f709e1b4f550b725e7cdf0b965dcc34d63195af7da4202eed41900bdb4db9d2041001", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619189, "uuid": "97cb9660-4b15-4570-aad1-6ae28b7659ad", "value": "T1C9C38D4677AA00EAD0B6C13EC9636A02E7B9FD169762D7DF4710012E1FB23C46E36B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619189, "uuid": "10d8b0ad-a340-4591-b6aa-cab46e07277e", "value": "e41db91f69aa8eedf1ddb71b901c4f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619189, "uuid": "2d1accd7-d73b-4225-8575-287bbf0b34a5", "value": "1536:6qjnB/BRwNXcrBgfrRdiQWzj3FKDPU2QIcCi2+Bx:6qjBcNXUBgfrR0QWzj1K7QTP2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619189, "uuid": "e2184057-b1dc-43a7-9672-fd822a4f98fa", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619189, "uuid": "f2528d46-13b6-4134-b0dd-d8d0aa2ea436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619189, "uuid": "797f627a-44e7-499b-b514-a5aa4d508b1e", "value": "darkside.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e4f070-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770623679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623679, "uuid": "6d8d3242-82b3-48f5-80a0-333340028945", "comment": "Malware payload (Stealc)", "value": "73aac0a6b040be4475ad6cca1b67ef44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623679, "uuid": "79abf28c-c395-44d2-a28b-5793967ea4c9", "comment": "Malware payload (Stealc)", "value": "00757772d873cfdf11241fc390c5ad2d2b3a27648656fe6ca502b12d9598cd6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623679, "uuid": "6f89fdaa-0297-40aa-9a76-d76b94b12474", "comment": "Malware payload (Stealc)", "value": "4b304b99541f8650dcdfbc94945377310c92528d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623679, "uuid": "da14fd01-93ca-44f2-8773-2a6b0f48656f", "comment": "Malware payload (Stealc)", "value": "a470cdd789eb5a5ed4cbfb3e9c77091b13871f31d62990333d35584118a8e5459747a053aef45108ca8c6316e88d8e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623679, "uuid": "e2ae0962-1162-40e1-b5ae-3531c096005a", "value": "T139765CB2F89509A1C67FE13498605E91763138680B3E7BD37FA815660D2AFC46B3FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623679, "uuid": "2c907560-620b-47b8-b3a1-a5c175905024", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623679, "uuid": "e5336998-8e5d-4180-952f-d1a0e86344f7", "value": "49152:lY6zC3+h/OzVX4dZEKCDfMY9BAJ2mWDj4kqA+c8OK1do:rC3hVITPCDfMA9xqwUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623679, "uuid": "6677a9a7-edcd-46ff-a83b-64261d18215a", "value": 7240090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623679, "uuid": "3658bbc6-8507-4908-a09e-e0587323b510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623679, "uuid": "fd18c9b0-4b5e-4a17-b004-4b3c01963365", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca034734-05bc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770644382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644382, "uuid": "f97423f2-3bb8-4a77-bb83-3266bf7b84bd", "comment": "Malware payload", "value": "8090eb445c3526aba6f73220f98d2376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644382, "uuid": "fde79d58-3295-4a30-93aa-1b320ba53107", "comment": "Malware payload", "value": "00a22dc8a9c7fc5a72ce60eabae3304607e45a7212dcf20cad9a0e657fde8092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644382, "uuid": "ad7f86dd-ad83-4982-b935-ba5259d925fc", "comment": "Malware payload", "value": "21452be8ded257de50d778973a1c0e74dc942778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644382, "uuid": "b4f24b3a-ffa9-4dff-a11f-09c7fdd2f795", "comment": "Malware payload", "value": "3b5171b08dd6cf744b3afd01a547673614c1f9e408b7be9c30226b4801a0631d56a891fef210b20d6f0b7f6db306caef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644382, "uuid": "dd53a226-58dd-458a-bc5a-80fae9d7bb8e", "value": "T186A63368B244CF14ED1D2F39A062692047E37D0A7E76E20E990875E89FF33C58857A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644382, "uuid": "561d3f68-f00b-4a12-809b-41718d67cb89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644382, "uuid": "c585768b-7a48-44bf-8f22-61692a7c69e7", "value": "196608:vcgAVhu/TvcMO41d1eEgcjGAuY2/fkMd2mTnj544IYN0oAu:DKhu/rcMOw1BafkY1BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770644382, "uuid": "95f05a2b-6d1f-47c5-926b-f287f0269b05", "value": 10266112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770644382, "uuid": "aef19ade-8309-4ca9-8c40-766a2e318f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644382, "uuid": "0eb897a1-53f0-4b1b-8286-2ec8ee4d7cf1", "value": "00a22dc8a9c7fc5a72ce60eabae3304607e45a7212dcf20cad9a0e657fde8092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9822c042-0554-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770599631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599631, "uuid": "92d393de-d389-4ac8-ac6a-335ed23106e3", "comment": "Malware payload (Mirai)", "value": "58951d3693eb07f54b6c64bd6d5dcb8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599631, "uuid": "9b0b1cda-9172-40a4-8c48-dc1ad5e46fc5", "comment": "Malware payload (Mirai)", "value": "0156eec51060fbc9375c9c9317ef9a191e334f97751a2402f84d15a1e559dbf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599631, "uuid": "7c62f7d5-547f-48e0-9bd7-94e81485b10b", "comment": "Malware payload (Mirai)", "value": "ee08df071d6da05194927bd58c939195b3bd8182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599631, "uuid": "cc8ba655-1539-4365-b767-4afc9831a948", "comment": "Malware payload (Mirai)", "value": "b967177542f344d74369d809c30cdf50fc1ea2ef9c05f5b409155ff44b1097593b857c95986d3a4544442535aec11367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599631, "uuid": "e5f19677-a13c-4526-a1a0-43cc389053da", "value": "T1C1B39DABF24756A0C8228BF007CB4BDE3E2323819F5785E73D2D667918761CB5D06B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599631, "uuid": "6483f1df-c2d8-4527-a4e5-0f970d1ced0b", "value": "1536:/Iyf/rKOZWLK2jRAtENq/2gdloH7Xw5mtVpXLEwIRgO1//LWs:/IW/rtL2dEG02ceKmtVp7EZgOZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770599631, "uuid": "81f3e47a-be77-49a4-aa25-9962897900e1", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770599631, "uuid": "95855c0a-d23b-4d90-bddd-2627ee624ead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599631, "uuid": "31f51967-6add-48ab-a933-a710596667d9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6d2e3f-05b5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770641410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641410, "uuid": "807bbc9a-e1ca-4da8-a84e-a2b11db740d5", "comment": "Malware payload (Mirai)", "value": "4c786fa2b3aaf134f650ff41bf6f7336", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641410, "uuid": "8f164599-c7d3-4c92-92af-825267e039b5", "comment": "Malware payload (Mirai)", "value": "02135d7778c96e309879b8d1767ea6a7e0c19dd39b04f8239fc2187813cfc9cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641410, "uuid": "31d3c7a3-69b3-444b-803e-da36eb0b14a6", "comment": "Malware payload (Mirai)", "value": "5bbaaa0e2865a1157da9bb1f8bdcb01ab28f8bfb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641410, "uuid": "3a141afa-ad19-44f1-bdc2-f44f3127b3eb", "comment": "Malware payload (Mirai)", "value": "f33fcd37a09386b9185b5998c0a662c79b878f85b2852bfd3e868e7a882c741448ce55252ff497a94b19ecdaf2172dff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641410, "uuid": "6ff2a251-5e16-484f-ad88-8df9ac081662", "value": "T11541BB5D7424CCB03C59CD3D6AC62609A88A475FD1177A48716F982E3F34168F1E86F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641410, "uuid": "3ae1e0b6-091f-4834-a14a-128145cc1968", "value": "48:QO0u9YIt2PPqlmtmKTe8kw+ryPyP70HHHOHwD+:h0/It2M/loKP46b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770641410, "uuid": "6b9d78a8-bc11-46b1-a8d2-2857c2a68748", "value": 1880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770641410, "uuid": "b47ea974-d89c-4c2c-9854-bd8ef42ecd09", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641410, "uuid": "f76dd3fc-2220-4af7-b924-d71b83ac15ff", "value": "6354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fbb3fc-0551-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598183, "uuid": "0710cccb-7939-49ee-a08e-757819d778f6", "comment": "Malware payload (Mirai)", "value": "2e2510b66051e2722e419b3929d3e6ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598183, "uuid": "49bdc54a-f720-475e-acb5-097b55f50762", "comment": "Malware payload (Mirai)", "value": "031cd3a09434757d7cc09f55db714f0b30b1e467ddfa65d412a3f468e4f105ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598183, "uuid": "a938b837-b749-477f-ae29-c2e62ae982eb", "comment": "Malware payload (Mirai)", "value": "1bdfb1380d0300a80c52410dcd4c1e24f08a3491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598183, "uuid": "3a475489-8b6f-4320-bac7-17aefda855ce", "comment": "Malware payload (Mirai)", "value": "5791cd12ce8f9523191037a79bccfea6192f2afcfe872ba99f9228f8deecbbd82b0b2c511870e1b4910c7cfae4577989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598183, "uuid": "8d3fb899-5663-4233-aff4-f0c6a225e902", "value": "T178734A24A97D2E22C1D4A17B12F78722F2F5230E25B4971D7C760F4FFF64680685A2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598183, "uuid": "de87290f-476a-4b3f-98cc-0b31c4ae4128", "value": "768:8HtoWsQnUWgPvgeh6/7de6A1eFpxQ+Y5ZcqVhL3EqAWszrEcGdd8gItzu8MX45O3:ktpFUWgPvWde692cqHL5AvzUcU8MXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598183, "uuid": "e6dd8500-bf6c-40ca-983f-854b1f7cab33", "value": 76600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598183, "uuid": "3bdeaf04-6dd4-4d57-88f1-9bd66db7877f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598183, "uuid": "46a084e9-b0bc-42c3-a5d6-79c09b50f139", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5455747-0587-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770621611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621611, "uuid": "26e6039a-1733-44a7-bba7-6dab219b3ccc", "comment": "Malware payload (AgentTesla)", "value": "bb1ad87d9146ded82a0f8127d17cda73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621611, "uuid": "bbd93105-e657-4321-9d85-354476c07fe3", "comment": "Malware payload (AgentTesla)", "value": "038751dde5f769f52ba480bcec531c48faecaaa2657c178fc31eaf84ec9d9419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621611, "uuid": "d16fa8a2-61bd-427e-b4ea-15c1bdbbdad1", "comment": "Malware payload (AgentTesla)", "value": "37cdfacbf5e180235b3933d053fe4ca2fd45c2a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621611, "uuid": "5c6d1ede-e580-4caa-bb07-e1c75e0a56eb", "comment": "Malware payload (AgentTesla)", "value": "df0a3bffddbece1523f0469160393889721bb40228fc5dc623a876c0c80e2a7ff6ca0d08403e5b881bf7a3b7d86cf0b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621611, "uuid": "3d5d178b-8f9f-466d-9589-09a29e09f326", "value": "T1F26586949F9E48BE92025BE398575D74FD1FC3DFE162565E3E6200CE8E403FA8369224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621611, "uuid": "a1693dd6-7bb0-438a-8c0b-4247e1666757", "value": "192:pGrWVR9FixMX5t+XwI1Mewlcd2FLEBTYtqdIf3DmX/sFaRIf3USfbAjEtRua/dPP:+d46SbGkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621611, "uuid": "64bfade3-8b62-4109-846a-ad41df41989f", "value": 1452668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621611, "uuid": "cc640bf8-09f1-46a3-a96e-cfeb70c33a12", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621611, "uuid": "8a9d57bc-7407-4717-aa39-4bae27c7564f", "value": "PO5R-W#YJK3NK-L2XC7CVWTUI.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fae2d6-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646466, "uuid": "29e57a56-57c1-4206-8c86-db0433c08beb", "comment": "Malware payload", "value": "f3eaa78dafc7c353f0cb800fb7227dcd", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646466, "uuid": "ec349c88-f978-48b3-9580-3af03c13f1a8", "comment": "Malware payload", "value": "03dcce1996e4acc8fb45f24e5f3aa3e5bad57c34ffe823699aae7ff6a7ff2f38", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646466, "uuid": "7c759bb9-d90a-433b-abc0-7d5b9f9a2f96", "comment": "Malware payload", "value": "772c01a3980c18ea45a34d8efb258f3e7b8292c6", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646466, "uuid": "d07cf582-4df3-4000-bc60-7962f1377867", "comment": "Malware payload", "value": "00e19443641a8f195b41a9e63cceed00f1a97f58e9a26b0c7fd8fdb96c3b1384e46f16e89102c00c27f76a73558c17a1", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646466, "uuid": "c1023a71-b4d5-4880-9e23-43623cf0fc86", "value": "T17BF27C16768F960870B3464C5AAF02744B6F7A9E0D7E418A00CDE68A8FE3514DC9B7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646466, "uuid": "b825e482-30eb-40db-885a-96456041fbf5", "value": "384:FOpAn5sJ9zjXd+afP9UQokGVgzrctNHzp9ftM:FOpAn5sJ9zjXdDfP5okGVKrctNHzpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646466, "uuid": "61500f68-e4da-4d60-b2d4-2028f161e988", "value": 36860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646466, "uuid": "cf1d1331-9e9d-454a-bd5c-e18b2e20350c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646466, "uuid": "23821665-2a85-48c9-a9af-d776bffa9029", "value": "03dcce1996e4acc8fb45f24e5f3aa3e5bad57c34ffe823699aae7ff6a7ff2f38.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190d74fd-0589-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770622181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622181, "uuid": "63215c39-acd2-4663-8395-7ecf4b4b1039", "comment": "Malware payload", "value": "71bafdb8216fe945c83f4060cf8a64ac", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622181, "uuid": "f271bccd-32a7-4f28-a08d-322047e652d6", "comment": "Malware payload", "value": "04ada74617075ff5a74fc99bab3d82e992e8b846b2bc94a80234076f6d8ee5a2", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622181, "uuid": "a9bde438-8fa5-4679-9e11-b6abf7a18d3f", "comment": "Malware payload", "value": "16b2f830cddc534a31a015ef2a40192a776a7fc4", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622181, "uuid": "22b0afab-0cd9-4897-b5b9-3aeffd5b929b", "comment": "Malware payload", "value": "d4e262176346fea096cf0c0a06a60dedc19452dfca03fa5f837ccbdcb84976bef35375a2cded8a95c12fc0ec5c3cf7cf", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622181, "uuid": "fa44fbfd-2a9a-456e-8c9b-288289f9f038", "value": "T165E423BC3185F991FF4528F916B85464EFEED2D309B02529B49B10EC70A8B78373865B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622181, "uuid": "dd9c28d4-f24d-4db6-9fbd-18fe4de58426", "value": "12288:DBKwQONj0CXtPpPL32WqTaw7coGt9ruAq6zRsUwkQzW8LdG7OwLzCT:DUUL2W2rco+986Ko2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770622181, "uuid": "20ac0809-4061-416e-94aa-ba9228051259", "value": 662603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770622181, "uuid": "9e7505db-342e-4feb-af30-61a84707b7d7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622181, "uuid": "ada9c08a-326c-4fa2-af9b-4dd4cf3a4a6c", "value": "GoogleDriver.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e24063-0605-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770675624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770675624, "uuid": "5608c9cd-95ed-46c1-8095-24bb65401556", "comment": "Malware payload", "value": "304e3d4c78f71fda29077783c00110de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770675624, "uuid": "a5e0851d-64a0-4a6b-aa90-f490e42f8e34", "comment": "Malware payload", "value": "080d9b47226aab86e5a82cd90237f4d3d6eb6b3a284cd70923734106ccbd4d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770675624, "uuid": "5dfced30-6e39-4c0d-b0f3-20a7f8df9291", "comment": "Malware payload", "value": "35f64fc093bbab7b36feb35eca3a6a7b8545892a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770675624, "uuid": "1329259f-b6d1-4a88-839c-feefdc33c553", "comment": "Malware payload", "value": "3a045ae96d97f4cddf2256fb55c64df8ffe62252e6caab6a592f4a678cdb84088dfffd7fe7fb905487dbc2f8f148fd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770675624, "uuid": "90e72978-ef36-4d48-ba75-4c685821c4c2", "value": "T14DD31963E88184F8D82AC57889DBD23E69E3B8811538754E5DE49F021F72B74F31DB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770675624, "uuid": "8071f5c1-6b38-4df6-b424-7ab14c60c98e", "value": "eb4720678f1423a954b890626f95e475", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770675624, "uuid": "b371a88c-906b-4fcc-aab3-10bb32e738dd", "value": "3072:NFUGQSMjLhVQhw3HjKBGcW2oh/0q+6G4ME3Y50:N+7SuLhuhGHjMPQ/e4w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770675624, "uuid": "98cf9773-b443-4c7f-822b-4dd1aa25d52b", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770675624, "uuid": "d1e52c46-ee2d-48eb-a700-870067f27ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770675624, "uuid": "e4ff2efb-6750-4b3f-aa59-5bcef3875189", "value": "SecuriteInfo.com.Win64.SvitStealer-F.72718717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea24b881-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632410, "uuid": "2668fcd2-22c4-451e-abb8-79df7f973751", "comment": "Malware payload (Mirai)", "value": "4d3e7b81e8c5a2ea0dc50c92128945b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632410, "uuid": "92657573-1428-499c-9640-23837d751f6d", "comment": "Malware payload (Mirai)", "value": "0848a71ff0609de5c6c68e7cfdd768b078d353448f7e77314a8081157c8cf0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632410, "uuid": "7cd0769d-7a4e-4183-8927-96cbf7a3c58f", "comment": "Malware payload (Mirai)", "value": "d55012632f72b83c0c4b4a2fe5e96e169dec5b4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632410, "uuid": "80568353-8aba-4aed-aae7-ca8539e81376", "comment": "Malware payload (Mirai)", "value": "7db7eafe8d2f2e419b839fd6520f1a75c66d656ee098198dcce51414dcd3cde5486f9c420ecf110d1c339bb75c091bd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632410, "uuid": "21ef8e60-3ffb-4588-8bde-da4c04e7ed51", "value": "T1B5937CC0F243D5F1E84701B16076EB379B32F1B9202DEA53D3695932ECA2551DB1ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632410, "uuid": "51c9f8b8-10a2-40d6-8d5c-23ee8e514364", "value": "1536:yDTWUEDqdK5gvoFO93NxCPI++OdgxaIfabzc4QSFLcu:y/WUEud4ooo93NYPDJqxnf8ttOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632410, "uuid": "f0ddf3a8-ad9d-4810-8ed5-f5246b9366ac", "value": 90056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632410, "uuid": "99909439-f8d3-4a7d-a1f1-6df2715149c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632410, "uuid": "3b3366ac-e7a7-4673-a86f-353cd6289061", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcd8ef6-056b-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770609388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609388, "uuid": "7696b962-5ed9-455b-b9ab-8c0a7046ecf5", "comment": "Malware payload (Joker)", "value": "1b906628a63faa18074cda18f9b449bb", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609388, "uuid": "698f7eb1-5383-4cf3-953d-47ea4a1dc33e", "comment": "Malware payload (Joker)", "value": "0a5fbf063d1ae939ed309cb1fba3b66bc71753e0d3a31280e7ed57a5690d38ec", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609388, "uuid": "8a69fee2-60a0-40ac-9c58-0258eeff1f8d", "comment": "Malware payload (Joker)", "value": "85986b6116cc04904490d41991eb4e8c9f645a25", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609388, "uuid": "e5581c3b-3148-4624-8796-5c6f729471ee", "comment": "Malware payload (Joker)", "value": "48960816186659027854fefa18be79c49fc93de77a815874aa78a973dbe1f28989009b40e7484697148c4a6281c9ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609388, "uuid": "840029a9-c98e-4cee-9506-d0c5d5767ac0", "value": "T189180149E52DDA36D9CEF07C5F690666F23A34640168C05BB82D910DFFCB6F046B2B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609388, "uuid": "afff5f9c-ff69-4d19-a444-20ce61333137", "value": "1572864:NcSNdnNJHDus/rARte6RteUGRRtej7GiJIQeZAG9ZYlI/iQBwY:NcYPh/k/N/rU/wraQgAjQBwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770609388, "uuid": "ec807441-31c1-4867-a0a8-821fd93740cd", "value": 88702895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770609388, "uuid": "3f45c223-b065-44a5-a9ee-93d187155160", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609388, "uuid": "75415a59-33da-4ebb-9d25-54091eabc29e", "value": "com.hairlator.cutpov.fashion_6.4.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf3085e-05bd-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770644575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644575, "uuid": "a178021a-b639-404d-8bd3-8ff03b6f7996", "comment": "Malware payload (RemcosRAT)", "value": "784df1252adab249a4397a45e80927cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644575, "uuid": "9a708761-5c08-4af1-936f-54046e7d758c", "comment": "Malware payload (RemcosRAT)", "value": "0b556d96edc749151971889b9a442e8d2112d6aebf62a774323944ea8faef177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644575, "uuid": "92e071a3-ede0-4861-a0d2-bec092f0f8c3", "comment": "Malware payload (RemcosRAT)", "value": "a22aa8e533f1da6d3c6020ff8dd141e32c593d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644575, "uuid": "3ef8666b-6d09-40d9-93ce-37d64b016233", "comment": "Malware payload (RemcosRAT)", "value": "da75f45e00a952f5ba031290f4f5b9e4f0d21752bf2456074b80cb8300ff2ca10db59cb87323959257ace6e92692620b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644575, "uuid": "50faba44-1cb3-4500-934a-99f3a208d2d9", "value": "T13BB49D01B6D2C1B2D57654300D26E775DEBCBD202836997BA3DA0D57FD70180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644575, "uuid": "d9955aad-9109-4f4c-ada7-db528e8e456f", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644575, "uuid": "81feec5c-ae00-4593-a138-ac51498aa7c4", "value": "12288:3N9WLGVGUYcvqvvCNQzvCZQBm+sPZ6VSw9:3N9sGV5YYqzvCZQBmtZWSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770644575, "uuid": "1f0ef9d8-3cb9-470d-bb45-20e44f785693", "value": 536172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770644575, "uuid": "4bc33435-1a98-4fe4-8f8a-c50a2c9dc1c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644575, "uuid": "6853fba2-1ac7-4af0-8fce-c6809c285665", "value": "0b556d96edc749151971889b9a442e8d2112d6aebf62a774323944ea8faef177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf83b925-0586-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770621172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621172, "uuid": "b9c63224-7d97-4e4a-b157-8e5b2bde6a33", "comment": "Malware payload (Stealc)", "value": "315db52d5cf09de020118fd290d0ade3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621172, "uuid": "206443a3-0f27-48f0-b016-9e3ae1501190", "comment": "Malware payload (Stealc)", "value": "0bf4086efc87becaa85af3bcc2ea67986c67aa5d1b7994bbcd9d451d0507d3c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621172, "uuid": "ed14ab77-2079-4a39-81bc-6f832a6d8ed7", "comment": "Malware payload (Stealc)", "value": "3d06c300c0fd7b1518e7939ec989b797a180db9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621172, "uuid": "0ae43caa-eefe-454b-9df5-09f148dc3437", "comment": "Malware payload (Stealc)", "value": "44df66cb0e4b0adc4b18c6809fc4957e2f86696a5badc16ee9226343d83fa41867eb88892397f08ec2c8b9db814a5363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621172, "uuid": "c4bad9df-0649-4410-847a-cbcbbfa0e378", "value": "T13EB65CB2F89509A1C67FE13498605E91763138680B3E7BD37FA815660D2AFC46B3FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621172, "uuid": "121ddf5f-f7ed-4055-a6af-4bcdadbffa89", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621172, "uuid": "a79fd6f1-a101-421f-bc09-38b53db19b47", "value": "49152:lY6zC3+h/OzVX4dZEKCDfMY9BAJ2mWDj4kqA+c8OK1d:rC3hVITPCDfMA9xqwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621172, "uuid": "414d8c7a-48b6-4c24-862e-b53ae2dde796", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621172, "uuid": "b0b1845c-4a71-4132-ae6f-59dee0b9b37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621172, "uuid": "599d58bc-f262-4aaf-9a4b-556d2afbba52", "value": "x0bf4086efc87becaa85af3bcc2ea67986c67aa5d1b7994bbcd9d451d0507d3c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823f7a2c-05da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770657147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657147, "uuid": "252ba13b-e38c-4a87-91a1-92dedf382465", "comment": "Malware payload", "value": "298cbfc6a5f6fa041581233278af9394", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657147, "uuid": "d8e64ff9-4d22-4b7d-bdef-b85158edef3c", "comment": "Malware payload", "value": "0bfcc531bc9e3297f64be41186c556f1c05d3e8172f91d2f4a243b6bf37aa021", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657147, "uuid": "06fbd1fc-691b-434a-a6d5-ea6a43026636", "comment": "Malware payload", "value": "8c39f1c69af5ec1cde0f7c6e3b9046e90e0da610", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657147, "uuid": "8974b0b9-5aba-4926-a290-5dbe10f544fd", "comment": "Malware payload", "value": "616ceecfdd022352414154f0634fcc6468507637f4e7bc0d7f8e8aaa9ebfc2e8c42daa4012b1ba786612fab6b589d00a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657147, "uuid": "255ae7c9-db4c-418c-8677-98e88ddb776f", "value": "T1D4C55C59EB4254F0E613A3B1458FEB7B8B187A25C021EE7FFF4ECA54B5335123809296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657147, "uuid": "cd337a53-c945-4595-a1ae-e577d89f5557", "value": "373531ff36a9c014e3592657f87c8ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657147, "uuid": "d341af9b-7c0b-4b50-82e3-447bb2a80f19", "value": "49152:sQ7yNADJlsPsX8crS8PsYvmbtUldhFOREjS6vYq1NAXpIMy5YPhuv:/ONUJlsPswbtUldhkmdQ2Nh5Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657147, "uuid": "7e8c6b46-c2b7-48f3-a306-b1f0562b3b44", "value": 2692123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657147, "uuid": "d71b1fa1-0df8-4eae-b205-5643da98573a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657147, "uuid": "6e766267-a5f6-4e3e-9b97-86e32886329c", "value": "Cryptbase.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38aea79d-05d9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770656594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656594, "uuid": "c4c6f142-6765-4fe5-8b98-18ead404905f", "comment": "Malware payload", "value": "3da9b3ca8b651d2efc9ee7c3573095ff", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656594, "uuid": "a081806b-5ab5-4f34-a26c-475430cc3d81", "comment": "Malware payload", "value": "0c301e54719c51ba49bf839a6c013e5e53ad85e9f7f2c92e6c7ddce14f36ab00", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656594, "uuid": "d47a746d-7c7c-4f23-80b2-390b8ce22371", "comment": "Malware payload", "value": "eab83f606c214ae733f0e5b85ddc14d9b9894d97", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656594, "uuid": "2a5f5ce7-12ca-4626-bca1-fe33510af948", "comment": "Malware payload", "value": "e784058e7da5b36ecb3c718b69d31f3f8f2897af24c87f4a4682ebab9d8f19105a38ddcea929507bcfa666fba184eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656594, "uuid": "ed6d3a90-1ce3-4e95-9104-295234801266", "value": "T19863D63AD9AEF03BC3295978DE060D54CF62BC8E5794BF92A7E11CE60E879106F1C581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656594, "uuid": "2003b772-c4af-4473-96fa-fc5cc07663d9", "value": "de3e74bfd953870246567b962b98e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656594, "uuid": "b14a0128-b6d8-475d-b625-2d97a3d833fe", "value": "768:PE0uMorNbV4gMIWFFLCJGHjFGhGU3ahIy8PMgZVj7HUDXCkB4Wz:vHtpGG8Ugfj7HUDXt4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770656594, "uuid": "74f176b3-2428-4e28-9e00-bde486513752", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770656594, "uuid": "9eae2830-0a62-4af9-8bd0-05393c158f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656594, "uuid": "95418cf6-3c35-4a82-acf0-7d38e7e7800f", "value": "0c301e54719c51ba49bf839a6c013e5e53ad85e9f7f2c92e6c7ddce14f36ab00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6e1446-05ab-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770636897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636897, "uuid": "ec223a8c-83b8-49c3-b1ef-555c9b1c10ea", "comment": "Malware payload", "value": "44938590790b694e6a3869ef332ff482", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636897, "uuid": "6c8f4fd3-78ed-47a3-a8a6-e409c743db38", "comment": "Malware payload", "value": "0d456141730cc498b5da1c3022698a9157f036623a9bacd70dcf849e578ffc43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636897, "uuid": "f7377818-3d8d-451c-ae0c-79455e3d6192", "comment": "Malware payload", "value": "ca7c89ab82ce27e03f0eb8c9af7be0f1a4179533", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636897, "uuid": "5f4c0845-3c27-4154-9cc1-97367e20e972", "comment": "Malware payload", "value": "d2be71250db8cc2251cdeff06f585fe141e44aa8ef12dde3ea22698ff8751c9b10b7f49c06c1ad39a38714fdc26447a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636897, "uuid": "83fc04e4-2022-441a-ab54-164ee66455a3", "value": "T1527702C7B0E3FBF2E0277364AAA1F4C89C7162F4324661859708AFFD990368651257F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636897, "uuid": "faee9b45-46df-4cd3-8dab-07a20a64cd2a", "value": "192:cRhzp8XXg2svMAivjG+2YOhXBblJRDhrWOIS9zhfRQs6d/xNj5:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770636897, "uuid": "017861fc-df1f-4f56-87da-7d548721c75e", "value": 35856399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770636897, "uuid": "adcfa868-d634-4a5a-9ea8-5074e7ecdfb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636897, "uuid": "dd8e6d2f-b470-4296-81cc-afaec6f88187", "value": "Notice_MOJJFI96.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac0ddd-05bb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770643716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643716, "uuid": "1053a6af-101d-4daa-8b8e-062d3c6b5b7c", "comment": "Malware payload", "value": "63f4e073dfe21b012b6ce3ed2bf7bf1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643716, "uuid": "d29d79e9-e020-47b4-8268-f0c472217763", "comment": "Malware payload", "value": "0dbfcbd44cec78b0bcb111a29ed86dc77c451e969ae2e13fd34754a1958eebcf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643716, "uuid": "c5f367bb-735f-4b03-883e-f8b82118471f", "comment": "Malware payload", "value": "26dbdc2c880ba3b1c3672c2aae41c8f7107f3f5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643716, "uuid": "3fc8b086-ec2e-4976-9d85-55194361be84", "comment": "Malware payload", "value": "fdefe01d17f8ec894e5dab470e6907c4d56ad51629e39e50389a663253bb404d5aee5971b78bac330403183873fd89c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643716, "uuid": "2e7348ce-d565-4b9b-adb6-ec46c2dea6a7", "value": "T197E0A0CB28D67062CA28EE8C61268C085004E7C421E2CFACF44D14319997946B114F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643716, "uuid": "a3fd2d83-eb57-4cfe-b2af-e942547c2b0c", "value": "6:aSWJj6Q4WGSWJtYOWCQNJvaa0LKiB4WGSWXImWGSWKWEWGSWgTnbAfn:dWJd4wW4OeNFf0LKe4wW4mwWYwW4En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770643716, "uuid": "3b4f4ac3-8f0f-4724-95ae-3412a7307215", "value": 424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770643716, "uuid": "9e98b6a3-3917-4e16-aadd-87cd0155c1c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643716, "uuid": "e1e1cac6-f5d2-40be-9e68-e416b0f271ce", "value": "u.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d8c186-054c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596058, "uuid": "2ad081d8-8e02-4068-9263-7fceba3100c0", "comment": "Malware payload (Mirai)", "value": "10a81709e40f61de51dda9174982a1e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596058, "uuid": "f1f71b39-29b0-4757-9b3d-37dcf0ce2232", "comment": "Malware payload (Mirai)", "value": "10048b16ad24f874285859021117819dbc9ce4212d954fd201cacd4275e6204e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596058, "uuid": "224ad7f1-1ba7-4d7a-8d6a-adaef0e43417", "comment": "Malware payload (Mirai)", "value": "4990cce9f68f7ff29308f8adc3de1303bae0de54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596058, "uuid": "04446947-c2be-4dab-b3df-e6657ae0938b", "comment": "Malware payload (Mirai)", "value": "c7cfbab05dc46504d0d97b57c03bf0bc0220a23241c720d05c513f4809f77197006ddb604fd3235ffde776743f3bb9ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596058, "uuid": "989370d3-bbdc-4c4b-9b9b-bd8003b7e93a", "value": "T157148D68FE4F68D2D2C7E37DAE4A0FA230277D749565C0B51A00A29FD5EAFD488D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596058, "uuid": "d32010b3-8750-4aea-b04f-9927df351261", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPxq:bOVfbEdxm4iub8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596058, "uuid": "8ed80a51-e9c6-40db-8515-017506bc489c", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596058, "uuid": "4a0c01c5-4d1d-44e5-9e3e-14fb5727f7bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596058, "uuid": "5d2483dc-a81f-4c8a-bdbc-30b55a14d2a0", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10da30d-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770648662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648662, "uuid": "760e3ef8-b06d-4751-b574-98b82639addc", "comment": "Malware payload (SimpleHelp)", "value": "8fa95f2e91dc3ac8eefe24b2797b7e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648662, "uuid": "eb0c3940-6721-4ef6-9009-f79d3262e3d6", "comment": "Malware payload (SimpleHelp)", "value": "11d83a28fe726090250d19fdeb6705e787c5b7d12b3f915dbc78fbdb66b7555b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648662, "uuid": "89e8d79a-e9da-4a30-a03d-2a4dcd93ca46", "comment": "Malware payload (SimpleHelp)", "value": "af87db820e4d941770623261075e1312f064c781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648662, "uuid": "2ca1bb82-a791-46f6-89bb-75f6c1612f07", "comment": "Malware payload (SimpleHelp)", "value": "fe5595e78d089c6e8dfe1dd7fc4b1042820355a14b4055a960ffd49bd18579695b0fbf8b2ba5b18dea8e8b7a2bdcc6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648662, "uuid": "84704a94-af6a-4676-bb97-c763bf581b51", "value": "T1E685C034E6A15DBDCF37AAFCD08E44DB979BB9A203C5012717F086D68B613D0542EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648662, "uuid": "a5483a48-c669-4cd9-a226-25425cfa74f7", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648662, "uuid": "d4ea2a2e-cf5c-4104-ad75-da9268d38965", "value": "49152:MOlCQ8msodjHF2bg2h0kSKX15dIpRkud5ou/btL:PXJrVRR75ou/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648662, "uuid": "ab34003a-af36-4f77-9b58-6d2c1dc9787b", "value": 1721928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648662, "uuid": "40cccb4a-24e4-45da-86ad-333aaef53f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648662, "uuid": "e499a9b6-5d80-41f2-8bf4-3c32c12312bc", "value": "statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688ada56-05af-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770638635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770638635, "uuid": "2250efcc-7189-4563-aca2-a7fce96037f5", "comment": "Malware payload (GuLoader)", "value": "92552f0769ded6635c4cb028530de479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770638635, "uuid": "a27f109a-3b83-44b7-bd6b-83a531a003fa", "comment": "Malware payload (GuLoader)", "value": "12a4c9166dd1b44d85ccbdb15d659488e70e72e4bb8fd3037685b9aaa705e8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770638635, "uuid": "c1c3e8a3-dc2c-4874-9fd9-fae79659ff38", "comment": "Malware payload (GuLoader)", "value": "cdfe5dd382097bcb68f2bef4be0924ae10ffaa62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770638635, "uuid": "5ff8462e-a1b5-47fb-919b-131bbe9fa892", "comment": "Malware payload (GuLoader)", "value": "19539292e31deb70c67cd7a2eb865de30cdfaa3933eb4d4d28fab9ef190c7f81414c3f59081598218d66342b7a902c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770638635, "uuid": "3cd595d1-95dc-4736-8428-989e94eb276c", "value": "T12A94F1113242EA47CEEC06B184AF92FE4E759E7B59828F43F680F75E7C712C67A15250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770638635, "uuid": "12186bbb-4ed0-4d40-8c6a-01c12e5a17b3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770638635, "uuid": "9db6cdd4-4a9b-4658-a504-1ffbba54318b", "value": "6144:fQ606xV8H+lc7SGd7Uln1Vk8nLTOvlo75gHCjA2MZ4fyeqJW8EYVdq7dHdRO:UecGGRUlXk8LTOvlo75gijA2oEYVdudU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770638635, "uuid": "19753754-7c4c-4911-9528-720dbbffb9e2", "value": 415308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770638635, "uuid": "17378605-af2e-414a-83e9-7f44f1a89739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770638635, "uuid": "47b61db0-ccf9-4619-acce-879f06f30961", "value": "REQUESTING FOR QUOTATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fbe284-05c3-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770647407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647407, "uuid": "db2bc268-b4f9-4778-b89a-9d33e6f8a79c", "comment": "Malware payload (Formbook)", "value": "bca5cdabe576a13b1d969b42b5062677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647407, "uuid": "f3714685-2637-4aae-9fae-853a501dddcf", "comment": "Malware payload (Formbook)", "value": "144b3e4d1f963e0fc6dd419df16c8eed0a2d816727ff2629e7e1aab5c0d3f243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647407, "uuid": "aac2d48d-2f51-40b4-bb94-e7055dcf0b91", "comment": "Malware payload (Formbook)", "value": "958249cf393abd7534aa7f0174b84feb370e8fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647407, "uuid": "683578e5-914d-49b3-98b5-0841acede8b2", "comment": "Malware payload (Formbook)", "value": "2a866cc108b1d270a2a111650ec0ca5c2cefc947cb8068d0ce51432aa1c907f6884a916f643a6cbadb00cc94acc30925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647407, "uuid": "dc0c432e-22b0-4f27-a278-d4e73c41ea55", "value": "T10E35AE027391D062FFAB92334B5AF6115BBC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647407, "uuid": "5037a9d1-a592-4e21-b4fb-7759891da68c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647407, "uuid": "bb639e59-9f2d-4583-913f-d654c190725b", "value": "24576:H5EmXFtKaL4/oFe5T9yyXYfP1ijXdaXbSRA4WTHw4vX:HPVt/LZeJbInQRaXbSRAVTHw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647407, "uuid": "6aa4107a-7bbd-424b-ac39-7e2891e32ff7", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647407, "uuid": "b1ae260f-9b9d-41e0-b754-743b8f26af6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647407, "uuid": "9a475511-0b8c-4277-b4d1-dbc82e5a92c8", "value": "rFatura672_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f955206a-05b7-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770642314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642314, "uuid": "1e5db67a-978a-4e4c-8024-00b0ffd5f86e", "comment": "Malware payload (RemcosRAT)", "value": "9ecf13c2f851c8e7522e147314059242", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642314, "uuid": "eb7e0916-a586-45c9-8096-4a899d43f51b", "comment": "Malware payload (RemcosRAT)", "value": "14cf7023721b60f8eea452bc7d911f4c10bda79145116a16348b93c1fca2fe41", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642314, "uuid": "729f49d8-a17d-4873-92cc-228527f443c9", "comment": "Malware payload (RemcosRAT)", "value": "0210e2bd486030a7badc96e06bccb89db6841a13", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642314, "uuid": "f26a253a-f512-437b-9349-2ab65946cc5a", "comment": "Malware payload (RemcosRAT)", "value": "c4af5e180c083c932f6fd2aa2e22a89a69a0e73df6a1c88aaa3e09445133882b2951706ef7b2da0b1c235c266323df9f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642314, "uuid": "59caea0f-ff78-461e-b4af-0f65bfe98370", "value": "T13EB51120C958CDA6064C8115206A5E8B66A04DB74C10B73A3F8F5F8E1F5FA4F99B53FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642314, "uuid": "4d835c09-6fc1-4d07-a118-5d06a0549b1d", "value": "24576:blpXaLi+wSEZcrY9KVLbYZ2XnwHi3IxzpN/XHs9oO01h+BrJj/kWiYc4SqEEpNJZ:nKLi11Uv+tf/XMJo+X6W+YLi9DY/bqI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770642314, "uuid": "b604c6c5-535d-481c-9351-2e30c94a37cf", "value": 2383661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770642314, "uuid": "e4dc4c42-aecd-4e96-98d0-788137e2f757", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642314, "uuid": "31c70d17-f518-49f7-9064-ec51d8764014", "value": "mari.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4235a637-05ac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770637282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770637282, "uuid": "4cce3f32-0ede-4573-9769-8ec33ce10336", "comment": "Malware payload", "value": "6b84cad087f5800df133658483a9ccaa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770637282, "uuid": "83f8b9d0-55a2-4b72-add3-14ad17b8b3f7", "comment": "Malware payload", "value": "14e2358e66c2dfd1aa283cc030a49110b06fd057cdebb9e96ff10e44ef0c012b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770637282, "uuid": "6c9a615e-a58f-4474-ac58-e433518ebaa7", "comment": "Malware payload", "value": "dc1f7527e5f39c5e1e1f19b2d574a6743cb1c6ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770637282, "uuid": "30770a97-4fdf-4176-9c01-8a434ab47a8f", "comment": "Malware payload", "value": "a38cfa041267e53f39923909979a8aa95428809f3c01796c8f843e0e553c0b22ac5eac72c47a2ef876f7a920a3269d46", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770637282, "uuid": "b1f6f07f-f3f8-43cd-84b2-caec6d4101ba", "value": "T14E06333B87D7DD62E4218FF0E6E77A231EA33423ED985E6943EE6C115F700A58C6A501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770637282, "uuid": "5edbba74-586c-4297-8bb6-322edfb40c4e", "value": "36f4177ee396a950259fd1b6833c1396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770637282, "uuid": "feac0866-238c-48af-b2fb-743224fe6508", "value": "98304:Q1snLD4i2M6vyFsYvraSM4lMTYzXw5285VVqP5AP:usn4SFs8raiMszwVFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770637282, "uuid": "8fdd005a-8b7e-409b-83c9-bf14e3477d58", "value": 3963392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770637282, "uuid": "1147dc37-39e2-47f0-8956-d35e0d787424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770637282, "uuid": "5501e3c7-6db1-4077-8269-249169b5ccb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b470575-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770670879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670879, "uuid": "ed7466e3-9620-4b5c-b189-25a2102bef4f", "comment": "Malware payload (GuLoader)", "value": "c6bac7187331bf51f7f70f8c3651104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670879, "uuid": "8c493aca-2049-44dc-9e7b-8279ee3f4530", "comment": "Malware payload (GuLoader)", "value": "14f5baba86e43ea12f13c38bac263bd7a0a58de989378f52033f2fc282b0f64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670879, "uuid": "94c7d61a-532f-4f4f-91dd-4a1ea6cbbbd8", "comment": "Malware payload (GuLoader)", "value": "c9c5f581429ecbd63090153b9ff74b10953e5c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670879, "uuid": "e1aeb22d-d93d-42ab-b195-0295d6f5ef1e", "comment": "Malware payload (GuLoader)", "value": "b703bf11857b5e96beeb9b055393cfcf09f025ecbdc9e5b6a2846dc941876590bc48b78e21f64b54964add325c2932fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670879, "uuid": "0a233e78-0430-4b99-9098-8c7f38d32e92", "value": "T1C01512601706685FE0934974ACF17776F2A89E66336DC3C63A90B5887D3B2068F793C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670879, "uuid": "b705686b-d1d7-43a3-a37f-44a961dce9c0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670879, "uuid": "5071ac0e-c591-442d-9089-403a0853730d", "value": "24576:mHO/MdQR+o6wWxxPhfWdBz6kqd43jbz1HVkMIwSqLbBYNGv:mHO/udrxhfWdBGzKb0wSqp9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670879, "uuid": "b7a362b9-50c7-41a9-9e1d-4d261c0d9342", "value": 885240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670879, "uuid": "277c6f86-27a0-4a4b-b66f-ceb0ffd9fece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670879, "uuid": "80bce13e-f8fc-49de-9c65-1fd7f8b424a8", "value": "Bevilgende.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf223d7d-05f9-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770670563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670563, "uuid": "298ba5ff-54fa-4dfa-aa77-9d374137da25", "comment": "Malware payload (RemcosRAT)", "value": "589da867ea87651c489065f0e68026cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670563, "uuid": "535e2633-a99e-41b3-8b92-ea9df6127fef", "comment": "Malware payload (RemcosRAT)", "value": "1652147663a81b888e0f11b7d2093548588629f18c124633611e6a02ca562775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670563, "uuid": "460db5d5-5abd-40f4-8287-796d8155771b", "comment": "Malware payload (RemcosRAT)", "value": "fbd350e6b8ad4ab8900e166a382d46a8f348da49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670563, "uuid": "e5e0239e-cc8d-47ae-8e1a-0457999c2be1", "comment": "Malware payload (RemcosRAT)", "value": "87b911403a5f6a13f9811053ae0d94398deb78b0bc09b03a7e4c88eced8412892ab306d826a89cf7a78fa50bae724db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670563, "uuid": "4972478a-c5c1-4dc3-bc0c-c78ff64336e8", "value": "T186B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670563, "uuid": "5e6c2706-daf7-44a1-922b-60c9e4b61fbf", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670563, "uuid": "3b35a8f4-09bd-4132-8593-6ce97a48d908", "value": "6144:UXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBced:WENlHV9FGeDWv3jADnyYiCNrsPZl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670563, "uuid": "fcf20eed-b6df-4973-ac29-b4fbd49db62b", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670563, "uuid": "a2562128-bbdc-4004-94c0-80b8cd3d22a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670563, "uuid": "46635349-22c4-48b5-9044-282c5baf907c", "value": "1652147663a81b888e0f11b7d2093548588629f18c124633611e6a02ca562775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7726ef6-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770646955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646955, "uuid": "5bbda687-9dca-433d-ab4a-5acce89ef022", "comment": "Malware payload (ValleyRAT)", "value": "ec8197d8929bc1e6baf215a08da9afa8", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646955, "uuid": "2e700ffe-41ca-4992-b7a5-829ee9c6fbcc", "comment": "Malware payload (ValleyRAT)", "value": "165f6d2f481d0f36b37e6f8485f189174f3b058a01f1a64e83986d0de65dfc35", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646955, "uuid": "6175b29e-89d1-4d0d-a045-fd05d76614fd", "comment": "Malware payload (ValleyRAT)", "value": "07ef31a5ae410ce30174a6b491577eb6f59ca313", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646955, "uuid": "009f419a-dd58-4d3c-8b31-28883da1dc99", "comment": "Malware payload (ValleyRAT)", "value": "a2970dba84db7aa10e9bfd630f94c0c891c0d44bc6073d78479ba2a38bd8581006c027325ed955bc71d74f618de2a909", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Sonbokli.A!cl", "colour": "#AC8BC2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646955, "uuid": "baaba004-54ff-4bb7-bdfb-dc01e37fcbc9", "value": "T11247339345844DABEA244F3FD553214D5935BA373901713FBA858A81BC2321EF37AEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646955, "uuid": "baf1a1e2-e2d1-4b69-8685-c26951bdf131", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646955, "uuid": "0a4b8e2f-9b40-45b1-9bf2-7a3f379c2a5e", "value": "786432:5bHTyYuOAW8viZ/vhRIJpu+Q9VVvYJhjaN0b5Am:tuYug9Z/vgALYJvbCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646955, "uuid": "e64f1cd6-f142-4e7f-be39-96253911fd5d", "value": 26209147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646955, "uuid": "39f8ddb6-5813-4b94-a3de-12483e32ffe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646955, "uuid": "1ec00629-b0ec-4c73-823c-5d90d579bd37", "value": "222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb1827-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597288, "uuid": "47788deb-7233-42c4-b905-001694f6d54e", "comment": "Malware payload (Mirai)", "value": "38d503b72a6f7d87b0e73b6ce3a9067a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597288, "uuid": "e07618f4-73ea-4672-ad99-1cc23283d20f", "comment": "Malware payload (Mirai)", "value": "175b39d1072e1ceb5d44af99d814f6278978c923ebdfdd03072cd228ed906505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597288, "uuid": "9a7041ce-67b5-4aa2-8f20-4beacd33fbd9", "comment": "Malware payload (Mirai)", "value": "7266cc663eae00c1ea5e6c2e3db169145d926e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597288, "uuid": "657645ad-6dba-4d44-9c31-5b0f3ba0d260", "comment": "Malware payload (Mirai)", "value": "83b8201ce864f819931828a04bb16657017be0546f0968c53bf6b4e629171aa1db24f7d2cee02a848781c20345decc73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597288, "uuid": "99177122-5246-4919-8b3d-d08cdeaa3eb1", "value": "T1EA532895BC819A13C6D11277FA6E428D3B2213E8D2EE72079E265F2037C785B0E37E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597288, "uuid": "27f5521e-a187-4f8c-a36f-e729a8ff62fa", "value": "1536:hRNvQI0U3gDZ/9tJS1pkYi2cYb3A8XNRulIvJW25:hRU7gCYi2cYbQ2tJn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597288, "uuid": "9c078a38-8416-4f93-9377-7361075262a1", "value": 62780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597288, "uuid": "5c5d1649-66df-4e35-84de-2db3402460c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597288, "uuid": "3167e4b5-77f9-4a75-aef0-ce28c12e6f91", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888b8fe9-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632246, "uuid": "71236864-a414-4864-856b-886c467729f9", "comment": "Malware payload", "value": "7db1692f03ca47c838d4b7c602558aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632246, "uuid": "9df11fc7-f835-401b-b6a1-9e707f09905b", "comment": "Malware payload", "value": "1817c505b8c0505230502a5cac985670301ddc65c1f5c5f614aa0824c3bb4623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632246, "uuid": "a0c5de51-1aa8-441c-984e-d7dba736de46", "comment": "Malware payload", "value": "46103175e4589bea7450b1ea65825d89c642ac23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632246, "uuid": "d1c173a9-1ccf-48c5-ba0d-d72f125f5ea0", "comment": "Malware payload", "value": "9d60fb30293829c853b8b00d7f0b4d60472724d84591da169f51b0f3c54c8b7de1445b1f8e89c4f07e5f5a3f5c44d4b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632246, "uuid": "59502d75-6997-4c72-9fa6-8e5dcc2d1bc6", "value": "T160149E013382E987CDEC06B144AF92EE4E769E77A9828B47F780F72E7C726C57924114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632246, "uuid": "2872ae7f-e811-4e55-aa12-780da7b4aef4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632246, "uuid": "9f084001-45a2-4e43-916c-938a436e60c7", "value": "3072:fca/q6CDF6Lt3uxepT8H+4UzuculJ9SGZsB3gT7bX:fQ606xV8H+lc7SGpTfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632246, "uuid": "f810b9b6-beb1-42ab-b490-34feff94aefe", "value": 202453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632246, "uuid": "9a4a5647-2b9b-409f-a031-3a51d5bb66b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632246, "uuid": "969bd47a-ffce-4f70-8886-2ab4ccf7b9a2", "value": "Purchase Order H6002873doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e6b577-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646286, "uuid": "a2fe9407-55f1-45b8-aff2-619dc67fa205", "comment": "Malware payload", "value": "201c19bf4860636c058342d890a52937", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646286, "uuid": "5cbc43fe-205d-486c-a52a-c6ec66384fc0", "comment": "Malware payload", "value": "189ffbb2ea36c28f35f4cbbeedf14f7deb63b1b2b4d5313bf641ca343e8f8837", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646286, "uuid": "88911798-8412-4b07-a272-de26e0adc638", "comment": "Malware payload", "value": "a4492a91f3ee21c825ad9ff0203ac9d984db35f7", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646286, "uuid": "6bd317c7-576c-490e-9a5d-824872ae8e65", "comment": "Malware payload", "value": "0285d9444e42d7faf0464a2a78d3d9c8c48108b8345e14368a855790cddf8cbd645140617aad234037a3bb06fe235661", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646286, "uuid": "26b4757f-9fc7-45af-9224-25f600201ede", "value": "T173A3081672474770C2885BB5C0A7561003B1E787A773DA4A789E138D4E137FEDEA8ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646286, "uuid": "7e1d55c2-5aac-4c82-9d26-9fb6bd3fe1d0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646286, "uuid": "03ee1442-ee52-4c5d-92ed-17343d8d5140", "value": "1536:AQFJ0IuJrIKqiQVu7MkowvrDt40s3TRCC3Nm9zrppMjUtCv66WqKA:clHL7Mkoytts3VCSNm9nAjGJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646286, "uuid": "0a7965e6-2867-45de-9710-5595158498e2", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646286, "uuid": "d3f7bce7-a0d5-42e4-a4d7-492093521940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646286, "uuid": "c866f9a9-72ed-486b-b256-569d0fcbc570", "value": "189ffbb2ea36c28f35f4cbbeedf14f7deb63b1b2b4d5313bf641ca343e8f8837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c787d7-060a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770677898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770677898, "uuid": "994f845f-5ebf-4544-ad43-8daee67d3a42", "comment": "Malware payload", "value": "6cadc95bc111dc3646f2a7f68fbc5882", "object_relation": "md5", "Tag": [ { "name": "cragor-dogakita-shop", "colour": "#100805", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770677898, "uuid": "217c0b7a-19d4-4a50-ab07-46ac8df7cee8", "comment": "Malware payload", "value": "1aa374bc252e0b237b7995e68737d06f014f859b1d55ad05f322786d52525410", "object_relation": "sha256", "Tag": [ { "name": "cragor-dogakita-shop", "colour": "#100805", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770677898, "uuid": "0c61ce6b-9af1-4fc2-b621-29bbf27bded6", "comment": "Malware payload", "value": "7116c7d3851642ef0167b17fa9521611ba1ced61", "object_relation": "sha1", "Tag": [ { "name": "cragor-dogakita-shop", "colour": "#100805", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770677898, "uuid": "06d93f90-39bd-4e72-8a88-0cf442e94d97", "comment": "Malware payload", "value": "5218d13bc7c9d56d381b91d0c879e02f7cd54dc67cd0d5458e1ae0158e04a90f8e3ff91053c00c78dee05641aaab8c5c", "object_relation": "sha3-384", "Tag": [ { "name": "cragor-dogakita-shop", "colour": "#100805", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770677898, "uuid": "dd59b0fd-0fcc-4451-be04-787e7da617ce", "value": "T1ECF02330032B9600C96F01A89B6B8972D4FBD880154C3B8E1D67E7C71C072F32F2C294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770677898, "uuid": "05806c89-1eab-4d12-bf0b-7d8d59bd1dd8", "value": "12:5jS5Ba0p6Rp5SfWlAPeg3C+piy9wLwAu5NLkD5Bai8jtax:9KBaU6Rp5SfVVtpf98u5QBa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770677898, "uuid": "00c4df1f-db61-4dcf-80e5-138f0b0febb8", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770677898, "uuid": "2d4187df-2030-43dd-b967-14d5767fc378", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770677898, "uuid": "e6661458-0619-4581-9f2a-90f8fd2bf621", "value": "663222350329.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230e2fba-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597287, "uuid": "f87426c5-70b1-43f5-a1c2-cde059891a3f", "comment": "Malware payload (Mirai)", "value": "07c0e4fed186fab9bbeb33cc9c50f434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597287, "uuid": "5cf4ddc7-78f0-40b0-9b24-4190f3024cb1", "comment": "Malware payload (Mirai)", "value": "1b79fffd04abb8fc80bfdbe6fcd18d54a08103cbc1d2be2be5c0fa21c9f6ddb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597287, "uuid": "d8e616db-cc44-46dc-934a-ec5fc267d108", "comment": "Malware payload (Mirai)", "value": "d4a37b89fc54ae6e3bf3c17a7f4eb95cc65ca8fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597287, "uuid": "58f47cc1-b38a-45c5-b961-e0c7d1a5d057", "comment": "Malware payload (Mirai)", "value": "27a153ad71bfcfbdcff5f563af077ea44733c916fbf283170b87b433657b46f29f77d1b766f73ffd6b9059d6367b450b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597287, "uuid": "cd9f18f2-5c3d-4772-b17b-c95f909e9586", "value": "T1C4D2E106D3906A03EAF765F26D5EB2D567D033CB7573AAE107389DAD38535380888BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597287, "uuid": "e42323c1-b597-42fc-99c7-c8b3ff687230", "value": "768:HPAjk43XpZpREH4WHWtI8KsqZgokr4uVcqgw0retr:kM4WaXKXZA4u+qgw0r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597287, "uuid": "1cd0bee5-6aac-46a5-9c85-ae4c0ed48a8c", "value": 28632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597287, "uuid": "56d6ac68-f440-49ae-b23d-a71c2aa48e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597287, "uuid": "dc9dcbe8-ad02-437c-b985-68ce8e1869ca", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7a531e-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596739, "uuid": "fd7d2e22-143f-4172-b327-3845c86e027e", "comment": "Malware payload (Mirai)", "value": "05542cae8fa6db757778827e9979c0b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596739, "uuid": "342c130c-8b90-43e4-8014-1c2237e29c99", "comment": "Malware payload (Mirai)", "value": "1bbcbbea1d4b3ee36d6c817940a01cdcf5e39c0b778fd711c1af786d2a5a0e0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596739, "uuid": "2ad8adb9-cd56-439a-a963-711f2397c9dc", "comment": "Malware payload (Mirai)", "value": "bc379c83b1f38fa4e35b3421a661601109a9fddc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596739, "uuid": "21b9f734-225d-4490-930f-5752c5464018", "comment": "Malware payload (Mirai)", "value": "0e0961c87dc416ef76f9aa88e95e332fb69bd6b1a2cc6180a5bc7ca32849638f3a968aa55225567ee5dbe9b7d1582f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596739, "uuid": "e3912e56-92e4-400f-9597-f9459415bd03", "value": "T169435C02B31C0A07D0A35EB0253F6BD197FFAAD022E4F685352E979996B1E325581ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596739, "uuid": "4414936d-d91a-4699-8fac-dbf1ec7550f3", "value": "768:+m+g0apUiRy1pbRrvIYsIBNqR9TLsbIEMiD/59LSsZvXXCabkNJVfV+FV+tWRwW1:RrgWIjKDdOLSifCawNJVtq+c6Wsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596739, "uuid": "713137ba-6de7-44bf-b9f4-34550f739f2c", "value": 59108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596739, "uuid": "a0568917-1ba0-4244-9afd-a54da23ea7ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596739, "uuid": "a864373e-5125-4fbe-a602-0333bedc29e8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c55c2b-0553-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770599278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599278, "uuid": "d18bafd3-39e0-44f5-9980-3eaa036e111b", "comment": "Malware payload (Mirai)", "value": "ae543766ad7c10961ff19987abb4e4e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599278, "uuid": "379484e2-811e-4a2a-ba9a-ddcb256dac72", "comment": "Malware payload (Mirai)", "value": "1c5aee683fc4001dffc177597d4fc6e78f600431fac1ab46a85cdaa32ea1f342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599278, "uuid": "4809219c-3221-4e5e-abd4-e80a98a2a101", "comment": "Malware payload (Mirai)", "value": "6f3cccae2f498ccdeae0e61c19de9e051c8cee5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599278, "uuid": "8504d11b-1fec-46a8-8a2b-446948c74170", "comment": "Malware payload (Mirai)", "value": "00323940977e9192ae58c13d2f55f5c974786c99e2a743c15cd92aafb64447aa7bcdcb01c181eff72e554aa48929a926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599278, "uuid": "4dd1fa53-cacf-41ca-95ab-261fff2e26fa", "value": "T1C173951D7E218FADF76D823147B74E25A69833C627E1D685E1ACD6002E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599278, "uuid": "8a914029-4fb7-4223-ab18-9f7602429ef0", "value": "768:/UYMezQo1V2eRCHlUtlViebsyWD3J9BRRvDWX0WGRbWbEdq+ktHQWF0Royo+leBB:RQeCHlveDQM07ibI4BQm+evvfWMkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770599278, "uuid": "490ce9c6-eb69-47cb-b6b9-822cf652ebf5", "value": 77028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770599278, "uuid": "84da6a16-3416-4daf-8535-523a06295d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599278, "uuid": "32bd919b-eebd-47cb-b14e-f51b457d77a0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0930641-0550-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598008, "uuid": "6d899b4c-245a-4ca1-b3bd-5c2f22a4359b", "comment": "Malware payload (Mirai)", "value": "7f18863c39344df75f98778fc4be27d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598008, "uuid": "fc320b2f-6aae-41e5-93a9-a73aaf06f1f8", "comment": "Malware payload (Mirai)", "value": "1c72c0f8bb02d33cd8f4dc6f859eb5f526623d6c679c779c3ff1b591fdabc79c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598008, "uuid": "69c45dfa-2178-4dd2-8bd6-23b11e2d85da", "comment": "Malware payload (Mirai)", "value": "eee1f0a582b293cb2cb7aef092ea015943ab49f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598008, "uuid": "4f600119-a68b-4882-a4fe-69d40fcdf20a", "comment": "Malware payload (Mirai)", "value": "34cb592579532e74620c524efaf6a963723a370c120e0abc7b3784c8b4b4a4862426e5565623b8d6c7c9f711dc035858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598008, "uuid": "841a29bb-5d47-4c42-8264-4c9428bf2c55", "value": "T199335AC5F643D8B5EC1B05701077EB339F32F5E91158D643EBB49A32AC92682E526E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598008, "uuid": "86510dd1-9804-4526-bab3-0769893f83ff", "value": "1536:BeKnsJJk7KyFVxlYXJs5iGezDGSGwfruMk:BeKnsJJO7xlQS5eKVwCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598008, "uuid": "9ac05eee-38c2-44c7-b9c5-6cd925f7a41c", "value": 52080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598008, "uuid": "ffe9f064-a4f7-4139-8d07-b67b13da7760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598008, "uuid": "b2fa3b05-79bf-486f-82a0-c8151df306c3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca34969-05d1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770653218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653218, "uuid": "dd5f9e71-3845-46a4-b507-b7feb5b0baef", "comment": "Malware payload", "value": "f38570a3e9cc4753f00b408cbe773f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653218, "uuid": "bd736208-30e5-400c-a18c-59eed0853ccd", "comment": "Malware payload", "value": "1cdf0124ae3cc7bfd3182b1083a44a76d93104b444e642df4c3c0a8975305deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653218, "uuid": "c6800f33-3fbd-448f-a585-e3b9d91cef1f", "comment": "Malware payload", "value": "703165d0cc9e956f98aad055f611a2e2bfa0e0a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653218, "uuid": "1341e07c-d4d4-4c96-9ffa-8bff7db3c753", "comment": "Malware payload", "value": "adc45248c87713ae7535cdebb6a1c53e32082655eb9624416f368599a1175fdd369b3ce4cc78d286cf69488d88fd4fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653218, "uuid": "d458c07e-09c7-44a3-bf64-5935782cd1b6", "value": "T115E58D01F3D84AA5E567DA38CA678333C3B179125631E18F6689D70A5F73F809B3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653218, "uuid": "910cd7db-d284-4907-8c1f-b6d4dd6abbd9", "value": "f98504e40a1849e25fedb411daa3c56b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653218, "uuid": "2bd55d28-79ed-4a9c-a770-91498664c129", "value": "49152:fWYpmY0biTZy60dGmsFbTGfYomOMejTiNNR:fWzbiNLCfYorFiNNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770653218, "uuid": "340eacbd-21a2-48e8-8bf1-466d4372fb6d", "value": 3217920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770653218, "uuid": "a8d9ac51-b2b3-4d73-827f-29962b0861c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653218, "uuid": "2ca9d4a8-b86b-410e-b983-1be168d41012", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a92811-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770632248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632248, "uuid": "c2e5abb7-ae0d-4598-9fe5-8b2f02fab105", "comment": "Malware payload (GuLoader)", "value": "a7e92ba8320c1ca427dc81efd76dc566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632248, "uuid": "5412b3bd-af17-47be-9017-321867a22a94", "comment": "Malware payload (GuLoader)", "value": "1da2a52ea89a09f4950642ee586e398c4cf117a1f0dd50bb1362f635a6720f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632248, "uuid": "ff196b82-3ccc-4933-9fba-46b04d5bdffe", "comment": "Malware payload (GuLoader)", "value": "e320bfff52a9b18128624b33021698df51fc8a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632248, "uuid": "267988ce-6d57-4bed-b1d0-6c47011f793c", "comment": "Malware payload (GuLoader)", "value": "3fa6e3e31ed6f8f05b65612fe42c3a17569497aba3b75899311d95af95692848812ec9413f697afdad81a413119990a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632248, "uuid": "046de1d6-e121-49da-a153-09dd11624f64", "value": "T177A412A2B274D86BC85256F3C632A8F61BF08E15D82517AB4F007EFE75740520E2B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632248, "uuid": "247e8e1d-44ba-48f8-81d0-27b03f5ff9df", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632248, "uuid": "fc7c37ae-af45-4004-b639-7f6a63d22b86", "value": "12288:DnVbe7PYad+y0qXl4a/0jpLVGvNQ70JE8vHA:DnVbe7PYajS60jx74HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632248, "uuid": "06fd939b-b051-4f95-8837-8f2181551fba", "value": 460039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632248, "uuid": "a47ebca4-4dc1-4e40-b259-e23e19e73151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632248, "uuid": "3d03417f-1d47-4429-917e-c7b0e7faebbe", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae932e1-0597-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770628278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628278, "uuid": "2851c9c7-da42-41c1-a02d-4837609c9865", "comment": "Malware payload (SnakeKeylogger)", "value": "4ac3780e76f8d59ed4085f6ee9f96537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628278, "uuid": "94c17fd8-1f6b-4646-a4f4-cc3eb381a6a7", "comment": "Malware payload (SnakeKeylogger)", "value": "1dc7245108586b1efebe9c379bbd181eb411213e64a993a29a0e525ef279a05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628278, "uuid": "3494f32b-45f6-451e-bc0a-d17eb97e1035", "comment": "Malware payload (SnakeKeylogger)", "value": "5691f045b73099c5a183f7e0630cbfd3a22c422b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628278, "uuid": "d8d86ba2-db70-49c3-a86f-c70d09353b1b", "comment": "Malware payload (SnakeKeylogger)", "value": "ad055a21bdbca81382c48f158661aa4257a71023891af4be4bfe1dd9f6c897bef8a34ba13fc7033675b1dcff6600c95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628278, "uuid": "5650e3a2-57aa-4ab3-9abb-c6f8094e38e6", "value": "T16D2522E5229DCD11C8E92BF06072C371A3B96E9AF413D3160EE97CEF3C4AB91455834A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628278, "uuid": "ab781203-8558-4b21-9f4c-e4e976fe7fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628278, "uuid": "bda27a0b-d13f-42d2-b05c-7eda70a31296", "value": "24576:HtPDguQkVb9aOnofCkYqBh1bLbf3xAKYcElqhVo:NPMu/XofCkt3xPVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770628278, "uuid": "43aed2f9-c2fb-4539-bd44-1815c8a2418b", "value": 968200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770628278, "uuid": "8abc03bd-51c6-4e8a-a065-75edb65bc8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628278, "uuid": "19e6f6fb-10c1-446a-8b14-05ba33ffc205", "value": "NORM TEKNIK A.S_F\u0130YAT TALEB\u0130-BSH PROJES\u0130-9.02.2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b60e496-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770657806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657806, "uuid": "5303b8cd-ff8a-40f3-8924-d209aa756327", "comment": "Malware payload (Vidar)", "value": "d6940c82b4d52f3630d687f211648419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657806, "uuid": "9d5eb737-c45c-4f84-b5d9-cfd25e4f914c", "comment": "Malware payload (Vidar)", "value": "1de05538213d5c2fb4924af9cf630d82298b7efd31c761a002b10a71cafd5a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657806, "uuid": "62d6b704-016b-4844-9e89-8555c68c3199", "comment": "Malware payload (Vidar)", "value": "1721a541320e07796ba8df6a451f996c0c901cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657806, "uuid": "dd0d8124-4fd8-4b6b-ad9e-01019a824b51", "comment": "Malware payload (Vidar)", "value": "c3fe0a7b5024fcf7bc64242428fbe13ac6b43e2b9ba9441968bf1790c35307faf645a544839a8d2e8f81fe9e3db6c347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657806, "uuid": "7f753334-efa2-4ca4-818a-8c3e39b2e978", "value": "T132F53A43AC9558A6C66EF13498A092617771B86843307BD31E885ABB0F77BC42F3E75C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657806, "uuid": "61a3b38f-e7e8-44af-a986-02e9e26edf9a", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657806, "uuid": "2b2b85f9-a9a3-47d0-997b-52c871ac1a37", "value": "24576:YMdMpO4n+K6r93nlNI1cZAuCoZz1eBOKc2ahhuQYTQxte3+9HScK11l9D/:mOtK6R3nl65n4ycK1/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657806, "uuid": "cb08249f-a53e-4a57-8e21-3914c30119f7", "value": 3587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657806, "uuid": "e32c71bd-67dc-43ba-86bf-b9825c7685c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657806, "uuid": "5777b5bd-f3bb-469e-8ed0-0272348d3d8d", "value": "x1de05538213d5c2fb4924af9cf630d82298b7efd31c761a002b10a71cafd5a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b08916-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646225, "uuid": "50fd0279-6b06-4467-b178-bd9eb2502afe", "comment": "Malware payload", "value": "fd684ea48cb97714d4f8a0c741cf862b", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646225, "uuid": "8cbf8592-18c8-4054-aa4b-f7fe34528d9c", "comment": "Malware payload", "value": "1e1168b2c281f1adaf2e2919e4872ceb4dd6918c9658b27278b85fcd44b4c256", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646225, "uuid": "1392f27d-f80c-4f15-a4ef-c5acd17075fc", "comment": "Malware payload", "value": "566925f65b46ae9651b60c94ee1169a477132e9a", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646225, "uuid": "0ffb732e-e64b-487c-8d93-22298ed01eb7", "comment": "Malware payload", "value": "1999da169041eb896fbba013f64c24f5118a722b1e9d3101aca6a144688190b201a778007065559430fe106b8beeb69d", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646225, "uuid": "94f90dd4-dec8-480b-9eb8-153f1138420a", "value": "T1D9C4CF2527D59B01E2BD877B54A0058003F1D11D9ECFEB36AFA36DE26AD73D18B2211B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646225, "uuid": "1165c6f5-83e6-4030-8922-042babeea232", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646225, "uuid": "849595db-5f99-41ae-88ac-6ca554f786f4", "value": "12288:FBD7CVE1LFK2EpXziA6o/EMTAICYjCp3k6Pfb+VJ9:FBnkGfKXq9MaF3Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646225, "uuid": "6b48029d-56dc-470d-9d8c-7c78ee6af2bd", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646225, "uuid": "15b0269a-d87f-4a8a-a68b-f399070e49c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646225, "uuid": "5d6130b9-b34f-46f2-b89e-f42d3ff474ec", "value": "1e1168b2c281f1adaf2e2919e4872ceb4dd6918c9658b27278b85fcd44b4c256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074a4d31-05fb-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770671114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671114, "uuid": "8cb3e07f-5de7-41c6-950f-87f7fe9e47e3", "comment": "Malware payload (RemcosRAT)", "value": "0fe8fa67e3310f62df7ef8d3203b444a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671114, "uuid": "8602d8af-605d-4ddb-979f-76d462806a66", "comment": "Malware payload (RemcosRAT)", "value": "1fcdad46b4e356758fb0df92c4ce2e6223237f43a9f0d3097098e0d578aa85b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671114, "uuid": "7e66e77b-9946-4851-9471-e12bb6a0dd50", "comment": "Malware payload (RemcosRAT)", "value": "8102c0294c7642c5d4f3c3500cba4aeaa625ad46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671114, "uuid": "38f6aa71-f50d-4126-94e8-08be11c8c88c", "comment": "Malware payload (RemcosRAT)", "value": "fb4a3f42f22f5d6c8bd0e3c0bdc5d707f4caf24870657ecfb868e0d73a12c5e06e36f63c9f8b06bbdeb7bb8fc8a4d06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671114, "uuid": "4e5c78bf-06c9-47de-90fd-5c32066d16dd", "value": "T1BBB49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671114, "uuid": "e6864383-af55-4681-b10f-ff209fe1ac6a", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671114, "uuid": "62fc7ffb-32d2-4aa2-8c2a-f53cede7d903", "value": "12288:a6pxxGI8gvGOHJpAbDYGxLhZ+sPZt7mPFN:a6pxxx8U+bDYGxLhZtZkPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770671114, "uuid": "d5fdc972-b13a-4a22-a586-417c75821638", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770671114, "uuid": "9208247d-43b2-46cc-8335-7550ca8350ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671114, "uuid": "e507e7d4-232c-453d-b195-9561d2d6d2a6", "value": "1fcdad46b4e356758fb0df92c4ce2e6223237f43a9f0d3097098e0d578aa85b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfbc94e-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1770623691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623691, "uuid": "ea03a6cd-b671-409e-a000-fe7ee7a508ed", "comment": "Malware payload (Blackmoon)", "value": "61d67ef8fe715853d4a6b30dc803dfd2", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623691, "uuid": "2ab068ee-8e5f-4100-b639-0a92669b1dba", "comment": "Malware payload (Blackmoon)", "value": "1ff670cc68c7ef5d1dbaf4566bb187f39bf2ce24aa9e6ba7c3d2da8eaf0cebf7", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623691, "uuid": "67e27649-89ca-4688-8ee2-d63938e8719b", "comment": "Malware payload (Blackmoon)", "value": "9c987cd9d57ee7d993258b9cf998326076df78c2", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623691, "uuid": "80aaa929-0f9d-447a-a91d-5359abe893cc", "comment": "Malware payload (Blackmoon)", "value": "069a7564484881e0842a71e3cd653e9ddc55807508c8ac8e8a76054158bd3f98d72f6d0509633cb6fbac6377af2ca58d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623691, "uuid": "0765f870-0dbf-4dce-810d-32e3a0e5c513", "value": "T121379D50E9CBF4B2DB425071C46BE2FF6B322C058736DAD7D688BE27F5265900623297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623691, "uuid": "d28cd69a-e3be-46b1-9c8a-b79dec04901b", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623691, "uuid": "ca0ed047-3bed-456e-ac16-99a88f764204", "value": "196608:mrv331nFjH0WYFNhyvZMzrSSdalKBHkMB8X50ABeSkOdYXsZ8:mrvVnFMyZ8rfBZT4h9eu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623691, "uuid": "c23d793f-69e0-4be1-ba5f-b392b7df087b", "value": 22519808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623691, "uuid": "534be5af-8b73-453f-8bd2-4b8f1e7cbd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623691, "uuid": "f92a0245-1be2-4c77-93ae-ad4da760d9e2", "value": "61d67ef8fe715853d4a6b30dc803dfd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5657d699-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770648483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648483, "uuid": "479c4c03-b311-4345-996c-37edca1b1059", "comment": "Malware payload (DarkTortilla)", "value": "fd5b916f6e185e9cd042223c8a61b400", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648483, "uuid": "993d925b-01db-4a24-bcb7-ee0a8e81d5d0", "comment": "Malware payload (DarkTortilla)", "value": "20beaec4ad8341161ef0a36de86a02923cb904d438823f86fd7dce0682429922", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648483, "uuid": "b8bc9c56-07ac-42bf-92a1-579e530af28e", "comment": "Malware payload (DarkTortilla)", "value": "129926143866e0548a91e054535a70b3e8b57b7d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648483, "uuid": "82433fd4-4e11-47ca-a3f2-2df906d4f2d1", "comment": "Malware payload (DarkTortilla)", "value": "2535253070f473e1c7a7e79151d7015ec3bacdcc97244d6aa6ed6a35a65704a43555e08fb3be931c2ab471465a9f4d61", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648483, "uuid": "cf8cec22-94cc-4a38-8e87-88c6d26a262d", "value": "T189E4CF1113AC1718E0BAB73E5672170187F2FC96DAF7D71FB98818D92861F429E91B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648483, "uuid": "9bbff304-9fe4-4a51-b29d-61ae502b3157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648483, "uuid": "28bae0dc-eba3-4f36-87ed-28e74bec83f3", "value": "12288:xcnhzzKcV23hZ7rxMkdwtffPdvgZQ/XjzutuJ2/v:6a623BM1lKozbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648483, "uuid": "ad780644-a811-4e94-97fe-45417ad5dcd5", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648483, "uuid": "4f5e9f1c-3a6b-4eda-b2ff-13be3ff22bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648483, "uuid": "69ebf70f-8ddd-4c85-b866-f28e2fa90519", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6b1d56-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645304, "uuid": "5a53d263-0c5a-4d09-a6fa-994890c7e503", "comment": "Malware payload", "value": "da7d00a257390cb42937e2fd894bb881", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645304, "uuid": "827850c2-b002-43bd-9b78-f1cf32efda50", "comment": "Malware payload", "value": "21eab4b9a3f3d129c60a1e53f6ec92d4aa546717e8df2bf858e06f0437f60c07", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645304, "uuid": "5f1f810c-6857-426e-a3a5-070dee4cd559", "comment": "Malware payload", "value": "a033b5faae1a068a185ec285f138152f6cd3df39", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645304, "uuid": "f0b00ef6-1300-4b0c-9385-47944b483715", "comment": "Malware payload", "value": "172ac74e26517940dfb51bfaa3fabed111bbfcde9792d02e8f3c45084e07029004bad192ae320385b41aedeb8160a00b", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645304, "uuid": "681841be-c2b8-43d5-a843-8afc73d53baa", "value": "T143F29B1572DF920871B3468D0BAF07740B6BBA9E0E7E8159448DE78A8FE35148C977B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645304, "uuid": "258c064c-0507-40d9-9182-31e0980fbeed", "value": "384:CiQijiIioiTiziMisuiqiViViViViViViViViViViViViViViViViViAiZP5id+7:t6P5idDh444rxUjAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645304, "uuid": "fc6a8883-05e8-48cc-8fea-a3b6b9140d5c", "value": 37022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645304, "uuid": "67494deb-d8a3-44b1-ba3a-107d7f50a4c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645304, "uuid": "dcf809ae-5b71-4902-85d0-f5d49bc3dc51", "value": "21eab4b9a3f3d129c60a1e53f6ec92d4aa546717e8df2bf858e06f0437f60c07.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc3d28e-05c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645811, "uuid": "fc92410f-96ae-422e-8895-85f7808a3ab8", "comment": "Malware payload", "value": "d33c9d30d928c8d53d71d678c57f00e5", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645811, "uuid": "ad0f5725-f0d7-41f2-abe0-79a7e0019e47", "comment": "Malware payload", "value": "220e11c678bcba151545ce19398e08b8802103bfbbc11696f3301ea8fa38190c", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645811, "uuid": "75ace605-188c-4ba0-931a-2f65be15829f", "comment": "Malware payload", "value": "106456f0fc8e701b6eff89a4851a8d33d888f4f0", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645811, "uuid": "4af9f054-f5c1-4cf8-8c36-65690e994c69", "comment": "Malware payload", "value": "54dd67f26441f010a370dfd36e3a3f30d4d4c1cd652855fd2dae74768289e44b0595742d1c6feaabbe35676c3f231cfb", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645811, "uuid": "b24e47b0-858f-420a-b4b8-898129dde749", "value": "T14DF2AC12758F960870B3568D5A9F02740B6F7A9F1E7E818A408DE68B8FE3504CD973B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645811, "uuid": "d7a26b4e-0e28-45c9-ade2-53aecb643d8f", "value": "192:C/ofXggL8/ofXggLZ1Kt9qKxVBXAAAAAAAAAAAAAAAAARrzBMcuUFC+aoOefrWPP:fzRud+aoOE+0YYaR7DP/zWc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645811, "uuid": "d0880778-0c95-484d-b906-040ae775d6da", "value": 36964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645811, "uuid": "7887099e-d24c-4350-ab06-6897e0830cfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645811, "uuid": "669f2051-c174-459e-adba-6be17bef5aec", "value": "220e11c678bcba151545ce19398e08b8802103bfbbc11696f3301ea8fa38190c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8d147e-05e0-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770659524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659524, "uuid": "89905e7d-30f6-4e3b-85ec-9d2900c541e4", "comment": "Malware payload (AsyncRAT)", "value": "a52e5fd3a542a966dad44c9730bab410", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659524, "uuid": "a8121cc1-e959-42f7-a6d9-40bb2e2dd7e0", "comment": "Malware payload (AsyncRAT)", "value": "234fc3a7de8af423424c9323ae295e3873b293122c723f8bbbccfa0bca5a8a9f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659524, "uuid": "18cc2c87-030c-4088-972c-87ec8c63baa2", "comment": "Malware payload (AsyncRAT)", "value": "cbbf5fafa5031d83479cd707efdb6676aec12018", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659524, "uuid": "27250334-8e36-490d-a9c1-5d765f8736e8", "comment": "Malware payload (AsyncRAT)", "value": "781a55eeab4ceb71077987c62eadda645529c0296cd4a3ac048fef62a1cba92945d89ea23fb1381f9c1adf8191b63768", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659524, "uuid": "a5f92e08-2c40-4b6c-bcf1-6a08046c7aeb", "value": "T100535B042799C966E1AD4AF4ADF2450006BAD5772106DB5E7CC400DFAB9FFCA4A123FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659524, "uuid": "921b8c4e-8987-4e57-bfc3-acf7ef50ed83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659524, "uuid": "3b387417-655e-4b6d-9402-5cf41f2f29ec", "value": "768:sHEkzqbHiPndMim9JaCopqVcn17iR+n1+OiSCvHmqb2nVpwH1oK4WjXT3DU/YH8O:s4bgYTVO1Abbiwj4qTTU/YcGpiVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770659524, "uuid": "5de50b29-cafd-4a9b-a84a-0692cc6b3b00", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770659524, "uuid": "3dc0beb3-13cd-4fb4-84ad-65ba2fdf9905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659524, "uuid": "615e0481-0618-4785-a7e8-2a60b87ffd11", "value": "WagerSentinel Node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2dfa2a-0610-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770680222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680222, "uuid": "832f5ce1-b86a-4116-ac22-4f8b3a4c40fe", "comment": "Malware payload", "value": "82a5458aa2db2602b7600aca12c0ee37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680222, "uuid": "61950f41-88f2-4aaa-a591-035ea8822d99", "comment": "Malware payload", "value": "2383e230c44f405c4171e0db86e9fc04eaeea223860678f0048e862b6ea477a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680222, "uuid": "9380307d-3285-4666-b0e2-1ddd0cbde0c3", "comment": "Malware payload", "value": "c301769a3605775c51c6dd9a8163c1140f8c1474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680222, "uuid": "0f3d52a7-1bcb-418e-8b9d-ec9009ea7017", "comment": "Malware payload", "value": "8033d65fca9352030aa672f43f3c2fdc0b1a27370001edb5858bacaacf7968bd22fe02926c3fe5b067498e4b950b3750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680222, "uuid": "cdc85dfa-c940-424d-b718-8e8ffb3209fb", "value": "T13783BF06F3D754FCD11AC93889E7A777B971FC2228286E7F2614C7312C11D60A76EA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680222, "uuid": "c38e9959-0cad-49fb-a601-f424f9265950", "value": "ae29b9d70ccdd3a7b2e699d4371d9bad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680222, "uuid": "8513032e-94e8-46a7-aaa1-12961df28a21", "value": "1536:f2iCR2K2i9Z8jJoMyo9+OeCuUbt9OixcOBdJ9LIyce7wQry0Q:f2iu2K2UZuoMhHeCu5urPXvEQjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770680222, "uuid": "dbcc3b7b-109a-422c-9fe2-d741072a75b8", "value": 87559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770680222, "uuid": "a4a109e1-0cd0-41be-9baa-038ecf034475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680222, "uuid": "806bcd10-efa0-421a-aaa1-c950f64af88a", "value": "2383e230c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfcc07a-05e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770659851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659851, "uuid": "3f992423-42e5-48c8-a9b9-fe5d0d8d9f61", "comment": "Malware payload", "value": "311dd9a5c910950a113f5a737a0dcf2f", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659851, "uuid": "310b7341-c16d-4ddc-96b0-8f149262a6e8", "comment": "Malware payload", "value": "2463b5bafc20504e29dd56f380b469859e5d75eaad857156970656e4e949e4d6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659851, "uuid": "6935a643-d2d4-4910-aed8-abd33ac6dd6b", "comment": "Malware payload", "value": "c994d5e7c535453564ed9c345249ad6780b6f375", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659851, "uuid": "50102082-d0eb-4963-8851-a5ab930cc2b7", "comment": "Malware payload", "value": "2ed700e46d8387e6b0defb60fabdf9039209b31c771ea3dfb887c0b571a6d73e6320252098aeb41cd547a73ae95d384f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659851, "uuid": "0849f043-ccb9-44a7-bd0e-acd101242568", "value": "T1DF2412ABC44B8DA6CC3EF13E62344EDAB215750BF2567839282E346E351179B314CE67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659851, "uuid": "a5c31dae-8742-4d82-8d1c-da951e81cd92", "value": "6144:V/725geUsZIUbbuzuQjzbU23umBhqkW4A9TKlf6WWLnv:xMGaXCCe0ou2aQizv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770659851, "uuid": "b28ca474-79d4-470a-a3fd-96c5b34d05cc", "value": 229368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770659851, "uuid": "a4136c19-5c66-4f6b-80a7-ab9a17f6c158", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659851, "uuid": "e1249c25-d7ee-4fdb-9d44-4fb624525b5a", "value": "F29.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7cbb7f-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597330, "uuid": "f88f698a-58e4-4676-9f48-dd832cf73374", "comment": "Malware payload (Mirai)", "value": "48e75d172b94317ccf381cb3d4b8715c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597330, "uuid": "fc8dc359-8f1c-4936-8bbb-e291956bc4a2", "comment": "Malware payload (Mirai)", "value": "252f77be41006dc1a48b4d1a1cd5049937fd124c24435f922bc052b732877a63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597330, "uuid": "70d97eca-2d77-4a27-be70-a3caf1d290db", "comment": "Malware payload (Mirai)", "value": "225f08776b834635df732fb86a79116890d6fa24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597330, "uuid": "639bb74d-3941-4e8e-8b2c-bbefdee574e8", "comment": "Malware payload (Mirai)", "value": "0a8defd85e639e70bcbffd0dbb93710353b82e4aef896e0ff9add432bbf2924458018d86d406ac96286660a1185db4e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597330, "uuid": "2624d61a-e9b5-4457-9084-08896ef60929", "value": "T118534C0173584E4BF9E61EF4293F1BE583AEED4022E1B185A94FD7464235F33499AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597330, "uuid": "4e7a1ca7-955f-4613-9755-28200a821e24", "value": "1536:RZeE1erBcOxN9oLn8KYE4BV8Y/INVxInzFBVC:KO2B7j9oLnSEWV8Y2VxInzFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597330, "uuid": "1259a861-f6f1-41ff-abcc-7d8750ecdc05", "value": 66648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597330, "uuid": "31c29b46-cbcb-404d-b5aa-6ba71291010e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597330, "uuid": "9d5ea7cc-999a-40ed-850f-77736119a84f", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cc0c65-05fb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770671106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671106, "uuid": "180d0a25-965b-44ad-94f2-f528d2333389", "comment": "Malware payload", "value": "4317201817b69553c0120ea4053da8ec", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671106, "uuid": "a27c941f-1c8d-4297-980a-db793db3f8a0", "comment": "Malware payload", "value": "268d12a71b7680e97a4223183a98b565cc73bbe2ab99dfe2140960cc6be0fc87", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671106, "uuid": "ff7294e4-2189-4e8e-a626-1467c39bbf3f", "comment": "Malware payload", "value": "2321100d9c75f80a6eb539d7b88214e517525502", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671106, "uuid": "0f8cd7b1-1714-42cb-b908-1109b073463a", "comment": "Malware payload", "value": "7563eb878a0421b61abf8818ff2e4acb6c8a60563cfe33f6e581acde81e0c2b64ea9daf1d85a2184a00dfdab05d7f77a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671106, "uuid": "9706e594-fe19-41db-a37c-cd9fb34f2910", "value": "T1A2B6330AA79025E3F4E7957D8A23C8329377B8922F14C5EB02BC96D55E23ED14937738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671106, "uuid": "4960cdc8-831b-4d02-9347-d5cd721d7959", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671106, "uuid": "798b2083-56af-4ed5-9596-f205e7a5c66a", "value": "196608:94UOXXKApQ5wRpj9fZwQRCgJIKpdzjPOtn7jzEOA4TBR2wTChiednXBtpicinf35:9QHw8fIKppDOSN4TB9e5BiJ35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770671106, "uuid": "f3b4c899-477b-4c22-ba0c-6b507f01f57d", "value": 11382624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770671106, "uuid": "eab8132e-74c4-4064-9995-42e72179b51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671106, "uuid": "81b52e3b-0533-47b7-97c5-3d5959a79929", "value": "268d12a71b7680e97a4223183a98b565cc73bbe2ab99dfe2140960cc6be0fc87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f5ffd7-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645310, "uuid": "b38206a1-7694-4e1d-a0bf-3a87087305f3", "comment": "Malware payload", "value": "fdd8f8802d50c8c2ebf37f9df7929a89", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645310, "uuid": "bc0d9dc7-b8e6-4956-908c-1481e3c1e6a2", "comment": "Malware payload", "value": "2890045d5a5400e086659bd1e714084c84caf25ed9b51210c8ec2cf06f5f366c", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645310, "uuid": "e335fbff-754b-42c2-81f1-04b80519ed82", "comment": "Malware payload", "value": "c3733b2d551d429a223622cf1ef641f121d0251d", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645310, "uuid": "53bd0b7a-fea9-4883-9682-6509549299b0", "comment": "Malware payload", "value": "87fb8902929731d2590880e928ceccb48476e62fe51911597e0c3031fd86c6cd042250a0bab9ed808eb68bf9386eef13", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645310, "uuid": "87b59ee3-4e4f-47f9-b81d-0a5de6dc61de", "value": "T11FF29C1176DF560870735A8D4AAB06B80F6F7A6E0E7E4049448EE78A8FD3515DC873B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645310, "uuid": "a8f62279-ff93-45f6-8e95-5f1a5a35c77f", "value": "192:BfI/nwwbb6XfI/nwwbjfj327iBhc5UFC+ah4LGrWZNTIgiKMCNJJNJeNc5YUuzUI:UC7i45d+ah4i4TIgi50JekqU7/3rwxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645310, "uuid": "c23bb2a8-2129-4929-891a-93e52cc67123", "value": 37016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645310, "uuid": "6d9e3b70-6623-4231-b151-c54345816487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645310, "uuid": "683e9b09-df8e-4e38-b6b9-0b8e749df82f", "value": "2890045d5a5400e086659bd1e714084c84caf25ed9b51210c8ec2cf06f5f366c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2fceec-054c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596019, "uuid": "f384893a-4ca7-49e7-bfe1-36d94e748722", "comment": "Malware payload (Mirai)", "value": "abdb73d7247048f1effe2fbd8c7d9141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596019, "uuid": "90c91813-eb19-4300-a9d4-4995016de3fb", "comment": "Malware payload (Mirai)", "value": "2a92006d7bcdf496681e68a37347e458673d288dbf19e607db63dea90831f144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596019, "uuid": "8836946c-89d4-41f5-a2c7-2ccd2ec5aea6", "comment": "Malware payload (Mirai)", "value": "12d7338295091e53820d5dfdc472ea451229b400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596019, "uuid": "5013abb8-f2e5-46c2-930f-12517d921def", "comment": "Malware payload (Mirai)", "value": "baa9be52134c335032aa9ee4d5e95610f1629775ca2f7e3e332dcb5846baf1991bf7fd65e54183806887235462b7ab0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596019, "uuid": "2307a3ec-131f-49a2-9088-b46de69b43b3", "value": "T1D06302CF6EB03F26C1D861F6703819898C36DD8BE2538A9D83F1E696473842765C871B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596019, "uuid": "c7c9b77b-7bab-4ac1-8e8c-e559fb61c37a", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMGou+vMYgENz:kaxZLmYKX+t08jmeJhYTJ7mNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596019, "uuid": "74d51f06-ffcb-49ec-940d-d96c7d8825b4", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596019, "uuid": "d32d36cd-87af-4d2f-a13e-b2ea3ef67ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596019, "uuid": "cd51e2ed-f7ba-4b4c-be89-3ac77e9fcdba", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a0b665-05c4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647782, "uuid": "9aeb98e7-112f-42cc-8009-443fd6931eb1", "comment": "Malware payload", "value": "7186a77612a093cc0e522cd31a95e155", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647782, "uuid": "d574343d-74cd-446e-b001-1259e890abc5", "comment": "Malware payload", "value": "2cde5446c1613194e2e7e6754a1da12ed459e468a3cc6e4fe2973214b9f33b73", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647782, "uuid": "9cd0f5a1-d53a-4145-a14a-603c67858aa1", "comment": "Malware payload", "value": "9a58a0fb892ccbf3bf7afce3b7f9f5bebeca3688", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647782, "uuid": "0a8d7f10-163d-464e-9e88-5387afe7ddf3", "comment": "Malware payload", "value": "846e92efb7623e9aa64b5e7e9559b3335a4e4bfae80c6693cd9942628c8c2c00d5b95537a3734544d88c3044cf1cb4dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647782, "uuid": "b5f05f85-1c34-4ca6-aed0-8106a0dbe4e1", "value": "T11DA012213000134CEA21432940DD8011D028007C42C7F0C1D52DE1F17135831382D904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647782, "uuid": "4ba66c99-1aea-424e-b396-1992c40918c7", "value": "3:Y3n/fP1zzOCtW/STvEDiIC7y2n:Y3n/HxzOCUSTcGe2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647782, "uuid": "7ea291e9-f2da-4470-a188-628bb0f01965", "value": 82, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647782, "uuid": "7df73995-e6d6-4cbb-9266-fd83e9782a77", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647782, "uuid": "066f129b-3749-4295-ba1a-ba53875eae43", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca264c-0585-11f1-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1770620811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620811, "uuid": "9e960b4a-487d-415a-8653-79c686d9cfcb", "comment": "Malware payload (Phorpiex)", "value": "869e6edba1580088394b324cd41e7dbd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620811, "uuid": "afa29d37-fe54-4770-9971-4609a9474855", "comment": "Malware payload (Phorpiex)", "value": "2e893562114e5fafa195fb09e0db323f4c41f6a327196f98fccdfeb18e887e6c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620811, "uuid": "b7efb8e1-ba1d-40b3-bfc0-0d515ecdb045", "comment": "Malware payload (Phorpiex)", "value": "b384ea034c9a9cfc1bc355b460f31733b18f0b21", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620811, "uuid": "bf1c1c2c-0351-4d9a-9aa1-999c18811bd7", "comment": "Malware payload (Phorpiex)", "value": "e705c057eda5f4e2feaa0e1c7b69be8b665dba471d0ffc7f1edfc57e840248f0b2151dd9bd8a9881b6fb5199293ec97e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620811, "uuid": "9e0f5da6-2f86-4414-aa02-cb7e744afea0", "value": "T1BA835B01F1D0917BF8FA81FAD2F74E69582CBFB4134944E35290659B9724AEAFD3102B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620811, "uuid": "7df0a591-0c32-472a-849c-6d906f36bbe2", "value": "8a17e5a35017900501d8d170aca1571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620811, "uuid": "fcf909e1-b8cf-4d73-95ed-028743f33190", "value": "1536:tKRjxbFmavM2B10yxt9Upp9AkyFA46bxHppK0Xmh:IF2OZ10yFUPqkcA46bdppK0Xmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620811, "uuid": "eb8dbe31-6efa-43c5-82c8-e4074110cfef", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620811, "uuid": "01d4545d-2177-4b8e-ad73-ae1282d84ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620811, "uuid": "cb11cf9d-ede4-431f-9311-92dd175345df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4056375-0551-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598362, "uuid": "ec2f12d1-02b5-4e99-b4dc-ebf877aca55f", "comment": "Malware payload (Mirai)", "value": "5389fd826a0e684af79a9f05772dd665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598362, "uuid": "91a7555e-10ab-4f32-b06c-9fe60e7242b7", "comment": "Malware payload (Mirai)", "value": "30d66f5b64badfb3f1abb396ecbad81696ebcc4071ea8fd9f24c5af1bd1ab9ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598362, "uuid": "12053d9f-7318-4319-8c04-60c3acfbd543", "comment": "Malware payload (Mirai)", "value": "8d4d963bb0783c119a9b1ac683825d86adb18a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598362, "uuid": "13d17024-b571-4bc2-9599-afd0b544245b", "comment": "Malware payload (Mirai)", "value": "6438b0e490730da211cd8df3daae78b586853842f0e256385e917d61224f134bf2a16baa1c1556809fc4798845283d3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598362, "uuid": "f56f58a8-504f-4649-bda8-1037eb1f26db", "value": "T1D2E2E128D46475C9CDAC0D7A207AA3B1BFC1F15076362B8D63289C61F33F947B16299C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598362, "uuid": "b9b2fb24-294f-4d7b-a664-33d84df876e9", "value": "768:czujNv6iA7+5k0dZn88gZIXF8uJcTeEIYXWWBQIlx:3jDASk0ruKu6EIaQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598362, "uuid": "d91d9ef2-c19f-4785-a121-676d614b8965", "value": 32036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598362, "uuid": "7352b0b3-c016-4cbd-b35e-92a263a11272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598362, "uuid": "a41f8862-2a2d-4650-8732-b92d520cfd95", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490e4062-0562-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770605511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605511, "uuid": "f3453bcd-6b2a-44f0-a0f5-b1cb45dda7cd", "comment": "Malware payload (Mirai)", "value": "7476b9626fbc0443d1583e0307deff00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605511, "uuid": "ede3105e-31bd-4b64-b76d-a7f71c35cd0f", "comment": "Malware payload (Mirai)", "value": "32fa4c01b1720d903a892da8ba3631f574d4bd18f9b29787fdbb4d59787103c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605511, "uuid": "fd3a1d41-8501-48ce-9815-29353b22fa36", "comment": "Malware payload (Mirai)", "value": "2ca16239df9367b38e879c33583a6ef16bfe25a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605511, "uuid": "0bdd7aea-d49b-415c-9a2f-80327d8e1a27", "comment": "Malware payload (Mirai)", "value": "1fa7aa0ac7fb3ef40bbafb5bdc0c9f0169fd78665d5b668e1c3fd9a610fbbda7c044dcc101dd866c0d0bd02b31687a65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605511, "uuid": "56ae3733-fc78-44c7-bb4d-1ea93878be98", "value": "T12C261A57B8918683C4E4367AACBEC1C433635EB99B9722576D04FE3D3ABE2990D35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605511, "uuid": "05a7432c-2d7e-4ba7-839e-b9b54f46ba5a", "value": "49152:udbPwECXvzRG6AdgKjxpBVCfvdEmxeyAzkU1F1:AbPcvVG6AjxyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770605511, "uuid": "d1398540-74ac-4ce4-9053-49255189fa50", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770605511, "uuid": "e48bc33f-9df3-4e52-bf28-9c24a992a38a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605511, "uuid": "0fccfddf-6c38-46c6-b13c-8a975f9a3e91", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06850ed7-05be-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770644913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644913, "uuid": "b8a0c973-068c-4b2e-ba3c-d02e52610a21", "comment": "Malware payload (Mirai)", "value": "b310b897b846a1bf93bde4f66994e847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644913, "uuid": "875714e5-7d09-48c0-8047-25a2fbae7a30", "comment": "Malware payload (Mirai)", "value": "331e0594ad32ae744a256b1e3b0c24b37ab86d127773a3f95418a5cf6b929f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644913, "uuid": "06257f67-1f20-4485-a7f2-16b5ba81cc4d", "comment": "Malware payload (Mirai)", "value": "0241a9b4870682594101bd9b67c5307883d19597", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644913, "uuid": "73f74756-d70c-4c78-9a5e-6ef91074d247", "comment": "Malware payload (Mirai)", "value": "74f69b4fcc66186b5fc603e5fdc9ca638210bf4ad16e3c54b04f698c3473e27a07b0dfc7f2efb25e5b30ff6ffee0f3ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644913, "uuid": "f1653ac6-b0b1-4586-952a-69d196392352", "value": "T169D42329775369CAFD274CFA85717A239BD77FF89CE1034E01CAA9894C899C09C83167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644913, "uuid": "140f95b3-65fb-4f6b-8102-7f37a9f7e736", "value": "12288:ZDTMErhyeVe1yWE0+MaDgblsnJ/mb5Uyi1W7pnHaH4wJ1oe5xz9qofBw:ZnBlU1yf0ncMbSf1W7kF1oMxzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770644913, "uuid": "249e4bd6-44c5-48a7-8d85-1fcf5e693b0b", "value": 622916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770644913, "uuid": "c4a287e2-f920-4375-a371-0369b9130ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644913, "uuid": "883ca8d1-7eff-404d-9bdb-9b1068b9e985", "value": "7233474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef27e10d-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632419, "uuid": "b2912fc7-b44a-4049-9979-81db782b83f5", "comment": "Malware payload (Mirai)", "value": "4a65afab48d49729b05635969d74e191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632419, "uuid": "b170424f-d431-471d-91fe-60e7b6929aa0", "comment": "Malware payload (Mirai)", "value": "344a729615ef114f7611730225f3676469cbae5e115f9729a58919696bac9074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632419, "uuid": "1dc7f6ca-0c17-4bed-8e02-b4ade9069be3", "comment": "Malware payload (Mirai)", "value": "1e1a2645eaaaba2b0d1e4fb625d69204d8bdac8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632419, "uuid": "14b33650-a596-4db2-81fb-ed968ad98588", "comment": "Malware payload (Mirai)", "value": "294bda93f1d14403f696341e2b8d9d7348bb298ec8f5829c5e2033862d9ba1135342e1295321b5a89e6ae2b23bfd6685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632419, "uuid": "f1c0f157-e4e4-49d8-99a9-cf2455194513", "value": "T171D35C17B5C180FDC4DAC1744BABF53AAD32B1AD1238B26B37D4AF262E49E205F1D950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632419, "uuid": "73817d2e-7027-4b3c-953b-6e09d9ffa17f", "value": "3072:2VQScyqG0jXS5qjpedSc7q6Pt+gZmQE10BizkLEsMj:2VQScyqG0jXS5qjpcfXrg7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632419, "uuid": "ab050cc2-fa9e-4428-bf7f-db0b240c8a6b", "value": 139896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632419, "uuid": "f9b564bd-cc63-42fa-a344-79a0b782622a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632419, "uuid": "f5eecb88-cf6b-4b52-90ec-91fc80d2e59d", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f311f4a-05cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770652229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652229, "uuid": "e41d165e-386f-4843-a965-8cc22329fee7", "comment": "Malware payload (Formbook)", "value": "6687d17bc8246cfdcfa93599bbf380ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652229, "uuid": "73c0db15-427a-4245-b7f4-4db59f809f3e", "comment": "Malware payload (Formbook)", "value": "351d3d2274389081c215d37dd5ac36e03594eb42123afb49fa5447e60f8156bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652229, "uuid": "bf0df9a8-f3ae-4282-b591-32168dc416fd", "comment": "Malware payload (Formbook)", "value": "b512b5ee5041d337e537deb9456889e59da83937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652229, "uuid": "041734ec-4106-441c-b592-e1ae6655bd87", "comment": "Malware payload (Formbook)", "value": "a1bcb50f7078b93f0223e67b61773a39d3528283d8a0f3ab2d9a824d268b0ced5e6eed22ef40eff5c6cb6368768bdbd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652229, "uuid": "9fa1f4eb-e8be-46a5-ad98-a2ae32ea0347", "value": "T1E82523B832AEDE51C0E92BB56421C2B157B5AFC5F602E3188FC4BCFBB91AB411508357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652229, "uuid": "67c24756-e412-4a8d-9baa-e8cf682b9fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652229, "uuid": "749451ee-e886-4c08-a57b-60404aae60a4", "value": "24576:shyFQN8TsAHKWKinX1vwuANGsE2WWaIVavguQ:MySuTsAHPnXhSGYMEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770652229, "uuid": "9b011ba1-44ab-4d45-bbdd-1c844c185af1", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770652229, "uuid": "22dfde40-8a4f-4329-ad0f-ebe0f5dbb984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652229, "uuid": "8f42eb89-671d-498f-b7ed-96f6052885d4", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee50e32c-0588-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770622109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622109, "uuid": "71b3ba54-5e97-46a6-8d16-6b6d3b5389c3", "comment": "Malware payload (PureLogsStealer)", "value": "02b4895314f37b4545922681d15d5723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622109, "uuid": "b44433d0-16e3-4369-8b5f-d3809ee7e029", "comment": "Malware payload (PureLogsStealer)", "value": "35c63a8326db1ee1d58f263d6fe7959183ec87dffba528071b3cbd73f4a3edd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622109, "uuid": "eff2d2d2-6e5e-44df-93bd-dfa8e6b70d26", "comment": "Malware payload (PureLogsStealer)", "value": "697a7917addb223a6714fae2191992c6ac798408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622109, "uuid": "c7e28d61-e3a7-4a85-8321-2751d7810346", "comment": "Malware payload (PureLogsStealer)", "value": "c94eb3d9d9230d07cdb10c01bc497ff42cf0f78771b301266a1a961d319c32b4bbf9d07d4f46f89e395a85532aaee34e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622109, "uuid": "c7d5f860-5f22-44b5-afa1-82d7a3fff0e7", "value": "T1F1B6AF70B42B2E17F326F83849217250C265A151FD8BE0FAF467DA644773AF016BE369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622109, "uuid": "eb1ca012-6acd-432b-ac82-4f94b8aafe69", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622109, "uuid": "cd27cbc6-de19-47d6-9638-601edde6cf76", "value": "196608:W+99w2NypbqGzLZCa4+V5KOdG7zcqiOFr1Mg21/GY8F:W32uqGRC5+V4Hreg21uY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770622109, "uuid": "81e8a353-e996-4248-bb9a-756d01a532ee", "value": 10812604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770622109, "uuid": "bacf03f5-f9e8-40e2-9690-a1c35f3b19a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622109, "uuid": "7f60816d-4935-46c0-a27c-f3bd0447cef2", "value": "02b4895314f37b4545922681d15d5723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d26c6a-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770623655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623655, "uuid": "42442e5c-5792-4ad4-9560-398010640e99", "comment": "Malware payload (Stealc)", "value": "f1a9b0fc594dd6a5db0c63e8b018263a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623655, "uuid": "2f3c8e3f-f765-41bf-8c2d-9267bd095385", "comment": "Malware payload (Stealc)", "value": "363201a7f7d0f230f00ae92bd5e86f1a950fdb3256f1fb2717c5ea610f09bc14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623655, "uuid": "74b23b0f-4508-4917-a79a-d58e926eafe7", "comment": "Malware payload (Stealc)", "value": "a41a5b15efccb51bf77509b5ce3293b9c51d8cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623655, "uuid": "bde7f606-0377-4ae6-947f-2791baca7e24", "comment": "Malware payload (Stealc)", "value": "aab248bbfc388f6905d26706e0f3e0205e6a091126bd5538dac72242acbc5c92d438990cf9b6ff3d71b52a1a3c1f15ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623655, "uuid": "3f39a659-f02e-4dc9-8b15-a4b0139db514", "value": "T10F463912BB9D45A2C6BFE33897506252BE31785443713BD36E9815AA0C2BFC42B3F719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623655, "uuid": "99a49455-4331-4bc3-8207-5c1694175eed", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623655, "uuid": "fd40a79f-fbb5-4afa-b7c5-28c27aebe1ca", "value": "49152:VntqN3/icyDrvIgMWB6mAkdSh5iA43OzG3jhsKv0bhyMMcYz7jyEnK16vD/e:yN3WvrdSh5iTOz0hsY0boxZPdvDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623655, "uuid": "ec685256-2327-4171-a64a-3d61e307287c", "value": 5875930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623655, "uuid": "c7d904e1-bec5-4178-9c41-3bca40845fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623655, "uuid": "c99a0a3d-4c49-4de1-ac3f-6f48fd23cfd5", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f6a80e-054e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596913, "uuid": "7e585012-ca51-43f1-9237-a1e2fae0fc45", "comment": "Malware payload (Mirai)", "value": "c65fbacada3976a04ad1cdb97014bda5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596913, "uuid": "238b4f6b-d9aa-4e02-83b3-3710ea9d5325", "comment": "Malware payload (Mirai)", "value": "36f5b8c6b02671befa2485cd75fd18e5fe3b30ed3e4d78257d9099fb7e21901c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596913, "uuid": "e7463803-47bc-4be6-8536-713da5568612", "comment": "Malware payload (Mirai)", "value": "aa3b131ba895ceff62ee4bd53cdd202321fa2805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596913, "uuid": "bf52bbb7-fc57-49d4-9a05-8d06d72b94b7", "comment": "Malware payload (Mirai)", "value": "50ea685d0b978e019719499a66b7ff0732e2ed3cb57f922f7b39d44c9fdbd2604fcbf91c1123d3b151b91f71063de297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596913, "uuid": "03e4e938-abd1-4469-9cdf-9d7ff87f6203", "value": "T11ED3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596913, "uuid": "b8ae7f20-9c8c-4ad9-a72b-4da575be0583", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZZ6:xOFgpOEoVv3MXL5NhGOZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596913, "uuid": "1b354cdd-4ab1-4daa-b551-d21ead86ff1d", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596913, "uuid": "88a7788f-3437-4a3f-b342-7095868c0e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596913, "uuid": "06c4bec1-03d4-4d8b-87c9-a57ce68fa024", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b86761-05f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770668890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668890, "uuid": "21b884cf-3ad8-484f-872a-a9345b2e686b", "comment": "Malware payload (Mirai)", "value": "05dc22ac50c20569adf875a49edad586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668890, "uuid": "c6da500a-5074-45c0-9293-0ea22951b9be", "comment": "Malware payload (Mirai)", "value": "3760b13c2950853051078befb0aafb8eea3cd306946603576392dedfdc1650ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668890, "uuid": "41ef3013-7120-4961-8048-e2c28ecde8b7", "comment": "Malware payload (Mirai)", "value": "5cf615230237633012b298022d92540f98486599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668890, "uuid": "f73ed9db-c422-4d2c-8745-b46eadc99dd9", "comment": "Malware payload (Mirai)", "value": "e3eb7286ab55592c2130b8b33669db39e9f24fbcf46a713aae343ed9aef5bbcfebf042dcd6424d9d03273dc34029bd28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668890, "uuid": "2838e563-f37b-4bd0-b37b-f6e03073fb9e", "value": "T1B9C33C92FD81DA12C6C76177FA1E428C372747B8D3EA32079D216F21238B96A0F7B155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668890, "uuid": "11efce8b-357b-48d4-a97f-9198aaaca3cb", "value": "1536:vbhui+z4byLEl/2Jrhf3PJrdNfjJRPbQUITN1xMpDDjwMzlVC+NnqOIdIWTTlGIg:vbhuiK4p+fxrdpM1GpvpVCsIl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770668890, "uuid": "7efe7d6d-fa90-4ec2-a742-dfb255015f57", "value": 124116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770668890, "uuid": "927f7a95-4225-40a9-981b-0b014734d211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668890, "uuid": "7e416858-a00d-4055-817c-6a664c1ca519", "value": "arm.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94140a60-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770623676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623676, "uuid": "9d7d1bba-5fc0-4e1c-a921-ea9582f63fbf", "comment": "Malware payload (PhantomStealer)", "value": "39e01c020ad90be8090acb92c89d72e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623676, "uuid": "7e728a25-b00d-428e-a75c-0a44aa90706b", "comment": "Malware payload (PhantomStealer)", "value": "395ce3629322c923a1738cc4e457c3041969978f0067abc56441dbae7f65176d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623676, "uuid": "018058ba-9f57-48c2-a4c9-0e3c26aea3c1", "comment": "Malware payload (PhantomStealer)", "value": "eac2e2c475a962166c6984ca14601cab15f8bbbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623676, "uuid": "324de9d5-0cfb-43ff-8326-70176bccb765", "comment": "Malware payload (PhantomStealer)", "value": "0ee086e0641cdfa562d0e79841c3e7acf80c95d9fd1eda311296b5e1214e949bf79f65e7c0ff7547b89942d51bfdada8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623676, "uuid": "4a92af6b-640e-4a6d-95be-bd29429bbbda", "value": "T114732A0376CB4661D52467B9C0EB95500BF2E3833A33D68A3E8D53C94D027EA9F81BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623676, "uuid": "c32ba793-1d6e-4add-bdeb-528446a09616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623676, "uuid": "3061e009-529c-49f7-a651-6fd65b0c6795", "value": "1536:Q7WQrr9H52YhnhuYRT1lXJU+oQSZndH5mObIL8NNtA:WNpRT1lXJeQSpdHTILgN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623676, "uuid": "ac6d8224-7b21-4c56-b6c4-a1289c993eb5", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623676, "uuid": "6115dbf3-9cb0-4b1c-a563-bec0bf7886ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623676, "uuid": "504b40f3-3e24-48f6-adc4-7a8216529ae5", "value": "Neue Ordnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d079e6-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596570, "uuid": "c04e2556-1fc1-4cb3-82b5-d23961399d8f", "comment": "Malware payload (Mirai)", "value": "d7f70628afb02d3b689ba40cab1feb89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596570, "uuid": "6e4b4339-28f4-4a6a-b392-271ee1698bb5", "comment": "Malware payload (Mirai)", "value": "3a2b49c91728113e0e48ab09a67afad0eb79f46ecf1ef6a2cef5efdb43046734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596570, "uuid": "25e8f69c-70c0-4030-8fbc-4808424f8410", "comment": "Malware payload (Mirai)", "value": "473a80a9ad22f260e11295c8a104da6a02374659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596570, "uuid": "b2ac44b6-b778-441f-9c70-b4538ea618ca", "comment": "Malware payload (Mirai)", "value": "ce80b5850c0e6557c464b9cb1384251dbc0f27d292701759526698892156eb337c418445fda641210b9f7ae33f5d0576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596570, "uuid": "3ec9f788-44eb-43e1-8d2d-3eab7fc94b3d", "value": "T182530A857C81AA29C7D0577BEA9F508E3310A7D8D0DB7347CC144BA47ACAA0F4D6BB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596570, "uuid": "ffd81681-55ea-49dd-b5bb-9be8422a7a84", "value": "1536:HcmpgG6QUMrhBNnMETn8uGfU08atQl11EhWD5Uz27:8mpDhTn8I0xal10q55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596570, "uuid": "1d70f3a9-28d8-4074-a4e8-2d223d1b8a2e", "value": 63244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596570, "uuid": "23afd4fb-f710-46d8-a831-677b06154e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596570, "uuid": "8c41a9bc-5dae-4a0e-a56e-b159a293f24f", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36764e3-05f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770669685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770669685, "uuid": "5568a2f6-4b6c-47f4-868a-2b2d87cdbcbe", "comment": "Malware payload", "value": "dfefbc8ff7548d73148d117bf3827c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770669685, "uuid": "2aec5b99-01b3-4250-afa4-7b02191e328b", "comment": "Malware payload", "value": "3a829180661e519e2b3388b182fcada59cc005906406a716c9d2677a524ca40b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770669685, "uuid": "ee99959a-5e90-4aaf-af8f-7a4c18f339dc", "comment": "Malware payload", "value": "cf3ee209a1b761207cdbcc90926ab3523d0594f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770669685, "uuid": "7df6f47b-1d26-43c1-a668-54c148661314", "comment": "Malware payload", "value": "fca845de34166da860beeeb7ba59d65a25ccff6c82e47357da5b694e359f167a09355f1b65c02571e0d42f5d8b869da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770669685, "uuid": "a524a591-b274-41fe-883b-cc651ee4f40e", "value": "T1FB07F955AFA289D0D315E634CD26E630DA70BD245A3683EB2431F34E9E37740AF6B934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770669685, "uuid": "f05e42dd-c814-4582-ae47-9ede298ad8b3", "value": "68e691e78fdc68cb9b20dff32de12042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770669685, "uuid": "cbfabedc-60b8-4810-824c-3e7444c46e0c", "value": "196608:VliyhOIMK4FBz8Ga3/LY0LOBmWPH5NK4GQ:VlUIMx0SjH/KbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770669685, "uuid": "a36a8fd6-efcd-4786-8597-009f338089ea", "value": 17896960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770669685, "uuid": "4771d316-330e-4e18-92d2-f3bed01242e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770669685, "uuid": "5008ddbe-ac7a-4b84-8215-23d633932911", "value": "3a829180661e519e2b3388b182fcada59cc005906406a716c9d2677a524ca40b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c489cb-0587-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770621311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621311, "uuid": "e79e0b39-08fa-4a23-9b2f-276bb8ecbdc2", "comment": "Malware payload (Stealc)", "value": "ec28fdb0ccefddd386c166c236ebbe44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621311, "uuid": "1971d627-0939-46e8-8ef9-c0387b0a81b4", "comment": "Malware payload (Stealc)", "value": "3bd9d247fc0d9557e92b517bb25d33248f884007c02cfc459359c6f3b8fe22cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621311, "uuid": "f95c6373-e51c-4390-b03a-66f4ce4588f3", "comment": "Malware payload (Stealc)", "value": "023c3a1696e87369e65cf33cfb4f8ffa37359182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621311, "uuid": "686096ac-1dce-421a-8105-fd165348a4c4", "comment": "Malware payload (Stealc)", "value": "7bafa2f07d0e104882664b99905b32676738b0cff0cd521b1c704ac8fa41e363a7c5ab6a98bf1aa3c31e6ce128d82824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621311, "uuid": "d4260d03-e4e9-4001-98f6-613a8794bd51", "value": "T189463992B89919A5C67FF13490AC7351763138A443333BD32A9925EA097AFC47B3F718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621311, "uuid": "95190e4a-f2fc-4cb9-99b1-70271208e7d9", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621311, "uuid": "4ffcaab4-b215-4369-b3d4-4dd5cf5891ff", "value": "49152:0dxFBRB9vbepc5hwwyqt2EVikloODL8IBuUue3yieZQjC0naSVENvgp7rnGrqWlO:SX9vOjk+yuUZ5G0J1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621311, "uuid": "758f3665-db3f-40d5-a4eb-ef7b54df46aa", "value": 5732992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621311, "uuid": "2ec88b79-c2a8-4f42-b664-83dc4480405d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621311, "uuid": "7b4f699d-bc22-4f96-8138-7f85b4ae5ac0", "value": "FixBoolsttrrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76511139-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596568, "uuid": "8dba12c0-cbf4-4716-a94f-f42da32c97b2", "comment": "Malware payload (Mirai)", "value": "b59f918ed5d1b585f8267cc4b9180e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596568, "uuid": "0122df39-8d51-4dfb-ab49-6e43e6ff6634", "comment": "Malware payload (Mirai)", "value": "3c54b06a36a4bc0d35bda907e1929ce34fc8f2024df6b582e3e3c2d355ee95ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596568, "uuid": "ed8e3500-6c9a-40c3-8431-39d24b0a0ef7", "comment": "Malware payload (Mirai)", "value": "a13d55dfe4a4472c6a7e789af859289c390ea618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596568, "uuid": "73aeab92-c9c5-428e-a835-79dfbd2ad167", "comment": "Malware payload (Mirai)", "value": "9d7a35ba67d8aba0c6d1cb82e10d5891634fac29327a316fc8bb45ef3122bfdc144a001794257b21d319055faf45cf4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596568, "uuid": "02d76734-6f83-4ef8-9e96-6749a78854fa", "value": "T191F2E595B882562BC2D1127AB7AE5B8D377173ECC2CFB217DD200B247A9650F1D22F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596568, "uuid": "ba9f2a2b-ad5d-4ab5-9b1d-26e469b9abe7", "value": "768:TCgvgvgbqU0G5OwQOe8JyrqVyW/pUBBYE7wvCOPpbUH6HVooaI/NPwWi:TCiFbqjG5Ol8JwqQp2vBPpZVlmWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596568, "uuid": "2f9d3fa6-1a18-4e82-9c74-63d56d475578", "value": 36032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596568, "uuid": "4d17a2bd-a973-4f84-983f-c47484377a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596568, "uuid": "9ca08541-7bf0-4964-bcae-0ce8b681b5c8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4ec1f-05b6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770641855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641855, "uuid": "ef17d938-773e-4d29-b0f1-25393858dd36", "comment": "Malware payload", "value": "ab6d22eb01b21b5f46e8c686fb9e5f91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641855, "uuid": "dd0a5073-f5d8-476b-964f-ed465613db35", "comment": "Malware payload", "value": "3d4fe1060e5040da1fa6bf7d71901f39c4b85d3fde04af94e400e93a3eab2393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641855, "uuid": "f1485c65-dd6e-4b80-a8be-2a8f6e959457", "comment": "Malware payload", "value": "e6d64eb5cf3ccd69068a57a573d2eafb52a90df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641855, "uuid": "12c1c16b-f2ee-4cdb-9e43-021c1cf2af1e", "comment": "Malware payload", "value": "97a7aa3eb24ff522a93bf40d405e2866fecab042cec3e56b618d8a4ab3038a8dd86d6b74a4dc9dc0857300aaa2dc7499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641855, "uuid": "dd3f31a3-0c9b-4cea-bb51-f588b831e940", "value": "T110B47C02BBD548BEC4A6C870875FD153EA76F0983122767B329A6F502B27E30DB2D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641855, "uuid": "99a4c86c-98ed-42ef-97de-ab7d8e1edbe7", "value": "12288:T3pzdWRy1IuTq7ZggHd1ltIV8qvFDbwFWd5+qbgW:T3pgcDT6Kqd3tIGO1wUf+q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770641855, "uuid": "f5174832-8b18-4d35-9b1e-a2622186125d", "value": 502336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770641855, "uuid": "409e2714-4c7c-4cb5-a962-4f0afcb37b00", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641855, "uuid": "7dd024a3-b8e8-41ac-b0e0-7b5c596723d6", "value": "ladflsaf12uerm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d9026a-0587-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770621348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621348, "uuid": "9393e87e-f573-4a9b-8a9b-9a841fa28e34", "comment": "Malware payload", "value": "718ad67812b6e7b394b9c32918bc7654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621348, "uuid": "8b3956ac-b533-45f1-9e25-e06cdac012c8", "comment": "Malware payload", "value": "3d5e57a27f74e3bc95da30daa9254b2e57940c7cbf9b0d248d98935e3f0c0ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621348, "uuid": "884cbdb6-7eed-4fa9-b09b-b9ce65ba9fab", "comment": "Malware payload", "value": "c6a608ee6aea10e4b9296eddef8d05626f05a20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621348, "uuid": "7f11794e-d512-4074-a01d-9c0a3278d4bf", "comment": "Malware payload", "value": "bc64864d8ec46ac514ba3c19944f89774ffe05c9cbb4ded9631ad5ca997ab91ca7742c7f53f10ce72bb4fb7e8791aa19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621348, "uuid": "b2bf47e4-d228-4dd4-912e-fbb57310fb29", "value": "T1FD464B42B9960961C67FE2349561A3613630796813313BD31FEA1A7A5D3BFC42B3FB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621348, "uuid": "b820aef7-610e-4952-a348-5a9a6f09d176", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621348, "uuid": "8d2b1ea8-23a4-46af-9941-acb125c26bce", "value": "24576:FyXhoQl9FTqI/0A3l8L0WNNs5hR/L1VbIH4+f9M5D15ixhPpkt6+KHfK1+3:FOhqI/b3KNkhR/5J+VMNojv+ofK1+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621348, "uuid": "1d72e469-ea57-4ee9-a0c5-5705d0ed6b84", "value": 5469312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621348, "uuid": "ecc6ff9c-6ecb-4d57-868b-7d08352f5d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621348, "uuid": "66d3b40a-1d51-4023-bb93-f16647b0f3a5", "value": "Glxis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ec4a24-05eb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770664297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664297, "uuid": "7e5f1f9b-2482-4494-8d74-0d9a9f7e3fbd", "comment": "Malware payload", "value": "3207703b6e6bd3b24c10c397aa0aff16", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664297, "uuid": "75563279-d00b-4e81-afcc-f378fc96f451", "comment": "Malware payload", "value": "3ebbcb3e2475db4d0e023110852080455ee331bb71256803fea2356a121fa5b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664297, "uuid": "a0957250-7c40-456f-9ad6-d242eaaeecf8", "comment": "Malware payload", "value": "4b49c3e48834792f40f2fd4c6ecce79e5ce73488", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664297, "uuid": "ac8da487-13e7-47c3-9c08-0ff6ea0efe4b", "comment": "Malware payload", "value": "39a8e506713f33ad9e8e4d4b1cb72bd2f2fff194ff07b920aef5e974c9c3716a42bdcf221421aa93eb0712dcd03fbd22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664297, "uuid": "9b7ce362-cd27-4696-8308-de0705b08116", "value": "T1AF14128F8A87E317C80650F78E857F17DA6E925839AC050F5B24D933A38D6DB4B4CA52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664297, "uuid": "5d8e23f9-670a-43cd-9332-7d671d2dc6c9", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664297, "uuid": "dcacaa9a-3dd8-43c7-9bac-39d8ca30a6b1", "value": "6144:KPMeb1zPF5huOsYzNc2iLkJ5j2L2soDVZ:UMeBLF5zsYD12L21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770664297, "uuid": "acb0f779-771b-42fb-a959-3b3b116767f0", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770664297, "uuid": "0b7161cb-2283-4610-8ba5-389c965e6a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664297, "uuid": "525a6799-8367-4b2a-a7b9-ce8bcb7e7a36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820a5ea2-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770632235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632235, "uuid": "b5eb45c5-5d9e-4f86-be6d-ab49fe95e6cb", "comment": "Malware payload (GCleaner)", "value": "f7a1a1e0e14f2f0ca782946aa29091ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632235, "uuid": "ffeca074-8389-42e7-91fc-4dc4c61fd5c2", "comment": "Malware payload (GCleaner)", "value": "3f432d2353e56a69760a93b50594a3a924c706dd597b6ce66ea88af857a50c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632235, "uuid": "f9e5fa2e-f347-484b-939f-b79c2cca9901", "comment": "Malware payload (GCleaner)", "value": "3cb0dc5695d071f6b8cf103f4f39975ca2df1ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632235, "uuid": "757abb6f-f9de-43e3-9304-376782f91981", "comment": "Malware payload (GCleaner)", "value": "e859727704271127bd8b93929246cddce533ff428536b7f452bd523c03ef70089a86744b31eaa4bc86e45a589ed314a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632235, "uuid": "2db1f11e-0b92-4b2a-8687-40d01c76bc54", "value": "T1FB06E0F92076C422F22D267CB53B9177BBAF699639396C4713641DE492690C03B8F18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632235, "uuid": "e1fa2087-e8c9-4e7c-9085-7e465b066bf1", "value": "4238e25dd8de3a93d062885942af50fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632235, "uuid": "b3120dbd-e01e-4d7b-afa1-b6812f497624", "value": "98304:TQN6pZbesXkYkxMqFKjnf2mdrrvOAqvnrf4b5FQoGUTJt3T6vr:TRis0Yjdn+K9Erf4NGU1tjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632235, "uuid": "68fd7a8d-933a-430a-a6ed-920b98a5ee7b", "value": 3860992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632235, "uuid": "a4756b99-99a7-418c-9460-b99bfe41bb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632235, "uuid": "75e705bc-810d-481a-8f25-d0765ede6e92", "value": "f7a1a1e0e14f2f0ca782946aa29091ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf201fd-05e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770659768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659768, "uuid": "f6800b12-bac8-4a20-9a7b-2ebc646a6d5c", "comment": "Malware payload", "value": "3ad9122de21051149185068569541594", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659768, "uuid": "e354c615-af58-42dc-81ae-56eaa1fbbf98", "comment": "Malware payload", "value": "41d6782f58aa79616ce21b1815f388f76a56d0b98a7db22190b11ccb7ebb7be6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659768, "uuid": "083f3875-1a3d-467f-87de-764fef05726a", "comment": "Malware payload", "value": "dec0419a780af710147ce6d89ea6bd60e39317d8", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659768, "uuid": "8b5548b8-e07c-4552-a448-8840276d39b6", "comment": "Malware payload", "value": "216587b8076d469b5dcf5d9d9bc60ff5e61de26b15f4ca695ebab99534fb387ee857022aa33dc16e23ff42b477c099f8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659768, "uuid": "c4fb9c9c-5263-4ad7-99f5-12ac676555fe", "value": "T160753379D7412D63D176CBB2764ADE316C30658CCD89382A52A0BBDB489F12FCB5D3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659768, "uuid": "b342aeb2-8667-44a9-b9c3-ed454d38b1ae", "value": "24576:Wo5XYMQpV0OVKQtH03FUzZemcnm1eHhd+tRBCbMEyJn1GCOaxK9ZBvcrd6n0JLUU:dQnhKy0GzZemcVhIsQPJLuodu0ambh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770659768, "uuid": "8c167eae-9743-4c31-845a-e679e20827e8", "value": 1654708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770659768, "uuid": "f5eaa396-7c44-44c3-af20-79f8f258a914", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659768, "uuid": "9ed90ecb-feb4-42f4-b281-5a7628ea1f26", "value": "3ad9122de21051149185068569541594.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072d6489-0601-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1770673691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673691, "uuid": "68be6b7f-faa4-47e5-ad35-8ad81562a85b", "comment": "Malware payload (DarkTortilla)", "value": "05210f90bf4e6589cbc0b385b0f27d18", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673691, "uuid": "21ca9e84-6216-4537-b422-fba5a177fc20", "comment": "Malware payload (DarkTortilla)", "value": "430716375e71d197cfe9fe4496ec52028498eda6ad17d47005b37e55cae97b07", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673691, "uuid": "9761f34e-dc6c-44ab-9671-a7d098f6bfa6", "comment": "Malware payload (DarkTortilla)", "value": "cf6d51e316db9ba60a4fe677d9cc8c7d27a1c6e4", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673691, "uuid": "300d846c-2d28-44a5-aa1e-bbf6f4ad357e", "comment": "Malware payload (DarkTortilla)", "value": "38dcd263056d695856d9fee5a5cd5d488cdb2e1db7eb092b7133938ecbc1974baeb3c47d682f6a16858297dc76d57b55", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673691, "uuid": "72567ac4-a11c-4449-b7f2-d55604d2a99d", "value": "T19D55F11626D44AA4F4BFD734B67C116843F0BA1F8A22EB6E6F4901F98821F4DD162773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673691, "uuid": "0904b2da-8159-4f89-a327-326a1fb831ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673691, "uuid": "7a99e396-34e0-4db7-9abf-b6b4948558fe", "value": "24576:y/kfd1HK6/XZfSxkNFs5JRkgjua8LPzP2:Nfd1H7JjF2JKcm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770673691, "uuid": "c69451fb-8f13-4937-9f0e-c7b734360310", "value": 1400320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770673691, "uuid": "d20f06cd-1f23-4364-a2b2-51de136d3363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673691, "uuid": "a738d385-867e-4dde-b5c4-9e417a05c045", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5c64f6-05a9-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770636008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636008, "uuid": "62c9a07e-f5a5-4e42-bd3f-d43c5cce438f", "comment": "Malware payload (QuasarRAT)", "value": "a3ef797bce423139098ca605be23c4df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636008, "uuid": "04b66f07-8f75-431a-b3ce-b8992aaeeeb8", "comment": "Malware payload (QuasarRAT)", "value": "43085b37cca2d849614cdc295e415840bae6cea1df58d75ad14d1ba3270951d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636008, "uuid": "6e04b30d-8aee-47c8-81d1-edde2e37a68e", "comment": "Malware payload (QuasarRAT)", "value": "08283ba1b8edacf45f19015803a1d0339c353659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636008, "uuid": "b98f3a42-21a9-44eb-a93b-0e54a48f6251", "comment": "Malware payload (QuasarRAT)", "value": "7da6351fc29c4a3e08fc7a13e5c851ee5c5ad97a33ace53dd5d2cd09c6b932be95418fb08a6939c1b11ce227cc918403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636008, "uuid": "af95bc50-dcde-4862-8644-6bfe70a48180", "value": "T1AD56AD25030D8194CEE6753C64671352DA30FE0C913CA7A58FF4DAA56DFFA6069AE23C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636008, "uuid": "f793444c-3f56-4076-a5d1-faffbb9e1da7", "value": "092e7fdfcfc8705a24bc0d24c8f6d4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636008, "uuid": "bf44016f-11a3-48c6-b68e-686d542ef717", "value": "98304:vH2pOfs2700V14QETtNAq+lwcg++L2/m3jd4C1fCDExR2XWzy:bZ7VSXT3AFg+BmTdn6DExR2Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770636008, "uuid": "52d58cd0-f368-44ca-9376-3dd9cbf83da0", "value": 6331744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770636008, "uuid": "48b39ad4-83b3-44d2-a5ed-d9586944d0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636008, "uuid": "c42dc265-b93a-4556-bfff-ff2aa8cf3a7a", "value": "x43085b37cca2d849614cdc295e415840bae6cea1df58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727ca39c-0582-11f1-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1770619324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619324, "uuid": "845c35ad-1bb0-4470-a8e2-8d95b3777b4a", "comment": "Malware payload (Hajime)", "value": "a604119d16c8381124730c79cc844964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619324, "uuid": "dbd9ad5f-9d76-4371-ad30-8f0d4f594113", "comment": "Malware payload (Hajime)", "value": "434fa28d4e8e1a113579214fb15a43909b8c068f01beec16a9d8ae363de6cf4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619324, "uuid": "c3eb6c07-4a0a-4633-9ab9-8cf06b1c35ad", "comment": "Malware payload (Hajime)", "value": "8bceb1235220b39ead825f4e1d13130bcef7cdcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619324, "uuid": "c0ee1add-fa54-41f3-a1b9-c6cf38a5ec63", "comment": "Malware payload (Hajime)", "value": "e96e14bce56f7eb9e3a203eb50b78db923198c376737a90d5599310988aa11b2b58c3d61c989282658b85aaa854f6f54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619324, "uuid": "b870a062-1955-40e0-8a53-efe212fecfa5", "value": "T1EFF2F24633943B73E16255F4E3BDAFCB601E7D649FEE242BA4403A6270B310D248D81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619324, "uuid": "b20501ec-06f8-450f-a658-5ee2b13ac08c", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8b:yYI0ARqw1qAEW67UIWi7M8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619324, "uuid": "164ea4be-d044-4296-8f75-5407f0052982", "value": 34960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619324, "uuid": "d9de1bdb-030b-43c2-af51-5d69894ca34a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619324, "uuid": "198468c3-3200-4f3a-b665-e9ac11783ed7", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20efcec-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646489, "uuid": "558faf35-39f8-42b5-be9a-2034cf5dee6d", "comment": "Malware payload", "value": "28a9c35aa9fc5b66b546257ae546ae80", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646489, "uuid": "7c5094ad-86aa-4d16-9fe8-5a8fb064842e", "comment": "Malware payload", "value": "436453a192a88298463a7611b94db74ec554de18a8c70f5a5943dded155e9770", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646489, "uuid": "b0bda09b-db1c-4957-a99d-8591d5353e93", "comment": "Malware payload", "value": "3bf27265267db0dc1e386420af2dc5f4680aba49", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646489, "uuid": "f2798b6e-ee54-4482-a156-69b86ac4ee4b", "comment": "Malware payload", "value": "46cc1d3a9cba575345f2de5a2829ef0c5398de43b0321a86340af1dcbab3cd03da12de4708be0c2da1ee6d078f42cea3", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646489, "uuid": "34f055b1-cbc2-4429-a816-49e07bd785e4", "value": "T192F28E1176DF92087072468D0BAF06744F6FBA9F1E7E4089448EEA8A8FD35159D873B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646489, "uuid": "0f22a77e-c195-4478-b0f4-808233ffc1e4", "value": "192:jfI/nwwbb6XfI/nwwbLWJB3PuTqOGPYc5UFC+ah4L3KrWZNmqYc+Q3CNJg7igm63:2efB5d+ah4+4mqYc+YGvQg/3JYKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646489, "uuid": "d6831fe7-041a-4102-8ebc-5e4e1dd6336c", "value": 37056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646489, "uuid": "320055fb-41db-4288-970f-a4e937cc9657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646489, "uuid": "9555f049-dbf4-428f-bbca-5016df101ca1", "value": "436453a192a88298463a7611b94db74ec554de18a8c70f5a5943dded155e9770.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261d52af-058c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770623491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623491, "uuid": "5b4d1a6f-76cb-4d95-9b32-43df66fa35c5", "comment": "Malware payload", "value": "29b06b98c96af3d6e883dd7e3b1e7b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623491, "uuid": "f4dda11a-b247-4fac-8f5b-3dbe94b44aaa", "comment": "Malware payload", "value": "439536949bbdfeac8c5ce0d852cf32d25413a16ac4a02289cf444997efca098b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623491, "uuid": "4b15c38c-f948-4416-bea3-d91a569912fe", "comment": "Malware payload", "value": "a17174de9ea22a8088912f5c613500e8d3c50806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623491, "uuid": "0d0846c2-b509-4cf1-aa08-3ea6fc14a758", "comment": "Malware payload", "value": "60b038ea2955da974cac4bf51f0dad140593f56d6dfe9fdbbe0f5066bf7f4df10e9aa1256dea350a9c87d4de1a2bb02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623491, "uuid": "682a9972-fc29-4c97-8f44-2de5a0db2cfe", "value": "T124966C83B9D644A5C66BF138E051522077327C5983313BDB6FE805AA0EBABD4173EF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623491, "uuid": "7d0a9142-1e72-4b68-970b-dca3489f57aa", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623491, "uuid": "2668b83a-6bb5-4200-b89a-d55641ac51ab", "value": "49152:yS2Zm63UtVE/kgbU5XYqsDaeoCWJWKLFeMV+CK0nbtHbQz6U4v+eLUJMVbw/+YI8:963yVi/2XCDaC+WKJdUClLwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623491, "uuid": "2d43dc07-9b32-47a9-b825-5771bd7c0b8f", "value": 9260348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623491, "uuid": "87c3588c-7ded-4d51-b14a-89944915313b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623491, "uuid": "7f84019d-0e97-4d77-b591-a3329199a6e9", "value": "439536949bbdfeac8c5ce0d852cf32d25413a16ac4a02289cf444997efca098b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0856a916-0594-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770626877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770626877, "uuid": "5ac6f061-72f6-4fcd-a1dc-8179cbfc1ff6", "comment": "Malware payload (XWorm)", "value": "bf874a3fc149d417339e52e5841fea98", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770626877, "uuid": "b00f55d9-bacc-44e6-ad29-46dc387d7935", "comment": "Malware payload (XWorm)", "value": "43d878b58f2c1c07abeb357855025c01541a30c78992a0942879d35591ab83de", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770626877, "uuid": "0e2579e4-fe5a-44ae-b567-f7ff46d73da1", "comment": "Malware payload (XWorm)", "value": "06573bf6894ba4a4d66df8409cfbd38f5ad4c2ac", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770626877, "uuid": "cb84061d-6934-44b3-b833-2784dd19d149", "comment": "Malware payload (XWorm)", "value": "67c21f2c7097023889cd97590af038712a53173dc0485f1b62a45dc4c4d627c316c1f04167932cfec78b40191ee7304b", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770626877, "uuid": "22afe7e9-691b-49e8-b30c-b24b161c4f15", "value": "T15EC18E5A2C3293A2CBDBB87DC033997F05B3B90392C19441EE1A2CD2D1FD69D011DA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770626877, "uuid": "94ce977b-13dd-4136-b72f-f628e5c20581", "value": "96:Lxn52wD75c6YOjk/lPP7KaOqgGXnWJ8MIiXUF5oNVxDLh0RtHz4lOXcj93SJ:LL75cnOjkNPmaKGXWaMIikoVxDuHz+Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770626877, "uuid": "09f0121f-e698-4f79-8ed4-51fb40c8f47a", "value": 5995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770626877, "uuid": "ee924a45-ddbe-4315-8ea6-9321c1a44b28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770626877, "uuid": "dd37f5e1-8ab4-4f66-a44c-1ca1f932c4d9", "value": "original_draft_bl_shipping_documents_docx.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cae5f76-05b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770641139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641139, "uuid": "af709256-8915-48ac-b5f9-16e0ad0ef682", "comment": "Malware payload", "value": "637fe634d506825b2705a1be7eed51c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641139, "uuid": "0d0ffe45-05ea-4a2e-9098-b6b30793a289", "comment": "Malware payload", "value": "44c83d5d24a41dfa3f9c98652913a993c03c88d14baf9d8d895ed90c89d3b854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641139, "uuid": "a515176e-7e06-4c6b-8c78-fcbcd5205aba", "comment": "Malware payload", "value": "b4ff0dacf6e3c8a950e159b2317be933c0fccc88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641139, "uuid": "12210781-c261-4bea-a102-8c1e48652683", "comment": "Malware payload", "value": "fb09c958b6014802937dacf2471463331718c622f11aaa4e062e8af1ac744c3c33da23423c8146c3f21f1b430777c4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641139, "uuid": "f691d6ea-964d-43f0-9e86-0912e9b443ba", "value": "T10EC35B5773A541BBE577C278C9530F41DB72B8151B60ABAF07A446862F237E08E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641139, "uuid": "40447ab6-6e38-47f4-89f8-94d30ab5dc8f", "value": "120744e3ffbe1dcdcbc8d902f1e6f634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641139, "uuid": "d62b1800-4826-414c-af97-bd890cec3a67", "value": "1536:5cnVIp2UdattQ/S4HZk5lrHJISXSt1F61qVuJdiRPzYBsWfdw9dlJjLTRcNRg:5cVO6D45aHJImuUqVOdiPERA/LTRcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770641139, "uuid": "81e98dac-0b18-43cf-8a23-cc061d7a0ba3", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770641139, "uuid": "c7b58bd7-4fa9-46da-83f3-c32589d7cd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641139, "uuid": "ada320fa-6752-4e40-9cdf-66872f01c6e5", "value": "aliww_win7-11_v1770095297.20619.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe01682-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645358, "uuid": "1806349d-4989-4554-81be-50a00170387b", "comment": "Malware payload", "value": "0a764f5f60dc8de2dedd847083d26f34", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645358, "uuid": "ff930b72-2fdc-402e-bca5-0a2f863a5ae5", "comment": "Malware payload", "value": "44cc63f709b370b43a1b6eda8294d70bfefe3726014037b2cb98cf006804e511", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645358, "uuid": "65c3cc84-835a-4b6b-a199-691bda2c03b1", "comment": "Malware payload", "value": "9aef716bc74b4491364b54c3cdc00d369c3ab0b9", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645358, "uuid": "d9b352fb-f38c-46ae-b85e-170f2a6434a3", "comment": "Malware payload", "value": "cc11369e87aa2e024ba0b6859a212e092cb2e4797cf864bf5b64a895a2346c65d1d63fcdf596b58e5c0a14a0b3a0ab8c", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645358, "uuid": "d71d6be7-22f5-4410-9ae0-c0d59c5fd02e", "value": "T11FF28B21769F960870B346894AAB06740F5FBA9F0E7E414904CDEA8A8FE3525DD473F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645358, "uuid": "7284bae2-39d3-4aa6-8d17-a1713913d060", "value": "192:8fI/nwwbr6XfI/nwwb28nM0PPYGzONNNNNNNNNNNNNNNNNkughHc5UFC+ah4Lor3:fag+5d+ah4M4sICQKz+ph/3FQRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645358, "uuid": "3e953544-06e6-410d-a8a0-2ecd5a50d7de", "value": 37104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645358, "uuid": "792e3847-be5d-4658-a645-e5ac2bfbea8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645358, "uuid": "f4f20e15-5bb6-4d38-a530-f507e22dafdd", "value": "44cc63f709b370b43a1b6eda8294d70bfefe3726014037b2cb98cf006804e511.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b463221-0585-11f1-a129-42010a9c0007", "comment": "Malware payload (MeshAgent)", "timestamp": 1770620655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620655, "uuid": "ea687b6a-c9a0-4bca-b3a8-66a6c513329f", "comment": "Malware payload (MeshAgent)", "value": "3c8604f9457d0a2039bfeba290a2a161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620655, "uuid": "dcd6071d-1917-4a4f-b98d-3ec315a4a7e2", "comment": "Malware payload (MeshAgent)", "value": "4577c3c76606f6ab348b11eb4c0a1ebbaca508d543328158e157423c24d50bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620655, "uuid": "8e3b94da-1336-4667-b6e2-550fb71b2fe4", "comment": "Malware payload (MeshAgent)", "value": "a2086027d695865fd649ea39817b71b7a4c1e00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620655, "uuid": "10a9d122-91ef-44af-8545-e629d7ff2aee", "comment": "Malware payload (MeshAgent)", "value": "dff0fdf6d0cefc3b2b06b45dc01c7e852e5cab4048d0e3315cda2fecfab23c28f51573727751d4f41ac0ecca7dd828aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620655, "uuid": "18a30bcc-2823-41b3-a95e-fafc4c6aba86", "value": "T184F5F13FF28BB53EE06A5A367A72E110543B7A61A4128C5296ECF84CCF255701D3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620655, "uuid": "0acf044c-bf34-4cd9-b6f7-070ad25fa555", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620655, "uuid": "f193a2cb-128d-458c-af5f-d0221ed5dcf1", "value": "98304:d5/IVw0Cf9E3lhx7ku3T33OnuMNucySNrlhk:vAVw0Cu3lhx7/TnMNjyak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620655, "uuid": "2f9ec73f-0894-47b3-8e6d-cee8b751fdc3", "value": 3550078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620655, "uuid": "081b0d36-91d1-4a04-8719-8aa96077d644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620655, "uuid": "ba907d25-29e3-438d-b9bb-8aec65c1133c", "value": "3c8604f9457d0a2039bfeba290a2a161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ac6113-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770670739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670739, "uuid": "29397040-8773-4031-a8e4-dcbfab403176", "comment": "Malware payload (RemcosRAT)", "value": "79124d52744b28fa0c5c5e347d4a8dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670739, "uuid": "b1b56b1b-c9cc-40be-a413-f7af8edd903c", "comment": "Malware payload (RemcosRAT)", "value": "45b6fbd68cb8c8991460337e5782c41f77ff0ebf84f7eebc36b1601e4de425de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670739, "uuid": "22f71117-3645-41d7-85e6-d863078a7088", "comment": "Malware payload (RemcosRAT)", "value": "f1ddd7186356994a0be548bae595942a1ebb2327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670739, "uuid": "fbc10a29-416e-4757-91b7-44cd7130397a", "comment": "Malware payload (RemcosRAT)", "value": "45993e680cf81f68dd0c006ecd1d04ce52f76fc1ddb00d5863897d264fa10714ff398ea84d02563a65142c0db6b209bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670739, "uuid": "9b775155-76e0-435f-aa83-327a9ff3e1f2", "value": "T1ACB4BF01B6E2C1B2D57654300C26E776DEBCFD202835997B63D60D57FE30190AB3AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670739, "uuid": "8fa875ce-b08b-4ad3-a442-df92abe3accd", "value": "1dac0fb7dad849409daf9e23353df461", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670739, "uuid": "5304ed96-58d5-4f1d-b3e6-36c86a58096c", "value": "12288:2vSPwdNnNZGA3/hvESbvqCqYH2v595OuVIsPZ3VL:2qPONnNZ33/VY42hnOmZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670739, "uuid": "fb78c397-b540-41b4-a1d2-dfc39ce040f4", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670739, "uuid": "d720cb46-0538-4d6a-b369-68a681db47a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670739, "uuid": "c48544ed-2933-4ec8-8829-3177e23130e4", "value": "45b6fbd68cb8c8991460337e5782c41f77ff0ebf84f7eebc36b1601e4de425de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d88bc0-05f2-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770667548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667548, "uuid": "714fad45-aca5-4c00-b598-51453c9e94a8", "comment": "Malware payload (ConnectWise)", "value": "5dd64f77a2722d4b0498b0575d1b9c5e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667548, "uuid": "add42c31-8dd4-4a84-8ee8-c29668a74e10", "comment": "Malware payload (ConnectWise)", "value": "45cb9f31d81e497fa60cc9f07312f11534f1067b44acfd2e0ebae7616b807161", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667548, "uuid": "bd492a8b-4ec3-4474-97d0-9146557257ee", "comment": "Malware payload (ConnectWise)", "value": "f53f4aba64c935fa9e61a1c60bd931198983672c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667548, "uuid": "93132f05-e141-4011-8215-23acd1bb4819", "comment": "Malware payload (ConnectWise)", "value": "e09368207e48ebcc153c401d35584b45a0a69f8fe4f86bdcafccbb69d62c508f57c9fe30b8b126ceb0ecf2738dd26b9e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667548, "uuid": "352c4ec3-7244-4bb9-b9e1-ef9555a1fad0", "value": "T163A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667548, "uuid": "5afc76d9-a5fd-4d58-9102-f5bdeee7edbd", "value": "196608:LKaLNkbgMi4QwKaLNkbgRKaLNkbgZKaLNkbg:DWgMiH2Wg1Wg9Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770667548, "uuid": "ad732b14-4720-45c9-a2d7-840b57e9a640", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770667548, "uuid": "0dd95ff9-3033-414e-a493-bd0ed1c5cc7d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667548, "uuid": "d5922c00-afff-40eb-a7de-f9f2c80bb2e0", "value": "SSAstatement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24e8534-05e5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770661979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661979, "uuid": "c7cb4bfd-68c3-4858-83e7-4487ccf0545a", "comment": "Malware payload", "value": "629ad5b421a406af5f2fd98e5aed65fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661979, "uuid": "1b92a77b-9f51-4a6e-8e8f-366642805a4a", "comment": "Malware payload", "value": "4604279554eb880e1e72618e96ef905e6853e415664724cc61c13c025dc5605b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661979, "uuid": "7e0a1846-aa60-418e-ae1f-1069a1ed2041", "comment": "Malware payload", "value": "ccc1e28f9b61dda3430c008634cebe9d739f61dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661979, "uuid": "34634f70-34a8-4d60-b7af-e22be67c48d7", "comment": "Malware payload", "value": "77e8e0325990dfb9d894337789874c0a44bed2abf1e3e66905ffac139bc0f916a6db2234dbbeeb569a6991716ff9e30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661979, "uuid": "324cde1e-5a18-4bdf-aeb3-90ee72fcd925", "value": "T1D073F74AB9C19B15C5D822BFFE0E118D331367ACE3EE7112DD245B2527CA96B0B7B412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661979, "uuid": "3af2325f-1a52-42ce-87e2-754f9e758b83", "value": "1536:NanWlI3IAcMCQjZnZvr7YbmTPFtfrRUIp+htp+ebmlVyxli/QX+Ep:blFAtCSZGbmbFlr+Ip+htpZMQXXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770661979, "uuid": "c76b8cf4-e7c8-46d7-96f7-1b5f004aebb6", "value": 73392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770661979, "uuid": "15e7d901-9f82-4588-a387-e834874412c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661979, "uuid": "6a90a20c-28ff-4560-b08c-a50f15a0d8f0", "value": "Hilix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15f0269-05eb-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1770664500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664500, "uuid": "c265117d-6e4a-42e3-984a-1bfdcffcf53d", "comment": "Malware payload (RedLineStealer)", "value": "2681f5750860cbeaf568329fc36a6c4c", "object_relation": "md5", "Tag": [ { "name": "95-216-2-96", "colour": "#A47FF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664500, "uuid": "a3fdce94-9a12-4aac-bea0-f1b6a879f983", "comment": "Malware payload (RedLineStealer)", "value": "4644d296b810ceeb381f5d28cf9f5fb2cefde13e5446b6cd0bdd81949f2dba91", "object_relation": "sha256", "Tag": [ { "name": "95-216-2-96", "colour": "#A47FF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664500, "uuid": "dbf58f13-d9b3-494c-998e-ddcc360ad23e", "comment": "Malware payload (RedLineStealer)", "value": "27a3ac507ff73a7fbca0af3cd5c78963387bb6fc", "object_relation": "sha1", "Tag": [ { "name": "95-216-2-96", "colour": "#A47FF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664500, "uuid": "8e163edd-dd3c-48bd-87cb-809aa245a1e5", "comment": "Malware payload (RedLineStealer)", "value": "157de60ad20aa84f26adaaff9a79ce03c4b52086f3ba4f64f2240a00b60eaf44b0e8c8fa0c9d960ce85976f9cdffe159", "object_relation": "sha3-384", "Tag": [ { "name": "95-216-2-96", "colour": "#A47FF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664500, "uuid": "98797445-eaf5-4be0-a90a-6307307ab85a", "value": "T19F855A28AAD406B6D577D674CAF542B3EEB1784233309C8F0296D3451E33F926EA631D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664500, "uuid": "3f79de94-22dd-4164-b48b-affe990c8161", "value": "147b07014c578784e05eb6eff7231cec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664500, "uuid": "aa61245b-a76d-46b3-b22b-75855616b9c3", "value": "49152:/3WB5MQAOWcm2AxNZu1mHV+mQ/1cU92dT:/hQAjci2f2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770664500, "uuid": "77f04fe2-a401-4dbd-9ce7-6df02cf74439", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770664500, "uuid": "68a7d3af-0cbd-484a-8e48-09c63d27a132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664500, "uuid": "795037b5-9e30-4e39-a767-0057ee018ac7", "value": "build.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf0d61d-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770670987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670987, "uuid": "ab7e9f52-b025-4472-938f-cca2903406c1", "comment": "Malware payload (RemcosRAT)", "value": "f3998077f2e86e9426266c051a7e4be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670987, "uuid": "a0010597-5827-4761-bf17-89851a9c17a3", "comment": "Malware payload (RemcosRAT)", "value": "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670987, "uuid": "80ae42cf-a622-4c0a-ad72-5e54ca7cca72", "comment": "Malware payload (RemcosRAT)", "value": "ebe7647a3ab462a5b4c6e10788d30f48afea4886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670987, "uuid": "4964a75a-7d11-43be-a557-9dc0be4904e8", "comment": "Malware payload (RemcosRAT)", "value": "bef9581a5d620ecf97c413f71c008563c809eae432eb47ff8ac762b2b65a9296eaca3e561e1c676694ec63a0553097c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670987, "uuid": "22911a7e-c378-4ab1-b7fa-7881fc70f0ff", "value": "T144B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670987, "uuid": "0838705a-9fe0-4c07-a0d5-d7d7cbec50fc", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670987, "uuid": "c91631d2-0d05-4fc4-a870-b21fc6b651a3", "value": "12288:i6pxxGI8gvGOHJpAbDYGxLhZ+sPZtOmPFN:i6pxxx8U+bDYGxLhZtZzPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670987, "uuid": "698db8a3-39c3-45c8-a85d-20802e05c333", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670987, "uuid": "4cfb25e7-c2bc-42ec-8ac6-f6c8401bb3e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670987, "uuid": "a4a64cfb-4595-4465-a3f5-7d92064332e7", "value": "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e857ce-0554-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770599632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599632, "uuid": "f498e509-36aa-495d-86b3-6912aa455bed", "comment": "Malware payload (Mirai)", "value": "3a48b19769eb8e43cd586af43a90d551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599632, "uuid": "1f4814d2-5f69-4ed8-9cef-97cc256e6899", "comment": "Malware payload (Mirai)", "value": "48788336e2b757eced0e3611857167ff048ff4fb20c6a85f61a7c0d79c93675f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599632, "uuid": "5d194700-d195-48ae-8637-9e8a408aa521", "comment": "Malware payload (Mirai)", "value": "ea877827fe6f43147d8c1a3e9c6bea050c843fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599632, "uuid": "40e0d942-9565-43c3-8fac-9cc01da8e1b8", "comment": "Malware payload (Mirai)", "value": "9f53372cc68028106977146eba7ab9d453dc2dd092cd138f590753bce231a0499f072dccde62b61faa338ec0dbb45fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599632, "uuid": "7a175505-40b5-4086-a059-6af01f8fb2e4", "value": "T1C704392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599632, "uuid": "1d5d29f9-4604-4b9e-842a-b1574e9d56a4", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55w+UXS:7eJpJUVD1A8n0YNgEJi5a7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770599632, "uuid": "df74d33a-6225-4d40-bb83-79aa41b747db", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770599632, "uuid": "ba9215e4-d184-4280-8450-bb800b929956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599632, "uuid": "2119d596-dc0b-4445-87ff-2a8c67c9b5fa", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6171db-05e4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770661348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661348, "uuid": "99754bd5-0695-4821-bc76-bf6e5f3e5137", "comment": "Malware payload", "value": "2574a32f22889ce0e24130ee1fe4d50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661348, "uuid": "eb9d15e2-0db0-485c-a441-6982c67d77a1", "comment": "Malware payload", "value": "49266c0bda5eb49dd33989b14e7b5b30d68db79ca7bd752afd5eac19a6b2287d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661348, "uuid": "03672abf-eac0-4804-9a8b-b0516ad75db3", "comment": "Malware payload", "value": "018a3bc48106dab4f394ee935b932baf4712e1e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770661348, "uuid": "ab71dbc9-88e5-4d3a-870c-60d84a7e3818", "comment": "Malware payload", "value": "c1920e8a613a15bf1aaa625f39a786b124290cf2eb9fcb767f3a4c226f06dc0443bf51c178918483fc40cedf709caf6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661348, "uuid": "04eb24d3-8881-42aa-a0a6-baeaf00e97b5", "value": "T1F4864941FEC751F1E90318724197B26F63345E058B29DBE7EB487F2AF93B6921836209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661348, "uuid": "d94e1001-0e84-46b5-8d81-057cd965bf14", "value": "8bb9cb7df4e43dd981f69dfe2a1c8a6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661348, "uuid": "9fbad13e-abb8-46df-9461-1868de3ed96f", "value": "98304:2psc6NecVTBIRv81y48z1WRHDFLDYqXf/WNbJKpvQwnGJPEbDkWt2jI:2akp1yH3f/oJKJnGJMbIWt2jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770661348, "uuid": "32a1b7c0-2bd3-4a3c-8a73-7f166fcabf5c", "value": 8341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770661348, "uuid": "7d1daef1-95af-40fe-b6a6-1bd448e85697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770661348, "uuid": "e9088225-dd8e-4ee5-ab34-6d8292c4c0f4", "value": "C46_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff09d9c-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632232, "uuid": "32956d03-b044-40b3-84ec-bdf99b0ed188", "comment": "Malware payload", "value": "9af6bddc5089c08547189e06afd70b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632232, "uuid": "789dcf3e-e94e-4684-8821-d87659e494f9", "comment": "Malware payload", "value": "49fe52eba31d2a3ddf75357cffd910ab99479e22ba126fdc2dd832caedd9706e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632232, "uuid": "0b9b75a4-8608-4b5b-8a16-c9dd70dd5401", "comment": "Malware payload", "value": "bd5702055bde55848778b5a887daf9cd9a9714ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632232, "uuid": "65db10f4-f9f1-4c09-8573-412e5097be31", "comment": "Malware payload", "value": "11c9163e5c4642a20e1d057eed9ef9e7f74c58e0e6bbf61c2a5f00ced79db615a6163c815b1852be97337c025fc0f1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632232, "uuid": "094bb84e-b49b-430d-b8dc-f34bf435400a", "value": "T12E74D0013782E587CEEC0AB045AF92FE0E75AE7769868B57F280F72E7C752C57929104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632232, "uuid": "a3a78592-93c7-464b-a46a-993b63b32639", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632232, "uuid": "42e12b01-91d8-41b8-a0cf-e44b1cce844e", "value": "6144:fQ606xV8H+lc7SGd7UP6Vk8YT1D2rxj85F75hvMMutRZYj2sEWI8:UecGGRUok8lkkMKZ1spI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632232, "uuid": "803bfa4e-0d7b-45b0-b4e7-f6e243143eae", "value": 363779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632232, "uuid": "92e4fad8-3d55-4f5d-a88c-d2fd6e75bec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632232, "uuid": "01370def-f3c3-4796-8af9-376111589913", "value": "Andenbehandl.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7f22aa-05bb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770643719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643719, "uuid": "efa75103-5cb3-41d4-a7e7-54065a6b4954", "comment": "Malware payload", "value": "fbc283ed10a0278dc895cb791f5a7b38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643719, "uuid": "36523b18-fe1f-4c29-a417-d9e7c56e3eba", "comment": "Malware payload", "value": "4c59c097fecbfc252622533ae0747660e33380947c2968cee5728f59e1826d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643719, "uuid": "3cdcc10e-3f51-45c7-b8d0-8b4886d83c3a", "comment": "Malware payload", "value": "9e88630d0cffc3751a3b82b037b856a7624656d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643719, "uuid": "958ab912-9020-4b24-8556-ac732f9fecdb", "comment": "Malware payload", "value": "170c4567073899e5f7917cf1161caa2e96acb039bde73e226e2b07095697127b8ea6016ff37acf0ec54e08ff7b944e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643719, "uuid": "e9d1b7d9-a9bc-4b6c-9f1d-13d7ee75f613", "value": "T1F0B42320B7316AF2C3F45D9C09CDFC9D9A66455012572ED3E9E005FE8689B039FC9DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643719, "uuid": "3478e463-2bef-4809-9567-299a9149b340", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGAQeA+0:hzfEtBkjj8t0D/p5fP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770643719, "uuid": "04fe5882-22b8-4791-b658-d63c65b4df35", "value": 524028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770643719, "uuid": "bd8d2069-962e-47ba-ac58-92241a0fa8b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643719, "uuid": "3f83de90-739c-48c0-ad95-fa7d62290f5f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08df195-05e0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770659774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659774, "uuid": "3f1bba94-c730-4495-94c0-ddf50e1c3782", "comment": "Malware payload", "value": "0502720f524e25071980cbddbb3e286a", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659774, "uuid": "970cfbcd-3ef4-424a-afe3-8cee6d54f1bd", "comment": "Malware payload", "value": "4d6048ca9f8d287a5fdb685012995fccdd8ed2f23adea6b585fb4449f1075da3", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659774, "uuid": "c77ec123-fb90-4f6c-95bd-ba8623788288", "comment": "Malware payload", "value": "8de6f24055e4b016cafd0dfae0f98118d9b23fd1", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770659774, "uuid": "295408f3-dffd-41d9-861d-9f2186208131", "comment": "Malware payload", "value": "33877931235084dcc3ab6f72bf1eed4452497eb4dd7a374bb1f7653ef8d6792f4315d1bcaf3c89566a5db85f8bc7e064", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659774, "uuid": "f7e9f6e6-5bb1-4388-8c88-fd13fb98cccd", "value": "T1FE65C0C4C8432870BB2D5811CB5FA62D241B70B362366E296E5872E8BE5D4F7CD652FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659774, "uuid": "15ffea8c-c637-4e5e-94e4-83eaaa32b5ed", "value": "24576:WH7rmUi9PhZ2kQy0dKp2FyXjp2QVEYmj07d/y5Zv/+wepU:M7rmUirZ2kQy0dKp2FyXjp2QVEY60Yv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770659774, "uuid": "1ea57e72-3fcd-4fb1-9565-972d71530691", "value": 1477839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770659774, "uuid": "49526d79-20dd-4ef0-995f-6b1f08b4a80e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770659774, "uuid": "27b34322-c6ff-4259-8fea-5306db26fdc2", "value": "PO2026021128790.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770cf850-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596569, "uuid": "8d26954a-fd81-48b5-bd8e-f2aecac22a04", "comment": "Malware payload (Mirai)", "value": "ade5f0995f90348af9a4e7e0ea56769d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596569, "uuid": "3625c7ec-9a4b-4634-8721-617e30727bda", "comment": "Malware payload (Mirai)", "value": "4df635e4868cdfa338a59a65846ff53e2550baad7ca1ccbb7601a1b010434499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596569, "uuid": "d2ae0b41-3de1-49fe-8463-a9bd86295647", "comment": "Malware payload (Mirai)", "value": "54d4793b021e4484955b899c8658266e2b9056c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596569, "uuid": "70e3d208-1bf8-418c-8990-0aab9f0356e2", "comment": "Malware payload (Mirai)", "value": "7dbe37723360d4c5b5e663e3eb6e9debcecba4e36a903f6c80025a539dd56d872f2e0403035cef3207b6a33556858de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596569, "uuid": "f05adce7-ae36-46d7-9300-290c7de458cd", "value": "T1CE634BD5B4019DBDF99BE6BEC0224E0DB821722160931F2BBBA7FC937D72168D846D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596569, "uuid": "e56919f8-b7c9-4b10-bd9f-464e960925a1", "value": "1536:bjN4CsoLRmhrTgSXH6fXQVr+/GWFLyj4KEfTi8BpYU5PI6L9X4O:bYsRm2/38i3F9IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596569, "uuid": "3df48bcc-6086-4af4-a39c-9ced145ac4a4", "value": 68476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596569, "uuid": "8b264c36-bda5-4bce-9d36-d07c57b20d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596569, "uuid": "d42bfbc1-3d5a-4ec8-a7ee-16db3196c535", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0d1bae-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770632222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632222, "uuid": "89c8782a-a246-46ee-96dd-c27d87ccbb35", "comment": "Malware payload (GCleaner)", "value": "295edefd9f4dc53c9a5b7e8066f83d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632222, "uuid": "8a9e5960-225c-4879-acea-025a21a3d291", "comment": "Malware payload (GCleaner)", "value": "4e9162d026d1164b93f77622dc37274af286299ee047d7295c1c0b47936adbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632222, "uuid": "fb2494bf-e0c1-482e-a2db-1664d0fd75e4", "comment": "Malware payload (GCleaner)", "value": "32c2ab4b1597857d668377938f73813792f9e9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632222, "uuid": "dac809b3-22a9-47de-a14f-65fdfb78ade2", "comment": "Malware payload (GCleaner)", "value": "5c68d6392390b63474e589caaf98637f1259e6d86140a39572b747e3a98f63a850fc845ce11b074f85c1a6ee211a39bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632222, "uuid": "1bde5014-f820-49cf-ba70-175c13aef40b", "value": "T1CC26D022F4A57239EC131AF7C959D35F51221E8D6B2AE101B2CC86F8F572C72AA3C51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632222, "uuid": "b2e5319e-2594-4799-9d1c-f4d1e2d5b354", "value": "4eeebe9c7cba6cf85504d75366422a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632222, "uuid": "e73857b2-832f-469e-b2e7-3bd7eec018d2", "value": "98304:yLJ1dEZRXIe6Ru/BbPKx9a+fQJCE/yLGfa2iLbn7/:yMRXITuJbnaQOGfli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632222, "uuid": "149aea87-eb83-4b08-b688-342b60d6fb26", "value": 4468736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632222, "uuid": "83fe0f44-ba14-4d68-8dfc-60cfad03e05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632222, "uuid": "958cdc90-e0ba-4eba-b436-e69ba286145a", "value": "295edefd9f4dc53c9a5b7e8066f83d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63370f3b-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770657954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657954, "uuid": "7afcd106-4a43-4b5f-b3a4-6bfa777c0e87", "comment": "Malware payload (RemcosRAT)", "value": "eb769a3f3c5806fa752e861813678fcc", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657954, "uuid": "d44a433b-35e6-4e08-8847-dffb774905ce", "comment": "Malware payload (RemcosRAT)", "value": "4f851818cf7895330d21b89728efcf7e056b7d5695796eec602e0d9ced761c46", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657954, "uuid": "25b85b57-7184-496b-83d6-7653e4ef6f00", "comment": "Malware payload (RemcosRAT)", "value": "91c2ee6a92712a273f23bf1e6552a86a7fb49693", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657954, "uuid": "343b72fd-168d-43e8-9521-72ec08825769", "comment": "Malware payload (RemcosRAT)", "value": "b2bf52540d8fc31883d90e1edd6b4a6442f947bb158e5ae77013bd0aae0cc633bc3cc9a5f1cdbf218ec402e6b7488bda", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657954, "uuid": "3f2f4fb8-98d3-43ef-893d-9e828313c24e", "value": "T17AB4BF02F6C2C0B2E67215300935E7F6DEBDBD206875993BA3EA1D67FD311809639762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657954, "uuid": "12b5e692-74a8-4442-a3c6-d98a88b8ab91", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657954, "uuid": "ad85ae40-811d-4342-8b72-cba3b6a43e27", "value": "6144:YHVFE8k/asWpO0KG+jWs8bQvA/xn1NKH1brf3St0CP84Jy+tCmIMBWksAORZFSX+:NhVRGe8QvsGH1bm1PPNsPZF15WmPFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657954, "uuid": "9aa6dfaa-7588-4c64-8c7e-579558fc4976", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657954, "uuid": "451d9f6f-8e3a-49e5-bc08-7ed0fe34cb4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657954, "uuid": "8d2fd136-da93-40cd-92e4-a1dcc1252b17", "value": "4f851818cf7895330d21b89728efcf7e056b7d5695796eec602e0d9ced761c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba44aba6-05c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646074, "uuid": "e69c2c6f-7b46-4bbd-984d-a17cc8803b48", "comment": "Malware payload", "value": "9423882386e3e0f9f2624804434fa56f", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646074, "uuid": "7cc06cce-3a5c-4f96-b3d3-46c5e5c546e5", "comment": "Malware payload", "value": "4fe51be1f4a33e59ff3d48422099c59ec9afa1b567138ff457e2cbf32c19490d", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646074, "uuid": "bd36569e-fddc-4c63-8d06-dfaeed962efe", "comment": "Malware payload", "value": "789fec178e374d42d6137b088cfcd19a90870288", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646074, "uuid": "38e744cf-c076-4781-a6ee-8ca31700f9f0", "comment": "Malware payload", "value": "6d044a1e30bebc8e61eae28c66de1146e82cccf1fbde5a172ed738dffcc805cd8d2e77d0cc25c6ab544c29a24a0c07e9", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646074, "uuid": "64dca0f1-7c63-4190-8599-4654672c8533", "value": "T13A183308BD22255EFE3D9430C5585264E7A0013545B2ACF68A2E22E335D3FCB5B79B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646074, "uuid": "1755a66d-749c-4cb7-bedc-d6620d5e97cb", "value": "1572864:UYxIwxxtqhf2byZw25/L1eV01S2IaCWZDYt8OB/ZKp1CaQQhWWJougF0d73jSfDk:UKIwxmlRw2/I3025B/sp1CQh9OF+REoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646074, "uuid": "9fa76811-b482-4ad1-b777-0baedcb695f3", "value": 90884086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646074, "uuid": "f6f58aee-b93f-45af-b8e7-62f49020680d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646074, "uuid": "9d06e6b9-066a-4a3a-a3b6-94a31663c716", "value": "args", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707e074-05fb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770671328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671328, "uuid": "58aaaecd-3ee3-48a8-af12-8d42d3e52b91", "comment": "Malware payload (Mirai)", "value": "89a9e8d0c469be52dada8f6e49369743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671328, "uuid": "1b0589cb-67ba-41b8-82c3-ee75626a59dd", "comment": "Malware payload (Mirai)", "value": "50b8755956680a3f0482887dc2e0df0fe92f37c68c40c4d9d099389e52a8067d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671328, "uuid": "337e985d-cb17-4eb0-9789-9ef9eca28fe9", "comment": "Malware payload (Mirai)", "value": "fb2d11acab448533b79b89ab6d307fd760426586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671328, "uuid": "67686819-cfd5-47b8-acb4-861ec5455df8", "comment": "Malware payload (Mirai)", "value": "a0f31e8898628aa555f67cb48bbde264acd738ad1a26786a17af05fa197969c7ab62dbb1ee318bb314b556e126ce5690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671328, "uuid": "46b43208-19b3-4a46-bb8b-09e2c3c6b845", "value": "T157D34B66FC91DB21C5C315BAFA1E118E331307B8D3EE72179E106F21278A96B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671328, "uuid": "9e6cd296-fd53-4516-926e-b25e319532b2", "value": "3072:G/scgZ1cAs6lEoethZNTeLnr54aXlyJ9sv+vrnaD:G/W+v6Woeth/krqaQsv+znaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770671328, "uuid": "6f3ef6e5-c7b4-422c-9d96-b2fff0756266", "value": 140500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770671328, "uuid": "cbc2eaf8-1ef6-4437-b000-e7f9b2d7b964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671328, "uuid": "4ae47cbe-9929-4dff-8fe9-af60c0c7ea3a", "value": "arm6.go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500c03a6-0584-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770620126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620126, "uuid": "04e48e53-6980-4e76-8e4d-ddde9b1688e9", "comment": "Malware payload (PureLogsStealer)", "value": "0c1a7b22d950e459da4f125d404a4c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620126, "uuid": "c9eb0a09-b066-4d1e-98fc-7abe2654b193", "comment": "Malware payload (PureLogsStealer)", "value": "51a9ed737ef8211337d221acf7252d3834f9e4e145fc613b6d2419238b4ee9ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620126, "uuid": "6e8f9347-f82a-4da8-823e-bb054005e974", "comment": "Malware payload (PureLogsStealer)", "value": "1aa6f37cb6c82f97faa917237b0d11b45a22ee87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620126, "uuid": "eae413c8-a509-48d0-bf2c-298d013acb1d", "comment": "Malware payload (PureLogsStealer)", "value": "990b71ae8838cdff4dcd905d1bb7e6230d069d207aa0045188baf08ead1263f5b74550a915c2aed04032976a0372fa45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620126, "uuid": "80d4d8b5-093d-4d3b-a835-dbd69bc61f56", "value": "T13976071973E3C15BD45236B0C94686EF09A5EF24AFF1D487368A3F4D7B70A826E1D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620126, "uuid": "c8b9b641-7049-4467-902e-19d5aca1ace0", "value": "54b94c55ca0500a1a89fd7d736b44969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620126, "uuid": "5c5f1b2d-9846-4102-a305-569de5f77414", "value": "196608:03TT3roNzBeyhlBBBr2Eyw3zgrWkMsZkSKl5f8PuW+K8Ye4:03TTboNz4yLBBBr2EFkrtMsZkSKlt8PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620126, "uuid": "6eea0882-7c3d-4355-abaa-ff274c35d68f", "value": 7141888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620126, "uuid": "bbedf186-5a95-4da8-b986-3d3debbea995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620126, "uuid": "dda91324-eff9-4696-98c9-a6333a34059b", "value": "0c1a7b22d950e459da4f125d404a4c46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77f4a9e-05f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770668886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668886, "uuid": "aaf7225d-5d7d-4195-9cf0-c5c72e4b674e", "comment": "Malware payload (Mirai)", "value": "1b17287ef913bc9532067941fa5d63f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668886, "uuid": "4c951ad4-50b3-4c08-a5a9-08924aa477ac", "comment": "Malware payload (Mirai)", "value": "51b1943384213ef104f0d9261e477fa5d74a37bbfe986c9d1f06698e7304c7d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668886, "uuid": "6b0ee901-2717-4a42-bcfe-cf8c15188926", "comment": "Malware payload (Mirai)", "value": "486bacbaa3fe655b81ab0cffe086fc915c7177d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668886, "uuid": "2190638e-bead-470f-b0ef-1d08e068a77b", "comment": "Malware payload (Mirai)", "value": "c933f634e954f2aaf8b582e0bfd470d7e5d606f11954660d4e41f0fa548e046d50273897102204348ee46addac5b1e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668886, "uuid": "8904f0c8-512b-42f0-ab2b-a945be771924", "value": "T17ED34A56B981DA11C5C312BBFA2E518E331317B8D3EF72269E106F31238A96B0F7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668886, "uuid": "5979488a-b82b-4abe-b0d4-e8bda3f321d0", "value": "3072:0Ws+9fUVJFftPieBgioCu9EsrAnXgad5pmrfXj54CO:0WFUDft5BgioDhaQavAfXdLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770668886, "uuid": "0a46fd50-bbfd-4d06-9e8c-0bcd45f77b4a", "value": 132308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770668886, "uuid": "e7bf703c-d6de-4eaa-8638-8a029d4397d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668886, "uuid": "ddb5b047-998f-45ae-8356-8349f142d4f6", "value": "arm6.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7565790f-05d8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770656266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656266, "uuid": "c1892143-b3ef-4b6e-af67-c06021ec35ce", "comment": "Malware payload", "value": "be46e986d06540304bce91ec8cabde5f", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656266, "uuid": "19cf7d1b-79e0-4148-bab7-a6035bc66496", "comment": "Malware payload", "value": "52c7b152ffdedf32e359793c19bf460eac0160ae341d05b490ce89dc5df223e0", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656266, "uuid": "36402246-2aec-42bd-b9e6-a9e41f5dedad", "comment": "Malware payload", "value": "7830f081ef2807b09a242a1b461735c5ba7635fc", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656266, "uuid": "cdba18a7-55be-4bb0-8014-cc9c0e6c2a7f", "comment": "Malware payload", "value": "d021fa27d8962a96c774626e8f6bd86c8bc44e118750c2a92dbad811ac1e860b8106e73acfe03ff04c85153bc8e1277d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656266, "uuid": "159afc0f-6bee-40dd-bc05-097e362d0573", "value": "T100730A3ADAADB17EC329A978DE060D44CB72BC8943D0BF57A3E10CE50F96A502F5D581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656266, "uuid": "31573f3e-1dad-4199-b20d-353375ff515b", "value": "13202ae6e20dc0e6f8ae3713ee808076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656266, "uuid": "114f8b21-7efb-468e-903a-616fa4f2f39f", "value": "768:IaAfnClK1AJbpw84s3XbeFWkGmlrdjiP2WCFlDl04+1/sUBodR1wk78dVvGo4c8N:AfSclpjrlDl01Wjh7kG9c85UuGVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770656266, "uuid": "024451e5-9335-4cfa-832f-65eb4ac8333e", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770656266, "uuid": "6b7e8f5b-6734-4c70-8b33-9584ddd458f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656266, "uuid": "3a997823-65fa-4351-8dbf-955d12a7f14a", "value": "52c7b152ffdedf32e359793c19bf460eac0160ae341d05b490ce89dc5df223e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b01e4e-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646519, "uuid": "00b2d6bd-ec07-4302-bc12-7915031c1cf9", "comment": "Malware payload", "value": "65f4020d821be4e036f81d9bcf04e4f2", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646519, "uuid": "734f436c-7de3-40c1-bdc3-2c06230068b9", "comment": "Malware payload", "value": "536744b7333676f640282d272a3a63a364cfba4022c3085e4008f69b45fcd6e8", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646519, "uuid": "85e709d3-4a11-4601-9d8b-2148c2716be0", "comment": "Malware payload", "value": "54ec34ec42006059ea1f7215ceb62c2099ab2833", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646519, "uuid": "7fba4d0a-0423-4f79-afe7-9fa69963fdfe", "comment": "Malware payload", "value": "5c8388956919712a833330d3ea9f115386f73649f69615ca952577074e385ed063d922821ddcbdc65f2d2ddb9476a93e", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646519, "uuid": "de0af27a-49f3-412a-9b2e-56b8a1776b9a", "value": "T162F2A112759FA6087173464D4AAF06740F6F7AAF1D7E418A018DE68A8FD3901CC9B3B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646519, "uuid": "ac332185-7bba-49e0-b2a3-39cdcea6daa8", "value": "768:uYFIQNNMmqLLLLLLLLLLLLLLLLLEW1TudDoOA4Ocoo:uYFIQNNMmqLLLLLLLLLLLLLLLLLEW1SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646519, "uuid": "6d65ed33-ba51-4283-ad6a-c48a59c7bd77", "value": 36980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646519, "uuid": "73f54a49-7c18-4904-af26-4a9d4fbccecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646519, "uuid": "8961ccae-69c1-4a6a-b241-22589541e6bd", "value": "536744b7333676f640282d272a3a63a364cfba4022c3085e4008f69b45fcd6e8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4377478c-05eb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770664343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664343, "uuid": "420011a5-ecd0-442a-a5e6-d48b1a97ecd7", "comment": "Malware payload", "value": "a366bc871e1a610197dd496c5add366c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664343, "uuid": "8cbfac5f-e0c2-4ef8-a3e5-27533625d032", "comment": "Malware payload", "value": "543cd2d0ab07345ae0f041809dc4b3156ff958474fbdc7006c94061283544561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664343, "uuid": "9a3fc661-daf6-422a-8fe7-178405088c81", "comment": "Malware payload", "value": "21ed034d4d1002291c61d36108e588a730092aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664343, "uuid": "80b32d80-7e70-4398-b81a-7162819700c3", "comment": "Malware payload", "value": "06d3a0e7968f3b8efb866fd91cafd1b8a2c41c4b1b0b0245f721bb482258b4208e59fcbc3232fc4d539bfe9ccf02b71d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664343, "uuid": "ed4cd35f-931a-4990-92dd-8c335221f6e3", "value": "T1BFC42A7EAC14E327F60CA0BEE287D3534F6578110236BA931CBA972411495739B877EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664343, "uuid": "2bef7270-0636-4030-b361-1921310a29f0", "value": "fc960b9f00b5c476474282bb39f86c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664343, "uuid": "e1e1dc33-6f73-4704-a7a3-705219c1eec8", "value": "12288:UcVR9cLXtGJKYvFSPXLI6zavBjR2+Q40S:UcVR9lKocLISavBjR/2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770664343, "uuid": "423d4822-6dc7-48fa-881c-b59a695e2c69", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770664343, "uuid": "5b201c35-ed07-4d71-b690-d259007c2fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664343, "uuid": "df25220b-3a2b-45cd-a966-67bb80e4f074", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bd58bf-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632428, "uuid": "8cc75c77-7cd1-4805-96bc-160351512869", "comment": "Malware payload (Mirai)", "value": "dcdd615ba7d9841f123c37f2355e08c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632428, "uuid": "9a9d1f3a-63da-41eb-947c-5ad26a5063a6", "comment": "Malware payload (Mirai)", "value": "550dccaed75759cef4c4c98b74b1b21cc2c71597e4cc98e0eb609101732d3257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632428, "uuid": "55a76157-f386-45d9-9e4f-33669cc4eabc", "comment": "Malware payload (Mirai)", "value": "a23e733fa6bc708248aad608a6fc359e364a8d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632428, "uuid": "d84edf89-9b6f-4645-83e3-752acf5226b5", "comment": "Malware payload (Mirai)", "value": "c7fca2fb44e547c0468b7267cdb32e7b06e997d9ae7bbeb50e0198dceed0fa75aa2d91991fd705c50605febb78f6c152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632428, "uuid": "aebe255b-cf58-4a67-b620-719ee22e1151", "value": "T132D32A06730C0A47D2632EB03A3F67E193AFDAC121E4F640355FAB8A95B1D365586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632428, "uuid": "c96c91fa-05ef-4145-9881-93d13882c2a3", "value": "1536:SIdIpS7IMu4+IWj2GxfJK+tTv61dmb4xpv7xjudvA+CXCz+gabq1lC72bw:KBjj2Gx5tuxxd7x1+iibw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632428, "uuid": "f85836f4-bc67-4c30-b950-7f17c2925d58", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632428, "uuid": "2917e70e-f966-4d66-8312-b46f26d3c2c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632428, "uuid": "75ae44b6-dc73-45c1-b2ba-a1aa0166b5f5", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225d760d-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597286, "uuid": "61b673a0-e36d-43f2-b4c9-b48b06fd57b1", "comment": "Malware payload (Mirai)", "value": "938376af4cb423564784562ce2dbda31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597286, "uuid": "fe0b6997-3d57-4c77-910f-00d3e19f77b3", "comment": "Malware payload (Mirai)", "value": "5533f06a7dc55ebfd3ac97ea5bf8e3053e5c1cf23725990f1143c634bf8cff13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597286, "uuid": "9a090653-dab9-4816-be27-6775b4fef18f", "comment": "Malware payload (Mirai)", "value": "0e869abc219d5c663e7dca4224d8fc9ea09308b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597286, "uuid": "f612cd5d-214e-4fff-9ba7-df092c41d878", "comment": "Malware payload (Mirai)", "value": "dfb3c333cb88cb65966a79c26346884ff0ae2738909edc59906d54de03a6ed6518c95ffe08a535f0bf0c20906ae04598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597286, "uuid": "dde15c30-31f6-41d7-99ce-e1594d3efc71", "value": "T14A146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597286, "uuid": "8584ab87-ac64-4b05-ba46-392927718eeb", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtG:BZAyFzQSdS7Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597286, "uuid": "bef44fcd-eff3-41f8-b3be-b9c1c67d7d13", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597286, "uuid": "07fa8177-2a85-4457-9c15-5bfd884cb1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597286, "uuid": "45f281a9-8f25-4a58-806d-ec9fcb2fa70e", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85402279-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770632241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632241, "uuid": "388ce4ce-d469-4d79-8dd7-18be162ef7a7", "comment": "Malware payload (Formbook)", "value": "da8353f8d4c8a668cb388871ddecd5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632241, "uuid": "33b27ccc-5d71-4fe6-8c73-5e17c6183a45", "comment": "Malware payload (Formbook)", "value": "55f142f550fa6dcfd1468195bc9b9fdca87714a06e5a8370152119fb10405b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632241, "uuid": "6f5426f9-d8f4-41ab-86de-aecda780c4c1", "comment": "Malware payload (Formbook)", "value": "4f01c576b49387cb5b4b1cfa2e0d0e11fbcd0bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632241, "uuid": "82f3fd18-8da0-4c9c-be86-d77dfff4c20e", "comment": "Malware payload (Formbook)", "value": "18b6598a9cf407878e4a5cb4a033ab1dfe2075852d8bfc3d0f3ede3097d6efe99f3a4d2927668dfa88e8d71116a53749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632241, "uuid": "4b711665-d8fb-4c86-92a1-4cba2da24d90", "value": "T1283523527655CA06C5BE4BF909B1E73417F6BC9EA801E3168FFD8DEFB90078128052A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632241, "uuid": "408563d9-6ae7-4fa0-bb08-a07d842c8ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632241, "uuid": "1d1637fd-8ba0-41a8-bbc4-c099de8db698", "value": "24576:+1PddCWv8WGFYSEvcx75dfemIFY47uowM31a:+P05ZTdGbFZuowM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632241, "uuid": "48d31ccb-224b-430d-b5d0-ccaef3088778", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632241, "uuid": "a8c158a8-894b-4426-acd6-202118e01f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632241, "uuid": "48a1b36a-6746-4b33-b793-c36f31444a4f", "value": "Order Specifications Sheet drawings pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec61d4a6-05ba-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770643581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643581, "uuid": "acb3d393-8c3f-4374-971e-16d549815579", "comment": "Malware payload", "value": "c4cd26edbd0b76bd619d6efd95cdb503", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643581, "uuid": "021e33fd-4723-4d20-a08c-3a3b43ff617b", "comment": "Malware payload", "value": "5621c4c3f8fd7a9b62894a79c44d29dfb35143dd833e7ac47bd06b3f0c8d9102", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643581, "uuid": "da190ee8-d843-4f97-adae-70adfd0be4e7", "comment": "Malware payload", "value": "b57a7ef70941cb6faf8dc63f55f005658b728156", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643581, "uuid": "802f0470-b933-479f-b8ee-3e9b775f32b9", "comment": "Malware payload", "value": "22719bab5f291c5f46d8f3188d768995e5adc4ae86286626eac07c75c5e0d87e4e992cf1f5f70af8f714ec49ae557736", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643581, "uuid": "a8ab965c-63e7-43aa-ba25-dbab63bb967b", "value": "T1D43633FC3B0472B7E0A2C5F052A96D6F0E513098D5F27EBA01F6253B3786582F62E561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643581, "uuid": "6df67128-10d0-478f-a3a1-fd930e4602e6", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643581, "uuid": "30148829-871b-4b15-9346-1ee6ca13beaf", "value": "98304:93JLlMn8jB9wD0hPY5ZUQGr2FfLXSAcWL5FAcQr4+HMlLwI/WZU48iEMsV8v2ftv:93JDcD0hPY5ZPRFDXBcCFEE+sUTst0G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770643581, "uuid": "ead09147-028d-44b3-bff7-b8625b71efd0", "value": 5235200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770643581, "uuid": "4e08cbb5-0ea4-471c-8432-0a1a0647a24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643581, "uuid": "b1da3cfe-3022-4ed5-af8e-7dfa51d2466b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82896ba8-0587-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770621499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621499, "uuid": "9437c6cf-31c8-4421-99cf-2b886af3c391", "comment": "Malware payload", "value": "57d6cae71b4d354a1ba4fe1d84deea41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621499, "uuid": "a1930632-8256-4d2b-adca-48828f55fcc2", "comment": "Malware payload", "value": "56221b4969770d667ffca6c9b65841676dfee9b9c66dd68f6d99bcb7495e49c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621499, "uuid": "2af8f242-3e66-49cc-a2ad-344ea051ceb8", "comment": "Malware payload", "value": "b73a4deebbf68fccdbe574be7da49fa312f503e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621499, "uuid": "18cb71f9-bcac-498c-a741-67045b8926b1", "comment": "Malware payload", "value": "e61e2487ced7e1335f9654b0656b3089eabbded6555787ba9353e91501886bf8bc3a4d00cbfbf6d40d684c33e591b933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621499, "uuid": "b1c75585-4e14-4580-a5fd-28053c9de5fc", "value": "T134E58C06B3D8499AD526EAB4CA1BA333D772B8015735A14F2148D70A2F73F958E3F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621499, "uuid": "db1b64cc-f676-4665-a4e8-097cd642d5a3", "value": "f98504e40a1849e25fedb411daa3c56b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621499, "uuid": "5193b6df-e1c1-45bb-a6de-9f2b435fca91", "value": "49152:TWn4mHqTLmO2KYAeL3jCj390dff12LPm//a6u:y0TLmO2bsLPcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621499, "uuid": "b470454b-439e-485e-ba0c-2ca81f436d23", "value": 3214336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621499, "uuid": "f2f1715f-1ef7-4528-b3b8-423c2c5e029b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621499, "uuid": "10cf297f-8694-440d-9fcc-d355c1c56321", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404bd51e-0585-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770620529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620529, "uuid": "1f3671b1-3910-4fde-a7d8-48820fc4000a", "comment": "Malware payload (PureLogsStealer)", "value": "7c3ab69a303b33b506e0a777d5b04c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620529, "uuid": "91fd45b2-7052-4458-bcd2-0423454e7628", "comment": "Malware payload (PureLogsStealer)", "value": "567ac6096ffd72781c09beb7cc591e25afbacd9a9d90ce112c448b8fa541c1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620529, "uuid": "95b5813c-6543-4e91-9531-e73029740993", "comment": "Malware payload (PureLogsStealer)", "value": "ec8b11e51bd065cdefa056198f18b3ec820569fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620529, "uuid": "4babce60-de1b-463e-8e95-f22ff77ebfee", "comment": "Malware payload (PureLogsStealer)", "value": "36911ef0a9881a53aa96b3b7e63f45b4b6116f7df4fe8671dad3195223af98f5348d83c283a44afc6765ad327939144d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620529, "uuid": "abec6b7d-97b9-4fea-9b39-f56a62de2886", "value": "T1EFD4AE1B7749CE21D1486637D1C74804E3F156E67623E70EBAC9235A0A073BEDE4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620529, "uuid": "791bc5ff-6d9f-41e0-8885-70f950167fa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620529, "uuid": "2e2b35e6-1658-4c7d-a52a-7873675e6355", "value": "12288:7+HgZis7fpXqsU3nqd8gsYsH79ewAISUstJL:ZfpXqJXQzsYsH74hISU4JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620529, "uuid": "fa0a834a-a42c-4a71-b172-5b685903ffdd", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620529, "uuid": "63a355aa-91d6-4415-959f-ca3ac04ec203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620529, "uuid": "0d905c56-a7a8-468a-a27d-9b5043fbe4d8", "value": "7c3ab69a303b33b506e0a777d5b04c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414f5c49-0556-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600344, "uuid": "0186189a-30ca-4966-8f4e-a49f4c1d4968", "comment": "Malware payload (Mirai)", "value": "8402d36ce24100d2862e360b9b7880b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600344, "uuid": "27c30a0d-a124-441d-8aa9-23d6bf3f22dd", "comment": "Malware payload (Mirai)", "value": "56d5956619fbd5c85816fab0db3484f8001dbebd53d3bb9234b15470f8a09024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600344, "uuid": "a9bdeb97-36ae-418d-a07d-c0c00526635e", "comment": "Malware payload (Mirai)", "value": "3d12b96fba2be689321624142a77dbd2b38acaa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600344, "uuid": "7629320b-a1af-4e61-87e5-461be56ba536", "comment": "Malware payload (Mirai)", "value": "ab4f2e29080afb666f3005a5d14345d7f128a2db827c83e10ace52aec9f6636ba2a35a5c07e34c4d7d8c90fe45ebb868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600344, "uuid": "46218d6d-4106-41e0-9745-63b5d42bcbe3", "value": "T1A7434A17B58281FDC89AC1B44B2BBA7ADD3370FD0235F2A677D4FA262C96D215E18D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600344, "uuid": "5e529695-7ae0-496f-82d3-ed24c7396af8", "value": "1536:7+t10eY1UGHVL0Xl/YZWDCgGceMnFdUJjn8M5tcmGU:atmeY19R0V/YmfKMFuJjn8if", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600344, "uuid": "c2ffb24a-2464-4953-a8f5-ac4218847aba", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600344, "uuid": "fd58b169-ff4d-41e0-a706-f5e874d28424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600344, "uuid": "aa29524a-a683-4b02-9d32-c8ed6390d5af", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3f7b0c-05cd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770651451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651451, "uuid": "0d7339ce-6daf-403d-ad0c-e7884f286b54", "comment": "Malware payload", "value": "746f7dedbf3049ea06dd4553e993598c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651451, "uuid": "6c19ca48-4a8b-4b6c-8d0e-faf2e82b96e6", "comment": "Malware payload", "value": "5897ed1b0e0ca15dbbe04c9c2a3c88328376d47b6c3bc03f6700b4a99360af29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651451, "uuid": "9a6c1167-93c8-4f47-9220-8aee7906652a", "comment": "Malware payload", "value": "9ac6ddd29c6204caef06176878962b900e6f2269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651451, "uuid": "84a0e595-48ff-4c36-93f0-a2d1090831a8", "comment": "Malware payload", "value": "d4132774893d1ad8e81cff72b31794f7ace62db2c60f39638da3163e34217dc2a66ba6f19fb442ed07dc8f31d0bb800a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651451, "uuid": "721fe0d7-69a6-4909-b604-a2c69293475a", "value": "T134F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651451, "uuid": "fc380177-be92-45c6-8fc4-7b912769a48d", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651451, "uuid": "c4eadf31-372c-4417-87d6-dc5146c88eeb", "value": "393216:PQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGK:P+3LQxhnLUYg3muRovxOOxUj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651451, "uuid": "debf7877-df05-42a3-93d9-75402a14a724", "value": 71543296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651451, "uuid": "92ff291c-f7ee-4328-8bfb-854235482307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651451, "uuid": "c360c83a-a813-4676-a825-906a4f0b1623", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563ecadb-05ba-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770643329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643329, "uuid": "396a8ac1-d554-40dd-bcc2-2d3483676a0b", "comment": "Malware payload (QuasarRAT)", "value": "255ab23022bc600d1fc6b15f273ebb3c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643329, "uuid": "4a7bf5e3-a8bd-4c30-bc4c-f7e553040bde", "comment": "Malware payload (QuasarRAT)", "value": "58ecc1faac86797ff1a98496c7e9841e3c471ca46286543ba2cdabb3fe57abba", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643329, "uuid": "60e41833-44b5-4c27-8661-e52cbce61ddf", "comment": "Malware payload (QuasarRAT)", "value": "16acd4ebc34e564063396743939f0efe7600f90d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770643329, "uuid": "53709ffb-4d42-4ec3-8344-62ecc1592788", "comment": "Malware payload (QuasarRAT)", "value": "88cdcb1003c103cb94ea4275b8d9b8aae7f8b7330aaea7dc28e0810a17e781d05dacebc6d7b0f543193dbb906b60bfff", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643329, "uuid": "2ccaf556-760f-4751-b077-72d3bc7feb34", "value": "T12FF533825FBE7F7602AD933870BF4D19E2E20FA854619AD2B399C0DB2F5CB01554BC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643329, "uuid": "1d5aa49e-4dcb-4640-965d-071d6287126f", "value": "24576:IePozcwoMimcThOhESjgoxLxH1M4qs3PncOAbeGfXzlwlZna0Vb8ldAePozcwoMu:nAmQp1VM9l4lkAmQp1VM9l4lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770643329, "uuid": "55d90558-b5d1-4f3f-a257-1c2426893a67", "value": 3477446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770643329, "uuid": "b9e0e499-8d0d-422e-a130-8e66e9835df1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770643329, "uuid": "2eb37ff1-84cb-4de6-8b47-3c093252d229", "value": "tail.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdffd0e-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646534, "uuid": "943f372c-af8b-483d-9302-7fb7c5cd99f6", "comment": "Malware payload", "value": "4b390746c305df01d6befade0695d0d5", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646534, "uuid": "68cff12f-ecda-45ae-9b6c-15cdfe0e8967", "comment": "Malware payload", "value": "5ab49f0e8af589d72168f23feebb5879276eb2e6f6642c5b55445a1326c06826", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646534, "uuid": "8c903f22-af6f-4eb8-bd79-c8ecc2013ac7", "comment": "Malware payload", "value": "2fceb100ec446faf42b73f657873ef5c91a32d4b", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646534, "uuid": "3b93013f-85ec-4a05-8ed8-d2dbc29e3153", "comment": "Malware payload", "value": "41585f29b26b4265cb068d87d34872e381b02f0679c46b4356e5022065d14412a4a2f7e0e2756700dff6922a9d9afe2b", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646534, "uuid": "5ae3222b-43ad-4aaa-915b-1a92d2707cb2", "value": "T1FFC15B0057F99608B6F36F05AABFA561593B7AAE5D36DA4C0048C54E07F2A04CCA7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646534, "uuid": "d23bd597-0071-4a15-88b5-565900adaad9", "value": "96:CyEBs5sZ5MfOOtdyFwFiODBhsZ5/HAO/mAMxdmJjR9JHmHAtQi0j+wvLzPvYZaZc:Cyeuf0qFicy/mAMxdmT9FQXSK/hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646534, "uuid": "ba53c620-77f2-43a2-8b31-bbe6869b7905", "value": 5888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646534, "uuid": "ee63a90b-b427-4f09-a764-82f23b8816ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646534, "uuid": "55f8ac13-f7ff-4520-8539-7fb6faafa042", "value": "5ab49f0e8af589d72168f23feebb5879276eb2e6f6642c5b55445a1326c06826.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f91edb-05de-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770658836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658836, "uuid": "5d55a868-9199-4d75-aa62-717901a6b992", "comment": "Malware payload (ValleyRAT)", "value": "3934450dcf981b58977b9bfc8fb1884c", "object_relation": "md5", "Tag": [ { "name": "45-119-55-56", "colour": "#689B87", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658836, "uuid": "4b9a6513-b294-4bae-bd37-6be9b6dfa5d3", "comment": "Malware payload (ValleyRAT)", "value": "5b7aa8edd23f2df2d6116b047e09746839136d7de33e6260fd4cdcd9eb4b941a", "object_relation": "sha256", "Tag": [ { "name": "45-119-55-56", "colour": "#689B87", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658836, "uuid": "92e4844a-c163-4266-9475-f099f423095e", "comment": "Malware payload (ValleyRAT)", "value": "f10b392467bcec79dba3a2156257c3f6a1d2ba4b", "object_relation": "sha1", "Tag": [ { "name": "45-119-55-56", "colour": "#689B87", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658836, "uuid": "e4cb342d-b053-4c0b-b2bb-f1a4b931566b", "comment": "Malware payload (ValleyRAT)", "value": "a94ac5f82dc36f182185d4e6e6c1809aa5f6612b3328f1de27b4e0f76013809396fb3bff306a1620ccb3d51d6004d594", "object_relation": "sha3-384", "Tag": [ { "name": "45-119-55-56", "colour": "#689B87", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658836, "uuid": "cb89aa94-58fd-4abb-aa3b-4f3d9b02752d", "value": "T166E733FFA38A243FD4690B3526B69E1536F72E50E5024842B6F5F818DF360702E6E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658836, "uuid": "752da19c-4e74-4349-a6b9-b0133f7528e6", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658836, "uuid": "2f088bd3-463f-48ec-a1fe-acd107622d5b", "value": "1572864:YLfjEqs8SpVysoCPordnEnr0dlp/7tD3umPfjVr:YLL1sRVoCJrEHTtzumHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770658836, "uuid": "2a1e51ec-b8de-49ce-8c7a-4f4fa88ced19", "value": 67718424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770658836, "uuid": "36573806-f596-43f5-be45-da9af99898a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658836, "uuid": "51cf9304-f07e-4154-9cc8-f04a8206ccde", "value": "3934450DCF981B58977B9BFC8FB1884C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a5b4a5-054c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596056, "uuid": "8f58dbbc-aa38-4cd0-bf62-12bdaaf3c552", "comment": "Malware payload (Mirai)", "value": "74beac97a57c82278a0e5e0ec3cab1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596056, "uuid": "79e6539d-68ab-417a-82f7-8d26699fa79b", "comment": "Malware payload (Mirai)", "value": "5d284a13504545bb82eb3e12728ac127d00ff1becf01445f111cc8cd74480837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596056, "uuid": "78d701d0-b740-456d-a760-3e815dc2bbc4", "comment": "Malware payload (Mirai)", "value": "326e5b2a4c7390376d2a9e8b487ff270a18a7c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596056, "uuid": "23c23e27-a9d4-4b35-a06c-0517bb9321c4", "comment": "Malware payload (Mirai)", "value": "874765184a106648cd4cbb731e10a83165da0aabdbfb6d45d145b3ee94177d69d6362ae0772caf33af496f14e3e434b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596056, "uuid": "8b27ce06-a00b-4319-a980-1d1caeb4f120", "value": "T143D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DD05E15FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596056, "uuid": "f2c09c2e-52b3-4bf7-9342-21b4f30b5398", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQC:yIRfe3xvvSrlvZZ7UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596056, "uuid": "2baf8f6f-dfed-4d03-9697-8adb8f90a090", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596056, "uuid": "97293ab7-3feb-45b4-acb7-8a5bbb948002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596056, "uuid": "d5f7c916-1fe7-41c5-aade-a7874538645d", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106e7148-05fb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770671129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671129, "uuid": "8c668145-62e0-42b1-a6e6-0895d29e93dc", "comment": "Malware payload (Mirai)", "value": "8e64fbeb16706caf96b04077563740f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671129, "uuid": "651e9548-1936-41b4-891f-15a7e15640cf", "comment": "Malware payload (Mirai)", "value": "5d6f50f18dbd9538c965e883027e9dda92967bbc515abc57cdef82dd8de96861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671129, "uuid": "86c3eb52-a2f5-477a-b356-7beed9115226", "comment": "Malware payload (Mirai)", "value": "97a36b75fd3f5313ef8d96c2c5f8c9508cdf50f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671129, "uuid": "4a8c98a0-df5b-4dc4-b354-5cf6bb768ada", "comment": "Malware payload (Mirai)", "value": "22b13bf958c254df464f6d0239f41db644111be6e13178b237ad309caee673f7a4fe507a32f3844eebbfb2df4f53a245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671129, "uuid": "70b7433c-88da-45ee-aaf4-aa29838272c8", "value": "T176F33A52BD91DF11D5C731FAFAAE414933135BB8D3FA31129D20AF61238A59B0F7A602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671129, "uuid": "69e21770-6b55-415a-94ca-b66a71ce5439", "value": "3072:7USF2P+336EQefw3EzkcfpTiaRFMEtREYCL7bgpXNj0zARr:7UhWH6jefw3EoctiaRFMEtREY07bMNYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770671129, "uuid": "a6d9b6b2-0227-4214-a82a-9b4a98bb7b8f", "value": 158064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770671129, "uuid": "884eb73e-e225-42c4-b5db-6329dc01202b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671129, "uuid": "9a7c7d45-ff5d-41e9-8e4c-eaaa7ff19deb", "value": "arm7.go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ce052f-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598716, "uuid": "9100683e-27af-4c36-9d2d-458c4708fa77", "comment": "Malware payload (Mirai)", "value": "a2670216bfb7830ca22bf055c3977c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598716, "uuid": "31e0641b-c5e2-4c64-8995-8304ea4f4afe", "comment": "Malware payload (Mirai)", "value": "5f370486a07295f1b56153840b3b75cd4df98dfa3f920a8e69469aa0afa505c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598716, "uuid": "5db8d69d-85a2-4773-9a7d-9a79dcf91c80", "comment": "Malware payload (Mirai)", "value": "78a249260b292eb65d2b2141b765a56347dbaf9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598716, "uuid": "acd130ef-7233-44ac-abc4-7632026809d2", "comment": "Malware payload (Mirai)", "value": "4d8e0c9f8cf35ed3aba499d1d43fc30d3526bfe2243671a954100ed6212c4b2e57d1ab893dd012dd9290612a817f2f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598716, "uuid": "93617d0c-fa33-4a78-8d15-6315e2ef576a", "value": "T1D55329DAF801DC7DF44BD77B4413090EB630B3D142931B36639BB9A7BC721A95922E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598716, "uuid": "e00ad145-fc76-40c1-8865-5b2253d18e39", "value": "1536:uTYPIYtiraWrBHU8nwlh19xsesQdJW2JwQhhcsQWe:uTCfirVrBQh13sZQ//hJHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598716, "uuid": "24930021-8e0a-46ab-89a3-891cb6d05535", "value": 66012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598716, "uuid": "25a7c661-a44f-41d2-bf69-0e196aea36e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598716, "uuid": "5df178af-52c5-4ee6-9438-f7c9fa1f3927", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5585481-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770646549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646549, "uuid": "f910a536-b50d-48c4-bee0-6252b4818484", "comment": "Malware payload (XWorm)", "value": "5404241e25e1bdc89ac648326ca0ac8c", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646549, "uuid": "739c0287-a8d9-460b-848a-dcbed0b83d28", "comment": "Malware payload (XWorm)", "value": "5fdc1aa9b6a418d4ba37290ddec3cbcca49bfba273310ffcef391f1116635d59", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646549, "uuid": "58503358-9134-4218-9cdc-e62092a42aeb", "comment": "Malware payload (XWorm)", "value": "00a9887363d3e1b7a38149dee9a5bb676a0bbf44", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646549, "uuid": "da243c38-9d1c-4cab-9bfc-3f2b4cabf448", "comment": "Malware payload (XWorm)", "value": "55bb85b5b9df6fbb781778a0083d784fb20ffe9fa89c8cd4e2047b7c2a40dd14e5813acefce2842b18f6daa8b1c4a719", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646549, "uuid": "a21a57c5-e044-40cc-9138-9c3a8d29c8f3", "value": "T1B1F28F12729F960870B3468C5AAF07744B6F7A5F0E7E8189018DEA8A8FD3914CD577B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646549, "uuid": "fcababe6-8a9f-4071-9da1-e6fb861db5cc", "value": "192:N/ofXggLc/ofXggLf1y9diCRjFrUUUUUUUUUUUUUUUUUhpup1cuUFC+aoOejrWPG:ku4ud+aoO4+G4VPpPtXgiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646549, "uuid": "bd2c3f24-875e-4bba-8c84-297458ea74ae", "value": 36932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646549, "uuid": "e465ac17-f3d2-403a-99c1-daebd1ec0f13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646549, "uuid": "11dfa455-4ad1-4447-b547-a7de43530370", "value": "5fdc1aa9b6a418d4ba37290ddec3cbcca49bfba273310ffcef391f1116635d59.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f34652-0581-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770618731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770618731, "uuid": "118fed69-d089-4d90-8e2b-063ae59e0619", "comment": "Malware payload (Mirai)", "value": "d8e5619225899568dc2d10e0ad54c0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770618731, "uuid": "b6321e8c-267a-4a11-9ef1-1a486f23ab66", "comment": "Malware payload (Mirai)", "value": "607c4e7e5a2301754f8bc8f45ebf665fe6f2c643559ff2d301e404e84a866777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770618731, "uuid": "43f7937e-e9cc-4b62-bc29-202d02d8f225", "comment": "Malware payload (Mirai)", "value": "3dd64fb1e712a75da7590345f1506ca9291eced4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770618731, "uuid": "12f17345-24e9-44ce-a5eb-0808e649a76a", "comment": "Malware payload (Mirai)", "value": "c4c7f62f6156c4c5564f8fb04314e560864a6299ec5c4e16db5f20d9b08a2c96f7a2a65feba83207213c8be14b74434b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770618731, "uuid": "15c74ab1-4902-48eb-8c9f-fdf9f346e97b", "value": "T1E9C32B56BD52CA12C1C369B7FBAE464937666BB8D3FA31028D246F6027874DB0E77103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770618731, "uuid": "53405a9e-1f6d-4705-87fc-b9faf34691fd", "value": "3072:UkDcxV+eaYNl3PdgH9OJUP0Tvc3o1vF1pd9yJBgxlptj:NcXpaY33PdFJ9v9hv9yPgxlptj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770618731, "uuid": "d722d1b8-1da7-480e-97f3-35c5f63f71f0", "value": 121236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770618731, "uuid": "a5cfa062-a1ef-4edc-ad7d-c4fd710386c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770618731, "uuid": "78817e17-71d2-47a5-b5c3-fb10b62442ad", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f635c1f3-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596782, "uuid": "5199fa9a-b9e3-4ce9-8770-c4cfec3777fb", "comment": "Malware payload (Mirai)", "value": "bea5fb79d29f36c1b4095c7afbb7d85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596782, "uuid": "8de780a6-d8ec-4b07-8abf-259cf0a00d18", "comment": "Malware payload (Mirai)", "value": "61bafe6d4e045a3869a476cfe81ae3dc5354ae6ccb28d2d7b76d3de1beb53ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596782, "uuid": "1e7d5884-7031-4792-965d-34b0fbacd647", "comment": "Malware payload (Mirai)", "value": "aaff913af7b4614b6aa79101677f145998dbd86e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596782, "uuid": "24d50111-e9d2-4e85-9aee-b051233220d6", "comment": "Malware payload (Mirai)", "value": "1676adfa7aacb12d64503fe97ba81354d1013d1f8a96e9fd02aa72ce4a137ce2ec5c920c4e91c32fba61ab31f416f018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596782, "uuid": "467d706a-1bd6-4b29-b1f6-2f4bd1ff934c", "value": "T1BE833882B8819A20C6D5177BFA2F108E330257ACE2DEB353DD145B6477CAC1B0E77A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596782, "uuid": "2349201a-1592-499a-a3ef-4fd4e14e4e50", "value": "1536:mRnMGDkKSZ62syQrtqqHBsoLmpMguHcUNVUHalw7WuuH0EsfCSvr064WmjAM91EI:ukFZUltqDoLmpMguHcUNVUHalw7WuuHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596782, "uuid": "0609d6f5-c2d0-4cbe-b35e-a1d8f8ab6069", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596782, "uuid": "8381cacc-69c4-4aae-abbe-5a134afddb7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596782, "uuid": "1259ad8b-9e9d-48a0-bb7b-d78986d0fc73", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df7539d-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770632229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632229, "uuid": "5b853f5b-1e82-4884-9e7f-3f9f33784806", "comment": "Malware payload (GCleaner)", "value": "83a9b38d64bc3d5cd838b23a1d1f1f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632229, "uuid": "3abc4de9-a938-4ee3-adf6-5a25817653b3", "comment": "Malware payload (GCleaner)", "value": "61ec677d742f1f9d7bd8e6d389700c8cb6a07219fedac3c47e44d1f6815421a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632229, "uuid": "38fda297-6f6f-4d9a-9f7b-92c6297d27d0", "comment": "Malware payload (GCleaner)", "value": "78aed62a311c5b648dbfe734cf7837b359665a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632229, "uuid": "76497483-85c3-411a-994c-65998d297b82", "comment": "Malware payload (GCleaner)", "value": "9ebbe934e0b86169486e9d6eb5b63571c63a2e4cac1bef2aa4957fcc42c135cc5590966ce206bd0704bec1ff82eb4aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632229, "uuid": "a641e4f6-b322-48f8-a78d-d7e2db875d67", "value": "T1B326E017AA71E476DD81DDBC3FEF70EC5219B93081707408B6807CC2A6EAEB5A4D215E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632229, "uuid": "a3ea812d-198d-429b-b796-a7f72ce9af86", "value": "4a3f446b1307d030a028ee27665ab52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632229, "uuid": "f7e8051d-65d7-4c8a-b569-c4a02a32d2dd", "value": "98304:msNHlvtIdHuqgie+jM5JPAe6N2ze3aA7WUo:mktIdHuqgyA9g3aACUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632229, "uuid": "061c309c-1da0-4131-bd8d-16858b06dc89", "value": 4494848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632229, "uuid": "ecbf65c7-0055-4033-9ba5-5159b66fecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632229, "uuid": "7f8be723-cc19-4148-b0b1-df4d6af63716", "value": "83a9b38d64bc3d5cd838b23a1d1f1f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a13f6d-0558-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770601457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601457, "uuid": "c600c1e1-645a-482e-8b9d-4978c78c325f", "comment": "Malware payload (Mirai)", "value": "763522604871482928f8f2c1048e06ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601457, "uuid": "937de9eb-5d04-4abc-8aff-1eff199a6d5c", "comment": "Malware payload (Mirai)", "value": "62cc70c494fb75d217036ea4685f2d13e70618be8e6a74a55dcfd124be1dfb2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601457, "uuid": "3de33a59-7177-4ada-bc4c-5cc195192209", "comment": "Malware payload (Mirai)", "value": "c8a494e1db7d0fdd8b62265aaaee37e65520ffd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601457, "uuid": "063d96ba-12b2-4675-a42b-f9c166c480e1", "comment": "Malware payload (Mirai)", "value": "9948bee4ca136c829624bf8eea7cc4174052c4d3c4ae76387efa452eaec6add62a8627a94e2c9e952d24a23ed748721a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601457, "uuid": "c6eff0c9-e443-4478-a29c-fe2e1cec8595", "value": "T1F4730984F98B81F5C41B497460AAF33FDA32D57A80B09BADEF9A9F32C767601510135A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601457, "uuid": "532f3bbd-d56f-4d40-9a52-0ffc23e9a5ce", "value": "1536:rZgWGjoodl6qK8KjyEFn/2YzO40iCG4t0li8F2SNnT80:rZgWGcodl6q9Ke4a4yG9iutNnT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770601457, "uuid": "020ee37e-0646-4b30-a784-dfffc7bee66e", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770601457, "uuid": "c431b260-2262-4ff7-ac67-6fbf0a2db2ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601457, "uuid": "7086e0d4-43f8-4ea8-8706-da930b7aba6e", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e164c1b-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770623666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623666, "uuid": "97c45956-5f6a-40a8-9904-943eb3191f1c", "comment": "Malware payload (Stealc)", "value": "f3372130c60511ef78cc45c6e2aa9b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623666, "uuid": "a5d75603-ad54-48de-b743-71b9e4738fcd", "comment": "Malware payload (Stealc)", "value": "644dc2759bec6cd7c6eb455c47493d65414ba08114e8648d28f1de24fa9a2e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623666, "uuid": "4c5ae1a2-2a62-4547-9813-3e119e84265e", "comment": "Malware payload (Stealc)", "value": "23c639e002c918f46d1801156b59347468b8571c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623666, "uuid": "0088f538-8591-4986-b749-bc28b187d30c", "comment": "Malware payload (Stealc)", "value": "17171b42ac412dc75e309ffa5d70b5f9f334ca0765da5af13d2bba0f2a5c138d14dd46e0ea59db1f90ff9e0fe84eba6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623666, "uuid": "d8de7760-3f76-4e99-9251-623d5eb6c5d9", "value": "T1E8673912BB9D45A2C6BFE33897506252BE31785443713BD36E9815AA0C2BFC42B3F719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623666, "uuid": "b3d663d0-1027-455f-9b3a-e149aa34a9ea", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623666, "uuid": "cddda374-396f-4c49-9d57-21a75ae07291", "value": "49152:VntqN3/icyDrvIgMWB6mAkdSh5iA43OzG3jhsKv0bhyMMcYz7jyEnK16vD/0:yN3WvrdSh5iTOz0hsY0boxZPdvD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623666, "uuid": "c7826ec6-58ff-4f18-8fc1-139086ba0dc0", "value": 29979289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623666, "uuid": "197c66a1-dea6-474a-9c4c-374a5dac0954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623666, "uuid": "df1a793b-eaf2-4396-9b42-9641453a6587", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b86e6cd-0600-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770673510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673510, "uuid": "bdcd78f5-5c0b-4a2c-856f-754b17e36679", "comment": "Malware payload", "value": "5bcd6242b463c477db2d0d9cc3ff6e10", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673510, "uuid": "6237301e-70b9-4078-8272-8d03eacb5d00", "comment": "Malware payload", "value": "65477584188773f40a7d88a8dc41a39c1de4a5c69cc563c3ca5f94493cdaa77b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673510, "uuid": "47ed3441-9021-4cc6-a985-02e8a4e98c82", "comment": "Malware payload", "value": "78fafe118d21977f644272b7035d87430641883e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673510, "uuid": "bb36cd9a-ffae-495c-81e9-5170be30a4d7", "comment": "Malware payload", "value": "ad820adfda485322d234f81283afd46e8feac7e0aae528b6703d383c154e409fca8d1ac224555f170d1ddad7e4697c55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673510, "uuid": "7f36c1a2-2e0d-4c8a-8bf0-eb779994ba8a", "value": "T15FA533F3DC8A2BE2D8E752357B6211C6E112497A2DEFE28E46D30C758C51374F4B1A68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673510, "uuid": "d2969eb4-717c-4364-88e7-1af339d8e82c", "value": "3a8632a6ba7f7c06aaa289e4406ae495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673510, "uuid": "3717eea5-f773-4985-831d-9a848a2f0c01", "value": "24576:vUVEvSRhFb1z0v1S2vprkck0P0nNa+lmc:sNP4tb1lk0G8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770673510, "uuid": "037dea0a-48a7-40df-affc-fdceb5bc8946", "value": 2221056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770673510, "uuid": "1866d564-46e3-4a17-9562-9552414c0428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673510, "uuid": "05585a91-16a3-4855-8bbd-8c71fb0c5c32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba71d9a1-0551-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598400, "uuid": "4af1aba0-c2fb-421a-b219-dee41b78d1b2", "comment": "Malware payload (Mirai)", "value": "c8c5738f35a290efdfa22eeabf327f9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598400, "uuid": "74e0c6bc-c150-457c-95ea-70c071c63376", "comment": "Malware payload (Mirai)", "value": "65e1bb1e1342faa591b62be272abc5465b5fc66b57a5ad03c748f348b0c766e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598400, "uuid": "87993376-df61-4cc2-8575-72b844966eba", "comment": "Malware payload (Mirai)", "value": "de723fd9bdf05ef03f38de48bf29fc77beb86905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598400, "uuid": "d3d7f663-5367-4f08-be56-8188cf412aac", "comment": "Malware payload (Mirai)", "value": "3a8d7311dde3649490d6e91649c9b97d14dd11c62aedf84e3897f1ffa948ced193e071b25cef8c64650bc16447c91c36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598400, "uuid": "9480dbfa-bf2f-4170-964f-9d1282f1dc02", "value": "T1E393E60A7B600EF7ECABDC3705EA2B05249D992A25AD6F75B130D818F14F24F1BD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598400, "uuid": "655f4602-9fa5-4f56-ba02-dff43e9492bd", "value": "1536:d/3A+amD+/xGr29wswj8drP9iznKvrT+DEZKIfh:dymwR9+JDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598400, "uuid": "c7c77b70-1a29-49cd-a91d-be5a4248f381", "value": 92816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598400, "uuid": "1403d951-9d2a-47d1-95f3-d87ddf08f136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598400, "uuid": "99fb00a9-c199-47aa-9570-1f766fd07330", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3140b1d9-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646273, "uuid": "abb401d8-d451-4021-9270-059f91eb0570", "comment": "Malware payload", "value": "285e113251add1e94ee70376017b545c", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646273, "uuid": "225fb240-e379-4a7f-9636-aa30b70e4d78", "comment": "Malware payload", "value": "67e2c9780a9067ba2dcc6713db2c409559fe6e8d4656062680e3575893223c09", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646273, "uuid": "5d1b26e4-3c82-41e8-b2f8-9f8fa48109c0", "comment": "Malware payload", "value": "05d342f4520f333701ac25e8ec8c3cd723f2e770", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646273, "uuid": "9cdc3958-ae39-41ff-ada2-d12f2f32e97d", "comment": "Malware payload", "value": "ecc57ad1acc9abaf521868a20fe01436bf9a910d4652ff4f83886c31fd7e0299ae46e879bdc5647ff0e5d67dc6d30b27", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646273, "uuid": "97f25361-23b3-4bf0-8c2c-6ed75feeda93", "value": "T17AC1460057F59A08BAF32F05AA7FA455497B7A5E9E3ADA0C0048C14E1BF1A44D8B7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646273, "uuid": "eeab779d-2e79-4ae9-9261-25b498b672ac", "value": "96:3yEBs5sZ5+fOB1yFwFiODShsZ5uHAKkx1hornSRqxHyHAY+HJM5DDoFSML0ZkvWv:3ye8fpqFicMkxzorqqc+QDGVM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646273, "uuid": "e9d5384d-a6dd-4460-bf40-3832583ee738", "value": 5922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646273, "uuid": "5508b125-4256-4131-b6d1-b6dca2c7e3d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646273, "uuid": "03194c3a-a4d6-4c3e-9489-14743e42cae5", "value": "67e2c9780a9067ba2dcc6713db2c409559fe6e8d4656062680e3575893223c09.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f360aa35-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598925, "uuid": "0c5767dd-29a9-439d-b53f-aa2d54df19fd", "comment": "Malware payload (Mirai)", "value": "a734ac2a82bbebc155b601ed45289bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598925, "uuid": "11f8eec8-679f-4f0d-b8cc-830c49218637", "comment": "Malware payload (Mirai)", "value": "6807b852a6709c4c8a3d9ae6449772982cf7831b8d9575aa8850359a30dc89a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598925, "uuid": "983e8f51-d95e-4f1a-a85a-2408eb5a9e68", "comment": "Malware payload (Mirai)", "value": "744e9c2a5050e3d9a1c07c3275d78a4305238f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598925, "uuid": "c2966cce-8501-499b-9a11-aeb7fbe418d1", "comment": "Malware payload (Mirai)", "value": "77f67a370268694df8506be40c83db685e8131833c662954e2445d6d30b616d992e9915f1f138d90f8a77b0a4607836b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598925, "uuid": "df844091-59f5-4564-9b41-da45bf702beb", "value": "T12EA3189ABC85C202C6E061B2FB1F51DD371643B8E3E6B107CD19AF29674B8670E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598925, "uuid": "4193cd75-8e46-4313-ba19-2b1a6562408c", "value": "3072:bU8qMSgGfBeYaVr8F/slWAh2UQ5jJlIpElX3:wBMSNfBCr8NamIqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598925, "uuid": "2925e926-bfb4-49be-8226-4e9ec5e29027", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598925, "uuid": "06a45ff1-f953-40dd-96f3-ee330f5d162f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598925, "uuid": "52592a88-c27c-4540-83b6-6f71fc9e070e", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093d090e-05ce-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770651790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651790, "uuid": "b7d1fba7-113e-4e22-97e0-9422cbfe2246", "comment": "Malware payload (QuasarRAT)", "value": "66cc964e54273f08bf1c23a9afddc50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651790, "uuid": "1a587da2-8ba5-4f03-8340-ce3a0b948d0e", "comment": "Malware payload (QuasarRAT)", "value": "686c3ca1118e7576edbfc8c662b7a5c37d1ba9604da10eaabeb3caf5a42ea91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651790, "uuid": "ce2fa201-2189-448b-ae73-95a36420d2e0", "comment": "Malware payload (QuasarRAT)", "value": "c082d023f668c3556c28e264765115e231c57d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651790, "uuid": "fa2c0797-c73a-4501-8ff9-8a047932ecd0", "comment": "Malware payload (QuasarRAT)", "value": "b01e12f9d3db46f04a462922ee337994114182b71b3d93ec5bfb50b115f12ebf2effe7b029286f9ed37f9c9c9bfbc667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651790, "uuid": "a731c492-c7af-4469-b97d-6e1fde556559", "value": "T16CD4F6027F048E12F48D1237D29F45084BB2E9516AE6E32B7DB9776D281636B7C0DCDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651790, "uuid": "6466f4e1-920b-4de6-addd-c34c776a42f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651790, "uuid": "0dc82a23-0eca-46a6-8c5b-08b05b183194", "value": "12288:6c6YlcQyo+HyYu62r4FY0iRMjIIm1Z4zaPXqZ:KYlgoqPu9nIm1S4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651790, "uuid": "f343a1d9-dfe5-45ca-bed7-8ae981539ff8", "value": 614920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651790, "uuid": "4836cd36-0da1-4713-842b-20658bc12ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651790, "uuid": "f611d9e3-3d3c-4c77-a6dd-367bfca4ad2e", "value": "686c3ca1118e7576edbfc8c662b7a5c37d1ba9604da10eaabeb3caf5a42ea91e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a071f7d-058f-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770624947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624947, "uuid": "b1f7c918-d915-4e87-9d7b-4ca9f031fbd4", "comment": "Malware payload (AsyncRAT)", "value": "c325a87a81a8eaa24534b12c62b752a6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624947, "uuid": "104a0852-02b7-4bc3-8505-5ac2210c3f98", "comment": "Malware payload (AsyncRAT)", "value": "69a4fc2640ed5303843720bdb7a7e0342bfe9253a646b9e4e17eed184b0048f6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624947, "uuid": "2c284fcc-49ca-43dc-9936-f5c5a3f74c9f", "comment": "Malware payload (AsyncRAT)", "value": "13526d88e4ff12d5555d689d7a5a49383a52435a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624947, "uuid": "1b47b9f8-fee2-4a30-b8d6-47ae25c3da1d", "comment": "Malware payload (AsyncRAT)", "value": "eaaf0e5210873d6c2e3453fd7de1849ff6268055e301c3fad1054382e53ccae232cce656a7fcbba46c79b691cfbaa877", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624947, "uuid": "20072ce4-2235-4afa-8692-b5d5f9eeaf8d", "value": "T142D23A08B3D48561E1FD57B94D7292048775EE4BA963DB9E2FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624947, "uuid": "6582a64c-dae6-480e-b12f-9e1dd401944e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624947, "uuid": "23302af7-3ff8-4daa-a0d5-778177253b53", "value": "768:OzCiRXbBJYMgsg/cIRGqo+/Rb7fB/dTj/+:O+iRXFJYMgN1iwRbN/x/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770624947, "uuid": "074ff77e-a5f0-47c1-8cad-25651b5dd521", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770624947, "uuid": "d468fa69-713f-4cd5-84d9-cb8a64d3dcf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624947, "uuid": "d02152b5-2e63-4812-bbe2-fc9bc6f88c63", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5e5c20-0586-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770620873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620873, "uuid": "3ea1d2ab-96f5-4757-9ddb-aa59d44ea9b2", "comment": "Malware payload", "value": "b300fa4ea317cf3490deda2c54b53482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620873, "uuid": "028a5f6f-a55a-45fb-b149-e2ce7dfd203a", "comment": "Malware payload", "value": "69f83ffa92b1c85fadebaeb9f7afc1076cffa32d7faad6913d5a99c22cbba99c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620873, "uuid": "76f47a24-b50d-4ef6-80c7-acf244fe4c98", "comment": "Malware payload", "value": "63585ec2e70ff3d4b1397745652bd0f551a688f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620873, "uuid": "c417d8fa-3437-4d50-b9e9-c31979f045d5", "comment": "Malware payload", "value": "bbf8ae6c60b373d9d06c05ee7a1d21b19288f133e2cd0bcd80e2e89d7f062a86744952c38f1404bef46960212f479c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620873, "uuid": "793936e2-3c49-4e36-87eb-77ace3dd4254", "value": "T10803927BFE475B8EE03AC473985605B0E7626B8C52A0334217E155384FA4A8F4F6EBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620873, "uuid": "c1515103-4391-4715-8ff3-b22457f7b359", "value": "384:z9oTumT6FZRA6Tef3vH6yKC4gU6AH5feVRsq8it7YsGnCbrbz:i6Nef3vH6yKC4rNu7YoHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620873, "uuid": "1773b120-6908-4da5-88e0-da8672ff9968", "value": 38197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620873, "uuid": "9fd976c4-5a10-4ef8-9764-9ffe10622708", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620873, "uuid": "8b352621-747c-4703-8110-f66ed0de88c3", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaee383-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646564, "uuid": "bcc40f46-039a-4c17-bd13-299b5165e5fb", "comment": "Malware payload", "value": "6a64aabbe344ee51f249166b9ed62374", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646564, "uuid": "1d514d7e-f578-4bba-8623-0e21298e34b2", "comment": "Malware payload", "value": "6a251ec2b354796bb9063b67143806b883d87844af87d39f897b9094441a5434", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646564, "uuid": "7af1e69a-e034-4b5e-b825-0037797c0f5d", "comment": "Malware payload", "value": "e9c5edecee852e83fba80ec1b93dc041921b5696", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646564, "uuid": "cb1a479f-8e7e-44f0-92f5-78a818ac5781", "comment": "Malware payload", "value": "14f0a3e11accebe11a498f0dce984c836e11696755ac8adb94bc086f016857507c54b7c20056092c98721ed5b5bdf9be", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646564, "uuid": "cab2592c-894a-4c5f-b1a0-3d94fc12281f", "value": "T1AFF28A12769F960C70B3124D5A9F02744B6F769F1E7F8199018CEA8A8FE35019C8B7B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646564, "uuid": "68fa0625-71b6-4ad2-bb95-e2f20330abc4", "value": "384:R+vemXXyXcpppppppppppppppppKwg6Xd+afPFUIYRrQCCCRTB8:qg6XdDfPpYRrbCCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646564, "uuid": "ba57f076-304c-4eec-bee2-906b1fe8927a", "value": 36884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646564, "uuid": "1d7e4aa6-53ff-453c-8352-f7f83e7760f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646564, "uuid": "773f2c43-8b57-4131-a5b2-812bb43739a5", "value": "6a251ec2b354796bb9063b67143806b883d87844af87d39f897b9094441a5434.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84259440-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770632239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632239, "uuid": "ad41bfaa-f86f-4c99-967a-0327875636c2", "comment": "Malware payload (PhantomStealer)", "value": "db1eceb37ae239e0a0471425551f31a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632239, "uuid": "3c77d435-4e1b-4b1a-9f38-9f3488d60a20", "comment": "Malware payload (PhantomStealer)", "value": "6a6f536464eef282d604d18eee6668b26334ed06642969ea1f959a076f542401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632239, "uuid": "28135242-b166-4981-b778-f79e848e69f5", "comment": "Malware payload (PhantomStealer)", "value": "339870a33cce6bd08c5c3c27e8302f4ef377f0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632239, "uuid": "777597d9-ef65-467c-b51f-b125debaad14", "comment": "Malware payload (PhantomStealer)", "value": "dc6809eae54f9179ee360a1282f7e16bc08319c9247583453d7f6113502f348c3ce27b1b06a47047fac2b4753fddc783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632239, "uuid": "ff7c0d02-6c33-480b-85b8-6fbe5adad59b", "value": "T17C85F11153E86A6CF9BF9B3C0679445443F1B94ACB32DF2E799D809D1821F93DAA1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632239, "uuid": "c3ebf657-1d95-4b62-a60c-0a1b06bd15fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632239, "uuid": "0a79c3f9-8cce-43e4-ab52-810d71da7fdf", "value": "24576:TEst1d5R43L6c/rWQs3/eBo9BqV8qIIvQDEp//ndkRb80k:lt1d5OBWD/4HVhIZDAn69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632239, "uuid": "591ca347-a5ad-40dd-9d81-c16a833e0399", "value": 1858560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632239, "uuid": "9dfe9771-778a-46ee-9ef5-e08e3060a671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632239, "uuid": "fd8b6c25-38b7-48fb-86d9-39368db41daa", "value": "Orden_de_Compra_WHFarm_26587.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff23e4f-058e-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770624447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624447, "uuid": "c98eb218-a277-49a2-bfc0-066bb4e1233b", "comment": "Malware payload (XWorm)", "value": "e4c9f74b18816d73ab04ad016fc579ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624447, "uuid": "a68c7057-230f-4112-8cda-5ee24175dc2e", "comment": "Malware payload (XWorm)", "value": "6bbe903a9cac83eb79a16f05b00ab6342861811f2ceb879177f36133f9237906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624447, "uuid": "6195ea2b-50d9-46a2-8ed5-f5b256568a34", "comment": "Malware payload (XWorm)", "value": "5a10554e3cfb139ccc1480a7c113e3c38a732b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624447, "uuid": "b10d3c03-7b31-4af3-b50f-a6f0547c7674", "comment": "Malware payload (XWorm)", "value": "a8c64c5a0b455206033e8f78cb93567cdf922944b5a94c567baf128e37bbf733fbfa2f30b9a33a6f9c4acc39e6ade123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624447, "uuid": "1454876f-012d-484b-a074-fb4eb4875d68", "value": "T1E5D4BE1523D84B68F8BFA738B479111447F1F81E8B22EA2E7F9951E90865F4CC5A2733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624447, "uuid": "ba8dba0b-8718-4953-b6f6-8c8173510b9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624447, "uuid": "d1c1ab69-02b3-4eca-94bf-f4cf10a0c091", "value": "12288:0aDrj/roSUdKxuNHK67OUXEsJCW4AIjX2hD0FLoDEA:b/kfd1HK6/XZfSpF8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770624447, "uuid": "d3233d13-123d-48e8-94e6-12f4c16bab59", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770624447, "uuid": "63796107-e005-413e-b08f-5892f318dbec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624447, "uuid": "4a840436-789b-41ff-b790-50465248ba8b", "value": "Zam\u00f3wienie - 00500262026 - LVS Polska SA.pdf(68KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b66457-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632425, "uuid": "fdf88a98-a39f-4fc6-8697-0570f4efb997", "comment": "Malware payload (Mirai)", "value": "476745add1f9e238f979083e1dbac9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632425, "uuid": "fb22f76f-5b27-434f-a258-836140bfbd37", "comment": "Malware payload (Mirai)", "value": "6bd6e7e635a62eeb691130e31620cb3992e2fd49431c0589d14a03bfa472b4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632425, "uuid": "a5efb13f-ea1b-42ed-a6d8-9fbb47f50b4f", "comment": "Malware payload (Mirai)", "value": "ae8e809333d27bcb40b17ee4ffdfb08c65d935ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632425, "uuid": "097b7118-3515-44e2-8078-e9b558f60eb0", "comment": "Malware payload (Mirai)", "value": "5c97e07292f6f17b4a612d82c2176e1a4867526c84d869df5ffa701abf15f9eea811076e26f1408cf3d7e0f7d32fdf20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632425, "uuid": "0f52f821-a81a-4dbd-bfff-8614c371f9fe", "value": "T11DC32B45F8405B23C6C612BBFB5E428D3B2A17D8D3EE720399255F61378785B0E37A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632425, "uuid": "2857fba8-e375-453b-a9ae-62fa50d927d2", "value": "3072:rK/uRn1hEwOLWCK94sY6EiPbYORJpkO7:rKFFLfC4sdEiTYKJpkO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632425, "uuid": "f95fb507-19b8-4f03-8ce6-c744d05062e4", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632425, "uuid": "06ac7524-a0aa-453f-a07f-d6a5b55f1298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632425, "uuid": "0200527a-7d6a-49ab-b5e1-c7c151a90768", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c648150-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770670908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670908, "uuid": "cf561e13-6bc4-476c-9757-211da0d10032", "comment": "Malware payload", "value": "9de380e00478bc803c33aaa13ffe7e5a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670908, "uuid": "5ce309e5-c1c0-45cd-a206-f9d48c355a1b", "comment": "Malware payload", "value": "6c0a23736c3d0849c3cdcdc90cfd6f6ff567b74736879cb0043d11451c785152", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670908, "uuid": "0cbdef8f-1efc-401e-8759-c33ead5fa175", "comment": "Malware payload", "value": "9435958a4ce420fab881c95638cf4a051623beae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670908, "uuid": "a45acf44-7030-43bf-8afc-c609036d3899", "comment": "Malware payload", "value": "59140eca3431812171e582ee4c97f53968d6568de2a59f598ecee10704d11e141284dd34f56a332bdf5d06255d0a1c0f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670908, "uuid": "b3458cc7-e9a5-4e8e-8435-be9b03f8f3b9", "value": "T1F6F6010362A89F07E162D775BF3745A05F267D1D98D2B0EE1107398B1B70BB149AE23E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670908, "uuid": "648c0c6a-8642-4869-961d-af4e92198190", "value": "393216:jmkEdQ03NldPmkEdymkEdMmkEdCmkEdOmkEdZmkEd:pE2cxtEkEaEQE8ENE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670908, "uuid": "b934c857-31b8-4038-9e28-c079ddf80a7c", "value": 15499264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670908, "uuid": "dabcb32f-3de0-46be-aec1-8ccdc4cd4d15", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670908, "uuid": "8c8d6304-42e0-42aa-9b2a-bad6fb293a3b", "value": "6c0a23736c3d0849c3cdcdc90cfd6f6ff567b74736879cb0043d11451c785152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb686741-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1770648653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648653, "uuid": "3e39432b-bcd2-41d5-923c-50ae5251d982", "comment": "Malware payload (DattoRMM)", "value": "4354667e257893d78d43af0761085e83", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648653, "uuid": "8dbe0693-3443-4c07-aeb8-18509dd773aa", "comment": "Malware payload (DattoRMM)", "value": "6c9a256bdfd921b0a4fed89b58acc41a3b1f48cc2b5e9149412023bff8f9d46c", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648653, "uuid": "d4b18c34-531c-43f4-9cd2-000fd537dc1f", "comment": "Malware payload (DattoRMM)", "value": "73c466e9db58aefaacdde962b8caf4ad0aa26af9", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648653, "uuid": "25785609-1df1-4b73-9f3b-ec1fa21fb624", "comment": "Malware payload (DattoRMM)", "value": "3302d67fc9f5edda23cce8c73e07a29886b1d9f572f2177ee52475a20c5f87f5a54c82f494688baedd7c0358c66e4276", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648653, "uuid": "2f3bfdc2-74cb-40e6-980c-16c5cce0392d", "value": "T134B63313C57BCCE4CB234678D6E10A46BB4A058A9C5AB8D5F584633E45D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648653, "uuid": "4dad34ea-1390-4d9f-ad5e-206454bc5cdd", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648653, "uuid": "f6808132-eee2-4159-ae2d-f541299edf76", "value": "196608:FaZk+wY0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:BnY04RT9R4PkE7Ap84p29qIT0Z6rXr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648653, "uuid": "ea9f440c-5dff-484a-8dec-825a33fab168", "value": 11055792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648653, "uuid": "e3626e9f-c476-4bd4-baa5-696f63b71b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648653, "uuid": "3bdcf585-bb7c-4ff9-8599-73fc8b7f8913", "value": "2026_RSVP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f7819d-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770657963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657963, "uuid": "aa9ca356-e551-4f14-98d2-d2ebe4c8e694", "comment": "Malware payload (RemcosRAT)", "value": "9c0f2390109fa6c6756aa8916614372a", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657963, "uuid": "6e66df32-d938-41e6-b645-e72c1ffc7c1c", "comment": "Malware payload (RemcosRAT)", "value": "6eac23c5b3c0017b9205ab1630cc6099690fae32e31ed1dda30bb62877428115", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657963, "uuid": "a659451e-a098-4489-86b6-15d65f9c75ab", "comment": "Malware payload (RemcosRAT)", "value": "4ab5e6b389d181499cceb4991eb14a53e1a76da6", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657963, "uuid": "78746f54-0153-48ea-8ea0-46130e7edd50", "comment": "Malware payload (RemcosRAT)", "value": "852e4729870ab18253f8432091b032b656efa7bc993c9ef195712f4910489fc65efb0b5fd40009cc469b734a171a4623", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657963, "uuid": "e6a1d8ac-b626-4b2b-a2c2-8815f26b3e12", "value": "T1CDA4BF02B5C1C0F2D57210344429BBF5DEBCBD3119259B7BA3DA1D6BFD70183AA296B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657963, "uuid": "cb8407bd-4a0d-4491-8280-12ccf54a5d8c", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657963, "uuid": "893ec1ab-3b5f-4418-87ee-f2712ac9d16b", "value": "12288:eqdfXIvx5EaaSQli27hu1AEegrsfZcyzn9:FfYvx5Eaafhu1AEeg+Z/z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657963, "uuid": "89b687c6-8dcd-43c3-a946-5fbddd4c9d2c", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657963, "uuid": "cc350aaa-cb7c-4c08-9a07-8f18d1408f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657963, "uuid": "b901a7d3-cc3d-48e8-80d2-ed8dc88a6b2f", "value": "6eac23c5b3c0017b9205ab1630cc6099690fae32e31ed1dda30bb62877428115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50b26eb-05c3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647461, "uuid": "724a985b-e748-4f69-93f3-ca521355beee", "comment": "Malware payload", "value": "7957c18f95aae05680bc5fc5504ea872", "object_relation": "md5", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647461, "uuid": "a926e16c-eec6-412c-8cb6-1a41ce8c10b2", "comment": "Malware payload", "value": "70446722fe0a6c57049818ffdd677342bf3e2df3135c2d62c5f87a165ab4e8bc", "object_relation": "sha256", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647461, "uuid": "088450e3-b148-481c-b806-7099398a9146", "comment": "Malware payload", "value": "e93de23c36adb8be0b671f4a91c172cd70b6b704", "object_relation": "sha1", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647461, "uuid": "13fef71e-2c10-427b-8842-a57710b40284", "comment": "Malware payload", "value": "e2be81a93c55bb9e67e8b4ccdec35ac36e5a7d280d4655fe87a6465882b1a8e4dc2f9e6e636c2e6928b3d33299d4f1fb", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647461, "uuid": "8748f4d2-d228-4124-853a-42e5ae553a7b", "value": "T10762E760B3E847B2F9BF3EF568B283410672F7669D12E91C0DC970CA09B26458B55E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647461, "uuid": "ff33486e-a44a-4cba-92b3-ed9c8127fa7b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647461, "uuid": "8912dfff-75ca-427c-9350-b793dc6fd1cc", "value": "384:q04CnzcGW0T9Y5XZwi0s18wCpT8c+R5L95mk:q04ARUX+i0sewU+rh53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647461, "uuid": "0837f8d1-dbb4-471d-88cc-f1bfc149fdc3", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647461, "uuid": "abc70fbd-f42d-47e4-bd40-1f725230871c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647461, "uuid": "ed0e7bd4-f298-41c2-a84c-5d28f700246a", "value": "DetectarAntivirus.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b39edbc-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770658048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658048, "uuid": "9c107a77-5c88-4216-ace8-b8ebf58c6271", "comment": "Malware payload", "value": "05e23654c097186b40481aee5c1030cc", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658048, "uuid": "4bf9c052-f6b3-4686-a281-76aeaf9128d5", "comment": "Malware payload", "value": "7070e8086054e0df0cd4d02a0f8f29e7a298dabcc789abe0e2348b675f70ba2b", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658048, "uuid": "462cc71f-9124-4362-9b1c-218054aa7256", "comment": "Malware payload", "value": "524703e05c78c3873e43cb12824040c6ec08972d", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658048, "uuid": "6a4c9712-e096-40a7-99e3-aa750a27aa97", "comment": "Malware payload", "value": "cb750ed32f21759ae500091f3c9c3085b6b82c63c0647abd6c9c122f52f14851f7de5f13cfd14713fd8c082fba621df7", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658048, "uuid": "feeb2236-2b9f-4a5f-a15c-4459faaab95b", "value": "T14395D0DBE580C473C0621936881EAE526415BBA01AD758727AF9094D4FFF382F71BD8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658048, "uuid": "f15dfab5-b5bf-4ca6-90ab-f823f4e0b6b0", "value": "24576:u3VqOtJFmDaAMGf9g00JjRiU8UEqYpGn6bnj083gVfvriHsGL9oHPeJlKe0tJ:u3VDmQjRjnEqYpG67ISgV3uHsDe0tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770658048, "uuid": "9bc4c7f9-8fc2-43e7-a8cb-228eeb9a5bb3", "value": 1964651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770658048, "uuid": "31f40f4e-df48-4d60-9e96-039a842e5720", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658048, "uuid": "341eee25-e1c3-4e84-90bd-2be9401a5718", "value": "7070e8086054e0df0cd4d02a0f8f29e7a298dabcc789abe0e2348b675f70ba2b.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26125d4c-05c4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647543, "uuid": "f5564ab3-f742-4919-b9c2-845afa202ffd", "comment": "Malware payload", "value": "827e211f7cd47081335d4cc58bda5424", "object_relation": "md5", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647543, "uuid": "6a86eefa-274f-4d79-ae28-efe5438fc4f7", "comment": "Malware payload", "value": "7092bd7c117606213d55bdef62d58300244450f000e92e02e8ec5dc8f1c0ad21", "object_relation": "sha256", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647543, "uuid": "7f28d8ef-81dd-43d2-82f3-35a7b3d11dc6", "comment": "Malware payload", "value": "3cdb0d903805cbc3724aaca083413c2fd72bea6e", "object_relation": "sha1", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647543, "uuid": "312cca61-f00e-4c77-b9c9-4c95b0da9b5e", "comment": "Malware payload", "value": "0313231dd4691c019e0eb3d5ac2a61f403b6fd212554553e5a15cca1ac29884ba3faf02157ae8ca6f30e33a1567178ea", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB RAT plugin", "colour": "#40FD58", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647543, "uuid": "72205bf9-6633-463b-bb04-8902d661d7e6", "value": "T143520941A388823FD97F2D755C32A2420A71E615DA13FF2F6CCCB42A09F32554B52B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647543, "uuid": "5dcf2bc4-e613-4153-afdb-1273742d7366", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647543, "uuid": "20dbd2bc-5c9b-4944-a88b-f9c515d690ae", "value": "384:yTGmzFrbzBRVJc2Y/XH4JpYckAYho9Xp5B5tk:yTG8klHCktCX5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647543, "uuid": "41b62c8e-63ff-46ea-af55-e21662a5214b", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647543, "uuid": "9570e125-552c-43f2-bd9c-b1ce213879e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647543, "uuid": "e501ec89-22d7-49eb-8b75-be5ace054243", "value": "Ping_Net.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776feae0-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1770632218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632218, "uuid": "bb05b670-946e-4703-828d-8c641a5cbe46", "comment": "Malware payload (GCleaner)", "value": "2480038a7bf294004858a8f3e5052ab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632218, "uuid": "e2103167-89d0-4652-8d9a-c8689bba9dbd", "comment": "Malware payload (GCleaner)", "value": "71a5caa56145081aa4982c82b660176ed21ace48a93daec955179b4199513bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632218, "uuid": "71b3bedc-c2f0-4da9-afb5-08014e2faada", "comment": "Malware payload (GCleaner)", "value": "769caab0ea61f117abf5badbb8ac66f693190089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632218, "uuid": "b86556ad-3612-46a2-93a3-11732be8eb5a", "comment": "Malware payload (GCleaner)", "value": "a8eeb30c3583a9af8176349ed09be757cac0420b9baaa972cb08e322d1129ec4abd6ba66c90ed51a47bbc685577dfc6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632218, "uuid": "075f61e6-60ee-45b5-b0e5-219bca145773", "value": "T14056E015FA762CE1DBEE1C74D80BE44F881E35263F6868402DCA1DE61C8736B5DA271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632218, "uuid": "9593778e-2dee-4955-a90e-687f46d09511", "value": "4eeebe9c7cba6cf85504d75366422a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632218, "uuid": "ed1e9132-c873-48a6-bac8-baccb1fec32e", "value": "98304:uLJ1dE5Kxmot7ItnRmK5w+b0a37i5dGC:uLmNtRmKSsLr5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632218, "uuid": "3a0d10ee-7b1d-4f2c-957c-6252aef1495b", "value": 6113792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632218, "uuid": "1588d670-227b-4095-90c7-ba5086fdacc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632218, "uuid": "9d0631a7-abc9-4177-bfbb-68ae8ca95015", "value": "2480038a7bf294004858a8f3e5052ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc96843-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596738, "uuid": "ad43fb9b-68f3-408c-b39b-5be632c92edd", "comment": "Malware payload (Mirai)", "value": "a9e0415f6674b964957bc354edd1870f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596738, "uuid": "fddfce40-987c-46a8-a198-b05b4a2c6032", "comment": "Malware payload (Mirai)", "value": "723141d159f1c15d4a2ad22050e46f10fdbde63a666d8e4badaf09054bdfa5e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596738, "uuid": "b8aecd11-a14c-4c0a-b9df-7dc0e6a0182f", "comment": "Malware payload (Mirai)", "value": "a512144933fe0ae5650a63257d80690e14296d9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596738, "uuid": "87b1fa4c-5fae-492d-8f2a-6a44302c1f99", "comment": "Malware payload (Mirai)", "value": "0d9dce38ff1e8784adcb6bb61d627d8f6ff23d2084703939b721c66530ea931b755be0ee1f2665d2369b3b826d84489a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596738, "uuid": "b035f965-4560-4d4a-b743-a327b54cd4d1", "value": "T16DF2E1B1B26239B2F0F00A34DA3EEBD123D74239D1AD349171AE47E976C2AC51D7909D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596738, "uuid": "fb71e566-7d5a-4466-ad6e-e51eeefdaced", "value": "768:tRSf3xuxgE0jAY4S6MPY/AoGVE+DIrPB2eY3U03wfxM:TyuV0PpQAriPMe1fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596738, "uuid": "e61453a6-7fd4-4b0c-9e79-4f0c1b634b28", "value": 34400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596738, "uuid": "2cdb1c4a-d5e4-488e-89a6-d6233316c625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596738, "uuid": "8be46765-e7c9-4c9e-b302-cc661bf2908a", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0b9a60-058f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770624741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624741, "uuid": "9d2ba2c4-1173-4921-97c0-18bb60218b10", "comment": "Malware payload", "value": "d98d510df4329420ee78c197a2b7138b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624741, "uuid": "01e38c8c-9be7-42b5-b031-e74bd3de9cca", "comment": "Malware payload", "value": "74973d963dd84473230a95e7bbff5c2d1042e2c22c705d5a140bc7a41d0e725f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624741, "uuid": "6bc3ed34-381f-4d3f-8acb-d0a41546b81a", "comment": "Malware payload", "value": "0653075ae2ec55db028820ef2d8a11fb6b690408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624741, "uuid": "54093f5c-8ffb-435e-9564-7c9b500a9677", "comment": "Malware payload", "value": "0d6dc6632984d3d7a77360b57265e99e0058d20a68d9a88c92aa727af035da1f8d901b9648ba65c7bcfbd10df9c84a2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624741, "uuid": "c93ee0af-775c-494e-9192-e2a1aabbd4d7", "value": "T17A763A51FE8B54F6E9430D3154BBA22F23311D094F24DBD3EA44BF69FA7BA951832209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624741, "uuid": "3cb603ef-dbcf-4986-8650-1e13d340d149", "value": "49152:9VzIavZ2YpT0Dh8Raj8pbCg32H5uwbpR8H5eojGQnViptzQMwYHXU6PiIIoEAorE:Dp2YRQhLj8pbpwpR7ojGQVGuWn/blWEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770624741, "uuid": "81510357-8fe1-4ebb-9efc-f9e93c8c406c", "value": 7221432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770624741, "uuid": "42bef498-3271-435a-84f4-fa119b7815da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624741, "uuid": "88e85d81-6b3c-48e4-8ba8-34a64029b5ca", "value": "crack", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee623b-0574-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770613240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613240, "uuid": "f931d413-e7a6-47a6-8770-c8334b18387e", "comment": "Malware payload (PhantomStealer)", "value": "715870da3de6f967137a0a28b1a1189b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613240, "uuid": "3e0dea80-4669-46b0-8700-3e7e9e73f553", "comment": "Malware payload (PhantomStealer)", "value": "74a7b0a30846e3b670be3f9fd0ba2fda1f0d682d1dae1006b36b3781ec521153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613240, "uuid": "3c57de06-7eed-494b-b4f2-a45062d811dc", "comment": "Malware payload (PhantomStealer)", "value": "7fb6d6231244351f2b9b8727a50481b7f3a5d1f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613240, "uuid": "70779ffd-320c-4586-ac88-fe5c55f33265", "comment": "Malware payload (PhantomStealer)", "value": "61dc7649efa323a44000905c393dacf878c0ccea25368c231e992ca930e4dc88fc7f7009ae5d3f30c8da36d624bcb330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613240, "uuid": "c39194f3-e77e-4ff6-b52d-d218d9e072f6", "value": "T18875F1C13B257726DD6D8971A526DDB993B63CA87001F6E62CCC378735BE202AD09F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613240, "uuid": "54c535b4-8fb0-4e48-8124-71c4d85d6ea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613240, "uuid": "aa3eba58-d001-4dde-8e73-f1bbae09e8f5", "value": "24576:YY4bKjyGGwn6IFRgXmmug6qfSIsNUa+EA+3D07OGgfNVMD9aNxl0w:Z4bKePwHFRS1ugTfENvxA+IJgfTMkNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770613240, "uuid": "519da103-b104-4d68-8376-a145666feccf", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770613240, "uuid": "ec941540-ba37-434f-8f71-9fb62f0a6f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613240, "uuid": "a4e6c265-173d-4257-9d2d-6294a302135c", "value": "REQUESTING FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821c74f7-05a6-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770634813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634813, "uuid": "1af8164f-0161-4c50-87a8-128dcc73eeb8", "comment": "Malware payload (GuLoader)", "value": "3027b3186711c0a52910bd69df93b409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634813, "uuid": "2a7fdfc4-4d7f-4c68-96fb-4ef3620a768e", "comment": "Malware payload (GuLoader)", "value": "76b44a01a26e771a473e255999e0026a153c9dc30271f4f9908f61cd4dd4ca19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634813, "uuid": "f219d64b-908e-42ec-a36a-9f5636024bb3", "comment": "Malware payload (GuLoader)", "value": "660014417cb2fb13b712bae1c9f1d48b79d519ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634813, "uuid": "3a15c2c2-0f15-4a0c-b842-a2e2cecce2e4", "comment": "Malware payload (GuLoader)", "value": "516edb44af783ab03f514263ca3e9d00cc8074c9bde364575b7e8456a26f91f61e4678e04fb9168fd51e926d871285b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634813, "uuid": "53f44e21-6ff3-4909-82d8-035579f690a7", "value": "T1B184F1013282E543CEED0671456FD2FE4EB5AE7B99858A57E380F76F3CB52C6BA18104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634813, "uuid": "3c79df08-b7c8-4d67-9dcf-59c3259f1efa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634813, "uuid": "88a0e29e-98d0-469e-89c3-2517ddf3ed45", "value": "6144:fQ606xV8H+lc7SGd7UgsVk8TbR523hhGdw0pB4c9YEb8II73NSjsZvq:UecGGRUgek8Pn2RhEbr4ceEb473UjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770634813, "uuid": "11db12fc-6e61-4905-88aa-46ac62c7d7e2", "value": 405790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770634813, "uuid": "f747a7e2-bdf4-4c99-a6c9-5e08bd3122fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634813, "uuid": "b6f2705f-a319-40e1-a443-a77287159d5f", "value": "rNewOrderN__2160848004.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2754c520-05f2-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770667302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667302, "uuid": "ae647402-e971-45f5-a88a-d55e1a482e41", "comment": "Malware payload (Formbook)", "value": "1521b134f32bfe5259d5991257964467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667302, "uuid": "1b259994-4bb0-474f-b624-6b021e9b60d9", "comment": "Malware payload (Formbook)", "value": "76caf765a683cb644927e208e4dba34f5f781c182c4e703ca0a1a2e4c70122e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667302, "uuid": "5bd909c8-549c-454f-9324-67c3719cef61", "comment": "Malware payload (Formbook)", "value": "62702f5cfc77bb14087104c9575621cbed7a682c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667302, "uuid": "e1aadb9a-3290-454c-a000-7292d025851f", "comment": "Malware payload (Formbook)", "value": "0d7bf1bb4a3861d02bc9a4a23500ff57190aba52e26f8c5f38ca24615b11dfc11cc17786211259b53c775825c2be47bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667302, "uuid": "adabd40c-0f7f-4537-a685-972c8f121f4a", "value": "T1FF45BF027381C066FFAB91734B5AF6115BBC79260123E61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667302, "uuid": "f2af5966-2235-43df-9f6f-996537dec362", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667302, "uuid": "cb0ae6c0-0e8d-4890-9fbe-88549af5e350", "value": "24576:p5EmXFtKaL4/oFe5T9yyXYfP1ijXdaa1Dj7VUp4Ve8mk:pPVt/LZeJbInQRaa1rVUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770667302, "uuid": "48213264-c8f0-4d8d-9b61-d480cc9ed01a", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770667302, "uuid": "90d14002-268d-4a40-a3bc-063fcd1f324f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667302, "uuid": "113faf20-4f2c-4ffe-8341-4bf7559dc42a", "value": "RFQ_Technical_Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf3374a-054b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770595879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595879, "uuid": "943b8dc5-184f-45c0-8ad9-da3870618974", "comment": "Malware payload (Mirai)", "value": "67885bb3a90600bde70fee3d090db591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595879, "uuid": "709016b0-32ab-4d8b-b57f-1fcb111fc650", "comment": "Malware payload (Mirai)", "value": "775c5b89a829416440a0a4b11a490d8df7db9b32b8ab01ea433763cfe736e5f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595879, "uuid": "b965fd35-5706-4ffe-9705-05ec070395ca", "comment": "Malware payload (Mirai)", "value": "ccdf0eecad34d75e5bdd970ad29ca299ac2dd764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595879, "uuid": "361ed7d5-d36c-48ba-b46b-8c4cd2d87554", "comment": "Malware payload (Mirai)", "value": "61e1851d9921ec272bb574a81fbd5b42a20b3cbff4f3442a25148cd89eceb7c97273cd3d62ca71b284b4e35b980c330d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595879, "uuid": "64820bdd-42ff-4b46-9f4e-b4a9c85474c1", "value": "T15C243B46AA808E13C1D5277BAA5F414E33329758E3EBB2068D1C5F7837CBA5E4E37506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595879, "uuid": "306d757d-90e5-4e78-b5f6-1d5426d2b107", "value": "6144:7Mbz1Pcb3eCboLmpMguHcUGVUHalw7WsuH0xsfCyXVjrabEX35Hy2VfM/9Vi0:7Mbz1Pcb3eqoLmpMguHcnVUHalw7Wsus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770595879, "uuid": "d8545abc-b947-43b3-88c2-20846001f335", "value": 210824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770595879, "uuid": "a75d0704-5dab-402b-904b-2f154bb94e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595879, "uuid": "74c46078-35b0-42b0-8162-f693ce84bf0e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa60378a-058e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770624706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624706, "uuid": "e2e12d3c-645a-4899-b932-bac0cecdba2a", "comment": "Malware payload", "value": "2a7cc34fc0ccad7a8d3985e84e46defa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624706, "uuid": "1a6ad693-8ff9-44c2-b86f-7bb46f05af12", "comment": "Malware payload", "value": "790cb9fdb87da32e78c5547b08cc62ae47783bdded54cb7206d9161f937ab819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624706, "uuid": "854f0c48-8f0c-4d23-a6d2-52ffcd325231", "comment": "Malware payload", "value": "bd7287de77b8c4a8ad76e71a0ae0fa1bfa53008c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770624706, "uuid": "e4080289-3e3e-4ee4-94de-f5c68e436b90", "comment": "Malware payload", "value": "1336532ea928f8e84183ac05afbc6011da7bf5b6f3b641d1fcb971e4aebc275d24aa929d941eda206d6a8f605d9821a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624706, "uuid": "3adb7bd3-1269-462f-a4cb-54ebd39f7f20", "value": "T1C9D533B9E7E79CD67FE7132CDB644D86C285642A95D80C09A9E3ED2B443AF08931311B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624706, "uuid": "001d023f-d544-4dbf-85bd-6b7c81d2148e", "value": "49152:uFYQrskOnKHknWiQauMSsOV50/8G/4P5VDcyTvEbANk+xpXbfJyz+VkIRJNSGp:uFYFkOnKHknWiqjo/8Q47c1saApXNyzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770624706, "uuid": "87bcc9e7-d3a3-4842-af9b-833a2d1872a4", "value": 2791920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770624706, "uuid": "1933acd8-8562-48b3-95e2-1a7ace732a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770624706, "uuid": "712b3cd3-276a-4c2d-ad88-e44f1dac8c35", "value": "crack", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea7cf56-05ab-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770636793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636793, "uuid": "b17d543d-db6c-4f94-8e7f-573494e095b0", "comment": "Malware payload (Vidar)", "value": "2f78a99b8e441817f98bc1ebfe05d222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636793, "uuid": "60fddc9a-d736-4167-bb28-987b78d30b0b", "comment": "Malware payload (Vidar)", "value": "794c6218299d6e09e27b8ada94063c06a7d4b02c7f4fc7d4f65103c26dc65172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636793, "uuid": "76cfe7c2-0dbc-4eac-ae1f-ed510dd29012", "comment": "Malware payload (Vidar)", "value": "53d046a48dce7b07f0f4da119100f5ee34f5e599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770636793, "uuid": "40f4f736-485a-41c4-be1b-fc046adf268b", "comment": "Malware payload (Vidar)", "value": "50e8e8aaa88e908e034e3dcd2a5f234cb79bf30e57a418d06f711b5dbd784af023e6c1c2bf84759eaba530761fddb6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636793, "uuid": "ab421c51-a1b9-429e-8241-a9fe359a9750", "value": "T15DF53A4278D95866C6BBF134D49052A17632381683317FD71ECAA6BF0DBAFC85A3E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636793, "uuid": "926e95ef-0036-4b7f-ad93-8c3789f16b53", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636793, "uuid": "37d8fa87-9c7c-4ab3-8c3a-f75ffb46ec45", "value": "24576:/I7VnzySei5p73dMU/c96qWLuOqMCyPy2tVMge3+9fZcSJK1l9D/:/IwRi5Z3yU/S6VuOfjySMp41JK1l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770636793, "uuid": "c28e599d-2246-4291-b86a-5cc51833dcce", "value": 3638784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770636793, "uuid": "faaf4ae7-e1a7-4bfe-874b-c6d84cb0c9df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770636793, "uuid": "82606979-4eb9-4aa4-a3ad-510c782d866f", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7aa9ba-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1770648659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648659, "uuid": "1d13f35c-fa58-4765-bf02-4abb0f11e68f", "comment": "Malware payload (DattoRMM)", "value": "8de174bc7da75fd0b8faa49fb70265a3", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648659, "uuid": "9ba2efcf-dec2-4310-8de9-3572c02b785d", "comment": "Malware payload (DattoRMM)", "value": "7b14a0ec90b602972f1300428a9a80d37d74a43539d2203129c413c75756985a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648659, "uuid": "e206c1cb-eb04-494e-9ecc-bd0c19a893b8", "comment": "Malware payload (DattoRMM)", "value": "aae001b470123dfba477bc7f1651c27693248670", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648659, "uuid": "223af906-435c-4640-8572-81a0fe775e31", "comment": "Malware payload (DattoRMM)", "value": "a5f84b2add684d981358f196728e0b63a83476b744171ca7277c25509ef37f20903025738125eb47b202742219b35b85", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648659, "uuid": "d6faefb1-fec0-476c-a7d0-051f2a162e2f", "value": "T1E6B63313C57BCCE1CB234678D6E10A46BB4A018A9C5AB8D4F584633E55D74ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648659, "uuid": "a3e4c8f4-e3ff-4e02-8e18-15fdfee2c805", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648659, "uuid": "566dc7d4-d760-4644-98aa-11f519dcc281", "value": "196608:OaZk+wt0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8m:8nt04RT9R4PkE7Ap84p29qIT0Z6rXr8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648659, "uuid": "2fce931e-fc66-46b7-a04d-0ec6958c9868", "value": 11055792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648659, "uuid": "434da253-48c6-43a0-b50d-974fb28e7bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648659, "uuid": "c9364cd1-3ec4-423e-a366-780535067860", "value": "Valentine_IV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12ece84-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646515, "uuid": "9db8396f-de50-4af6-bb01-3a526fe794b6", "comment": "Malware payload", "value": "45e9f27199e816a54b584b716abc6a83", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646515, "uuid": "15b685f3-c403-411d-9f37-29249ae7c0f9", "comment": "Malware payload", "value": "7da6e0efa489991a04bfa847df5e545d565aa075a124dea5f234f6792f62b001", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646515, "uuid": "6ecb9911-66cd-4d3b-af3e-d4d436731d28", "comment": "Malware payload", "value": "6bc4f4e74ea76d5cd0942af95a821b8db82022e7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646515, "uuid": "7b444fe1-d77f-4ef9-a3c3-e52c1ba73f2f", "comment": "Malware payload", "value": "a7222ee2d148593443f9be43a908c2c6c0cf5be318c700c723a803123ea4d3e25da583726431f761d5ebd468da40581b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646515, "uuid": "7a0e69dc-7d64-488c-8dc0-7a7cdb3620fb", "value": "T12B436D07734915FCE26B5278E5236653E577B0062362A9DF03F444B20F976D2EE3E682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646515, "uuid": "c4adf3a3-b780-4ed8-8a0f-58c792f9a679", "value": "4ed77b3d5b8481bde75099ce04b67b43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646515, "uuid": "16dc17c5-0763-4cd2-8c71-064560d81512", "value": "768:NNkUD59FgIz3Wzx4FNhP1V9fvR0pKa+mApaMEbkGfpMCK+x2UG:fZgQv1V9fE+m2wQY2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646515, "uuid": "8e8d905a-2f78-454e-bcd4-e502cd229bc8", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646515, "uuid": "5b62df1f-a712-4a2a-97cb-10879e6c070a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646515, "uuid": "169e33fe-db66-4483-8c46-e2ac4d65731c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d64dfa-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770646581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646581, "uuid": "42e1f8ed-a85f-4254-9062-bb27ceb12a70", "comment": "Malware payload (DarkCloud)", "value": "fe2cd915f48f4af030d7e0ac50fcea3c", "object_relation": "md5", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646581, "uuid": "cc617af9-93b2-424d-bb84-784ce76fc64e", "comment": "Malware payload (DarkCloud)", "value": "7e616d0455c83957b916dc112802bfc40e1db08db3801ff4757303fafba5bc4e", "object_relation": "sha256", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646581, "uuid": "52b22cd1-00b1-4626-8bb0-99e86822e758", "comment": "Malware payload (DarkCloud)", "value": "d6e86aab7feddfc3477799d8000fcbcc49330158", "object_relation": "sha1", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646581, "uuid": "9b3a6e85-4481-44b9-9007-161b43369619", "comment": "Malware payload (DarkCloud)", "value": "a14bf8bbf6a29397b13faf6faf25e9e09380ee95db5b0b27d4f2cf9e8133f1361ddd2e0372a81f1ddf6865117ec5f490", "object_relation": "sha3-384", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646581, "uuid": "c7afd564-892e-4302-99d6-002628a1bda9", "value": "T1A1B18E875A06F82BFDE692FFA8172B22C6370585D445FF49E2C540474B9D97C4D601C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646581, "uuid": "a8170184-b283-4082-91cd-0add911fcd46", "value": "96:RCPvJLRiedzWSyQ70Beo11CAYF9zo1tqg3ZtBA8ktoLrWxbFmtsSd4E:YXJBAvAo1hGYtqgJtBjxexbFSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646581, "uuid": "a9c843e1-83a4-4f7d-9444-ab1d0233a14f", "value": 5552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646581, "uuid": "2dcd3287-3c37-4d85-b57c-5b480184e4de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646581, "uuid": "f67e03b9-3ac9-4679-9d48-274d150b5c4a", "value": "7e616d0455c83957b916dc112802bfc40e1db08db3801ff4757303fafba5bc4e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4651ed6-05d1-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770653419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653419, "uuid": "84dca33d-c4fb-4750-aa78-80c09db36d12", "comment": "Malware payload (SalatStealer)", "value": "86bfcfb543cf49892fa07d85304f5a5f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653419, "uuid": "e4ccb1b9-ed0e-43f8-a097-e3292c080b1d", "comment": "Malware payload (SalatStealer)", "value": "7ecbcecdc37c55e1757c183a8f77c9b2493d2008f4facde3f089f5bbaaf1b4a6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653419, "uuid": "4749492e-5c8c-4777-85d2-3d2b99e74af8", "comment": "Malware payload (SalatStealer)", "value": "d0e1985ddb0903325937a8ecfd4586f5d1433616", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653419, "uuid": "78b03cd9-d1ae-4a57-9dc8-870faa7c1e1e", "comment": "Malware payload (SalatStealer)", "value": "8b1fa85714417c3cc23c07032a8f92e14c6fbce3f1dfa06bf1df5f9d0ea33b3a8be2ff9880af6af95b141c106577bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653419, "uuid": "1bbc1205-3e99-4f73-b2ff-0d95ff6e536f", "value": "T11D650A83BACB4CE6CAC6577895D343316738FD258B1A5F2B6B08C6316D536C5BE4AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653419, "uuid": "0e5c7e04-325d-461f-a4fa-e526a45a4347", "value": "f1435e18a1e876c30356812ffec72f27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653419, "uuid": "bb85ddf2-ff7e-4030-a0d8-f8edd2ea5bbc", "value": "24576:B0Bp/0Efmoa3c2bKAUSW1ie8JsU3Aot+Ec0xMk1qqIcoyBja:2Bp/0ua3cUKCW1ibqqIcoyBja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770653419, "uuid": "25cb3457-7426-4fb6-904b-30229c7ac7d3", "value": 1540481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770653419, "uuid": "fe83c0dc-8621-4885-9c24-c1a5389c0428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653419, "uuid": "1282fab2-b295-4cb7-930a-b1d85443b490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d08a5f6-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1770632254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632254, "uuid": "f02b7b3f-fc3e-407e-ab00-a2fc2b63abb8", "comment": "Malware payload (MassLogger)", "value": "23b039f0c83b95c35f3ab5c1dbcd79c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632254, "uuid": "eddc9f36-bc8d-43e3-86f6-a921de0505c1", "comment": "Malware payload (MassLogger)", "value": "7efba5bdd57a190663d38a52ff71b525874b832cce859895adf688e9d5c41d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632254, "uuid": "d825cf25-1bb2-4cab-a5a8-343d891f51ce", "comment": "Malware payload (MassLogger)", "value": "fd435b0a8bcd46d3bc0d9b24c8eee4bd60157ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632254, "uuid": "78b9a899-4b71-4d69-b2a4-0b32225e6782", "comment": "Malware payload (MassLogger)", "value": "1517ad6ecb8deacc15943f0b8349bfe06cac162d89c910a197e52d32354d815fb85fc8e495f6c4aebe7b4d34e41e9f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632254, "uuid": "967c228a-eccc-4c31-898f-f84fa64cae38", "value": "T11715D0D13B267716DE6C49309525DDB987B62DA8B000FAE62DDC378734BE211AA1DF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632254, "uuid": "3d39abff-74d6-4ef1-99f9-c81eb0627a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632254, "uuid": "77c3366d-041a-4ec0-9540-b05e562800e3", "value": "12288:VWGiUYFrFWiVuhgFwSsHZpfU1EWILUUIcfQdN1xI15mIExL31WtZHSN9G:PYvVmNLpfU7IjIgUNEvmIEl1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632254, "uuid": "0fe24a18-3be6-4aed-b28f-8ac381b67cd8", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632254, "uuid": "66e6a03d-9601-4b33-ae2d-16fe301c3362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632254, "uuid": "88da22df-f9c6-471c-ac49-9249b32025a7", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24729ee9-05cc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770650976, "uuid": "d129957b-e7df-45c1-aa07-d38f488ef353", "comment": "Malware payload", "value": "ac4ffd73d71228c4ece39c2bbda7ffdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770650976, "uuid": "66341d66-8ac2-43ff-b2ff-e9348a9c7625", "comment": "Malware payload", "value": "7fce1610afd46b0e569e89e94f9b104d3de200bea638765a9cf6d38aa6eaa5e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770650976, "uuid": "6e02e381-fb16-41d5-b424-93a1efec245f", "comment": "Malware payload", "value": "8c7b02f51eb9372f26445a646588d4d909c1821e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770650976, "uuid": "5df3b7ad-ddec-4bfd-8a89-458d52f6f43e", "comment": "Malware payload", "value": "65da6f7ef305c3269ea3be6eb399895f12ddd007feb990d67319862f3103a134c42a948f3a9f46f147c46b024bb31335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770650976, "uuid": "ee0a6ceb-a8b4-4e16-b004-bf98cff96a5e", "value": "T1B1D433E6D9A796CB86F3E2394400CEB97D27117D5946250BCA1CE3B0E51E8361F8A932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770650976, "uuid": "98c6994e-21f0-459e-9ee2-a7fbbb121061", "value": "12288:NjuxpD7EW9dVbz340Wy3w903mEp8LCNqfpdr+XSpbbuikGyJxr:dO7EQb5XgACLCKdjpfYnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770650976, "uuid": "cb516c00-dabf-4bc2-95ba-a3858054af86", "value": 635328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770650976, "uuid": "76bed548-0c3e-43ad-a8ea-1e947da98489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770650976, "uuid": "62e3a5d5-165b-45af-9184-e0cb88fc53f8", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c365ee-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770657803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657803, "uuid": "cda96a15-a8f0-40ab-8ad2-7d1d46b35fd4", "comment": "Malware payload (Vidar)", "value": "d7ffa3e40e8670b22821a670f4661c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657803, "uuid": "5b564a26-68ba-401d-949c-c4f2c11acea2", "comment": "Malware payload (Vidar)", "value": "7fd992c7f31a00b5fa29dafa914460da9f580f0311998f51f0355f0849865b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657803, "uuid": "27138b2c-bd89-4fc8-8763-cb8bae486a27", "comment": "Malware payload (Vidar)", "value": "1a0d4814a3fb27debcf15f706b74ef879dcf4329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657803, "uuid": "ad293f65-7a35-40c2-bd48-e7a722767a95", "comment": "Malware payload (Vidar)", "value": "c943fbb25bde498a1580c0810539ea86f3117de35016fd51cf1557fdcea1bea93fbcda1fee6fa4a3feb2363faefe54e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657803, "uuid": "38e5746a-594e-4869-97a0-e025e0d8ec23", "value": "T1AEF54B82B8A964A6C5BFF23894A0D29177713C5453313BC76F8815BB0E767D86B3E708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657803, "uuid": "7dc42d66-c955-4642-b798-0597dff62af0", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657803, "uuid": "a3622df5-59bc-4881-870d-4941745ea1b8", "value": "24576:C86EBX8Aq7g5SXf3Pf5Klxt4mqn2nIKaT//pa6e3+9Cv+K15g69D/:C86EXH5Sv3Pf5IxE7paL4I+K15/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657803, "uuid": "1bc18c82-bf7d-433f-8e9c-ed205d053dc7", "value": 3623424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657803, "uuid": "c89571ef-b8fa-4ff3-a6a6-f4c5c60b1c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657803, "uuid": "9554f6f3-d81b-4e59-9cf2-c5dabc8f4563", "value": "x7fd992c7f31a00b5fa29dafa914460da9f580f0311998f51f0355f0849865b02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c11878-0558-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770601422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601422, "uuid": "a5963751-f7e8-41c4-b4fe-bf2e7de08379", "comment": "Malware payload (Mirai)", "value": "d207337cb80f65ba907159bba36672a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601422, "uuid": "20b83348-cf22-4790-b472-848fc5ffb5af", "comment": "Malware payload (Mirai)", "value": "7ff997a834842f0eb165765baa947aff2ab13e579059fa3e2bda4ade3c965283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601422, "uuid": "79388055-8a32-4736-bc9c-08c426f255db", "comment": "Malware payload (Mirai)", "value": "389ccabcd76d88ecf9074c2f975cc8f073a221c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770601422, "uuid": "7d3ca233-90cd-4e29-a54a-0e7d9f8ea4fc", "comment": "Malware payload (Mirai)", "value": "7bbb691ccc78afa2bbb72220b47e031e3b6445f8c9232d6572d7758212f14a578e4139dd80b6e1eff98e5756a1bf23f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601422, "uuid": "7fa45c74-4d78-409f-890c-829653253101", "value": "T161D2E180D6F54A18D2B459F00A9F3AFD2584DA28384457F319ED2D534F5EF962B388CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601422, "uuid": "0ebf2415-27ba-4c8c-be8c-618c8ecd7cdf", "value": "768:AdZJfQyiH2SfZBnxkdGGzUwNGGSrF8KqitQRnbcuyD7UM7T:AdoyS2kBnxmGGYw0GUmB/Rnouy84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770601422, "uuid": "617d84a8-1e3a-41dd-9d52-ee01b40f435f", "value": 31028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770601422, "uuid": "1cb3259d-7a29-47b1-9748-e126f438d822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770601422, "uuid": "bbd8de6b-a528-463c-ad68-c78fe8f9f63c", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8666bf86-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632243, "uuid": "2d31de7e-b491-463d-9f69-f77297f0a022", "comment": "Malware payload", "value": "ffb1d768e2c84644be7c9874bbf3e8fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632243, "uuid": "0f34abbc-9db1-4b6c-8773-bd1e70a5b1c2", "comment": "Malware payload", "value": "8059c7108bf9c257ee5abbf5fa3efa1faa3ab39dc3922a645556ed7443bfe62e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632243, "uuid": "776fb6bc-6c37-4b61-b228-298e1f01694d", "comment": "Malware payload", "value": "57b8634652ce23d40efe9ef301cb6929eee8e28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632243, "uuid": "ace353a1-3825-4ee7-b5bb-f633b5b1d8cb", "comment": "Malware payload", "value": "893d099fbf1451b87be885d4fc65b60b5e6d5ea50df3d82c51a2a21c5e1f6d7b732bbc3c1309541217bcf86eb855e2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632243, "uuid": "73220afd-7485-454b-a66b-a9e301e00bf5", "value": "T19F84E0013282E947CDED06B409AF92FE4EB69E7799828F57F280F71EBC762C57914144", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632243, "uuid": "a1ddde08-c2f5-4633-9277-12227ad9ab31", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632243, "uuid": "5262bae4-d363-430d-8dc8-ede4f0399c04", "value": "6144:fQ606xV8H+lc7SGd7UQVk8ffdC7UpfqjQWNOLAw1q/OXpgKhd:UecGGRUik8ffdCCw2k/IPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632243, "uuid": "c2b98509-a9d6-4f52-9e68-773249198748", "value": 384032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632243, "uuid": "df5d4c22-2b53-4144-8f36-92cfe250d95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632243, "uuid": "86dedbbb-5305-4d60-a693-cd080b015639", "value": "Payment Copy of US$ 75,162.57,.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d976c5-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632421, "uuid": "cddcc273-34b3-453b-97d9-fd0ff6e476be", "comment": "Malware payload (Mirai)", "value": "eca89f2958c459dfc1c2dc65d86b5c3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632421, "uuid": "943ef848-aa13-42cf-91c6-0c48d5f7075a", "comment": "Malware payload (Mirai)", "value": "816d9a9ae65b9a4ce5a2abbd149fef11e8180ed98e6c060e85cf7fbe31938add", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632421, "uuid": "0f1a72a4-1b8d-42e1-975e-47e0e37af287", "comment": "Malware payload (Mirai)", "value": "cdace8b7b9b1cd205b10b43d75e9e4bd616c1f80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632421, "uuid": "7574366b-a4cd-41d3-a4d4-defac7f95c4c", "comment": "Malware payload (Mirai)", "value": "a3a8e1e7ad916c0c016dc60bb5346ad35923305257bf2202bf8b48134926441add4e31de25a59cca60d5520e9e9acb84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632421, "uuid": "58fd6a0b-ffba-4803-8029-5519f099cc79", "value": "T1B1E32AC7F800DEFAF80AE33648530909B630BBD115925B372257797BED3A1991973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632421, "uuid": "bbb01eb8-5501-4a53-afad-01eae4f0868e", "value": "3072:7SMzmmkNYfms5eD0NbS5zxuVljbisLubIyMYNR7:7mims5eoNMzxoLfyM6R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632421, "uuid": "9dfacf67-3634-4179-9e34-77b34867e113", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632421, "uuid": "2db9955c-f823-4bcd-a320-48bfd23fc159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632421, "uuid": "a670116c-3f6b-4f16-acd0-3b5e26f3bc79", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97de2adf-0597-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770628407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628407, "uuid": "09151c4a-0670-4405-b084-139f8561dfd4", "comment": "Malware payload", "value": "a2b796e12b2a79bedc1a446ec3fc1a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628407, "uuid": "695a355b-a5bc-44c6-9f7a-364a50c900a7", "comment": "Malware payload", "value": "852c0cc1a75dacf2262c94247253825f86870c72f08554d4ffe9aa727aa629f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628407, "uuid": "9087b3cb-56d7-4af7-ad52-db4bf8b0926c", "comment": "Malware payload", "value": "efdc72d54a1a83cb98d0a50dd27326f0424ca151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628407, "uuid": "53b4287e-b5e8-427f-8e92-3a65da19ae42", "comment": "Malware payload", "value": "de188d5c2a2b80db89003f3a660b3edf174ecd3fc4301f91bce756168649f6ecc58ae0f0425f7393bd223ab291225428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628407, "uuid": "2a9435d1-028e-4f36-b0a0-c17d42dbd5de", "value": "T1B2C5AD15A3D902A9D577EB38CA529333D7B078464735E58F0698D6052FB3EA09B3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628407, "uuid": "4a7149ae-7d31-4fb4-92d6-6aed34a26a77", "value": "b945e1eb6baf5065a35d74831f8df9a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628407, "uuid": "9830aa8f-13d0-44fc-b595-1e65aa7b023b", "value": "49152:hlNwuyrs6/zEf8l/rEzh9KVbN9Vr3tYoEi1x0zEa:1rErD9rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770628407, "uuid": "5b1632a9-09ae-45dd-9164-6b01b3391ffa", "value": 2550784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770628407, "uuid": "5f182450-442a-45be-9bb6-9ee7e1324393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628407, "uuid": "b6605031-89fa-4e56-a014-a2e9d994df0b", "value": "SetupXML.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a543774-0557-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600708, "uuid": "c5aa8014-6260-4476-b915-e6f88d89e012", "comment": "Malware payload (Mirai)", "value": "7533850a699ef09ad46f15bfc9252a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600708, "uuid": "0f080ea0-9adb-42cb-84f3-2c7a2bffec2b", "comment": "Malware payload (Mirai)", "value": "85b9425dc07ed241a77f2273d3f4f6df5d2be0a002b085b3d337653a5b477ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600708, "uuid": "9f046907-dda7-4d2c-a9af-554e0ef68aa0", "comment": "Malware payload (Mirai)", "value": "b920dfa00af8348c2edc5b176a00a2525ab00900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600708, "uuid": "6b698526-bb3d-46d8-8f6b-ebcc1d03aae9", "comment": "Malware payload (Mirai)", "value": "71450e6f472f05607bb1e5bab161896f3ebd5919566770b0e7098f8d25f9c6d68a0abe01753d7da9c53656f304e72f4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600708, "uuid": "1ec1d343-dc6b-42da-ad88-4ec9f946ba6e", "value": "T143B3E085B210AE55C02672FCB187099093B17E7B4B9A150B44B3F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600708, "uuid": "8ea87f42-9c30-46ef-883d-c8a2263b2414", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuk:as5zqhr5Nzy7wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600708, "uuid": "1f6e1d67-bc3b-4af6-b50f-169dc99d1c52", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600708, "uuid": "fcf1637b-2a0a-4ff9-9c60-eb8b41fb8a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600708, "uuid": "b34445a7-c528-4062-8248-52519e6d16bf", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af00f771-0610-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770680415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680415, "uuid": "c3a2709c-2518-467f-af05-a3223cf2f902", "comment": "Malware payload", "value": "ce9a3e422c471914076318fb2b8bf3c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680415, "uuid": "3e254a84-3974-472d-abde-eade10cd5ab5", "comment": "Malware payload", "value": "85c5d598edccfddce306e53a69ba86fd0193114aa05e66d8e0106db2b00ba03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680415, "uuid": "bb25bfc3-924a-4280-82b2-065589d3a1cc", "comment": "Malware payload", "value": "7033b25a165709c3ac98b335fd65b9dd6bf68522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680415, "uuid": "0a1bbd26-0f8a-42eb-852f-2498ccc4a141", "comment": "Malware payload", "value": "60858dc14ebb06e20841a4a522518b4d414760abced12b8242bc29b25f0d212c27c8ddf032532e6b8324b8341993a733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680415, "uuid": "cc72ecda-8231-41f2-88a3-dbd66893b01b", "value": "T146957C537FC18171E6D21F78057A932A5B7AFA21572097C793A02D4ADEE13C1AE342CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680415, "uuid": "ecd993aa-e3c6-4aab-b8d7-f47e8855db10", "value": "4c64806c5223248babc89b63bbe73f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680415, "uuid": "c40d7b0b-378f-44ff-a37d-93b0a6acec43", "value": "24576:c526A7Yj4v9e04vYp2dkEwR5Wntbcal7ScPBokc7eDyn2HrTfDcj68a9gYUTCYD8:Wo7heKIF7ScPBokVDO2HrTOGU+YDQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770680415, "uuid": "7ad16c5f-f1a2-4d38-adb0-3d1d0619be1c", "value": 1912696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770680415, "uuid": "9b7be218-c2f3-41d1-b009-146168e4e37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680415, "uuid": "32db1edf-54c7-4bb8-ba30-f423799abe7f", "value": "Verifier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d146dcee-0550-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598009, "uuid": "0ba78056-38e0-4612-b45d-e78dc9d3f5fe", "comment": "Malware payload (Mirai)", "value": "f293c8ccbe604071b6b1d6957f723049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598009, "uuid": "b833b994-3c60-4838-87e3-b2f39319d877", "comment": "Malware payload (Mirai)", "value": "860fc15451216e43935b0ac7eda08cd84c0001cb27ecd9183ff850d752bb6f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598009, "uuid": "b9c9ee73-f353-4183-835d-714ea2a68972", "comment": "Malware payload (Mirai)", "value": "dbcbb019420209d0dde72d098c459811466f47ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598009, "uuid": "68ec5f68-28ae-4d75-beea-ca150d205be0", "comment": "Malware payload (Mirai)", "value": "1d2a43a081a17a3cf6bdec331514c4839e3aac1879ed6cc45dc844b7ba2fa6f50e5dd7d76cac53ad31afbc8a6814c493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598009, "uuid": "a5d84a8a-24e2-44ab-96c7-2a588fb97743", "value": "T116E33C56EB408B13C4D62775B6EF424533239BA493DB73065928AFF43F8279E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598009, "uuid": "eaf24c30-ae66-4b79-827c-e2efa4544c04", "value": "3072:TRxkLFCSFcza0Ei72V888gcuJt1q02X671M/9MlHj:TRxkc9za0Ei72Vd8gR402X6pM/9Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598009, "uuid": "5aa5d914-9b1b-4c70-9b9e-aa9d60c306ec", "value": 146307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598009, "uuid": "b44f521f-1605-40d7-9a09-78b92c2fdbc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598009, "uuid": "6ea9b858-2552-42a0-a209-fc45652be1b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1257958b-05b3-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770640209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640209, "uuid": "ae9f88ff-f71e-4030-8bdc-af4827dd2608", "comment": "Malware payload (QuasarRAT)", "value": "bf5fdd5fd0d8bfd84294fc45047bc070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640209, "uuid": "48c3e297-931e-434a-a737-d3a213dfb60d", "comment": "Malware payload (QuasarRAT)", "value": "861e5f42dd1864548196963bfbabe7fc6940bf0b0b7681e8675a41d4ea99bd4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640209, "uuid": "0776f5c6-1ca5-4d19-bec0-dd267c4026b5", "comment": "Malware payload (QuasarRAT)", "value": "d06557e512553a492029f4c167c7e53ee8a55bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640209, "uuid": "33c649ce-89b0-4b73-bdd7-0e4305a51eae", "comment": "Malware payload (QuasarRAT)", "value": "e26d7f10ab572e381c44cd1aaf920b7d98c3876b3a61c8e05106462be0d6b373f0041db8ee3c5564f1ac11d7076d6df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640209, "uuid": "5c3edc41-2401-4964-8991-7c7fe5519308", "value": "T129E54A1437F85E23E1ABE373D5B0041767F1F82AB3A3EB0B6191677A5C53B504842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640209, "uuid": "d676c9b1-5eae-4a3e-b38a-576fa119bba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640209, "uuid": "67970bf7-673e-40dc-8a43-28f6194fb58e", "value": "49152:uv7hBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaXcdnhAar5doGdkTHHB72eh2NT:uvzt2d5aKCuVPzlEmVQ0wvwfMphp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770640209, "uuid": "d06c92e6-804b-4e27-932a-b2aa26665993", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770640209, "uuid": "a7765c03-e8af-4ff3-a535-4d27f3db173a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640209, "uuid": "8aadb15f-b255-470f-b108-905b9f0af566", "value": "eaglesot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32149ed3-0597-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770628236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628236, "uuid": "c049cabd-9c6e-473c-abe2-06a29964606d", "comment": "Malware payload (RemcosRAT)", "value": "e6d40230f82bf6ef3d234065126b8819", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628236, "uuid": "cdb6dd40-81be-47dc-8954-1eb9ae153cca", "comment": "Malware payload (RemcosRAT)", "value": "863ebc5c327b6598f24309490e5241793d119f36704abccc2d28dd1fd76735a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628236, "uuid": "4120d2cd-e962-405b-8964-2ba3aee35d0d", "comment": "Malware payload (RemcosRAT)", "value": "42d6ef5d0f7317d2d85478af46ba3bc6ac80be6b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628236, "uuid": "886cf4e5-9c7b-438b-938b-4389b8ea6500", "comment": "Malware payload (RemcosRAT)", "value": "c7097dc479fcbc987bf46047d7fc99cb3bb9311893d0b4f5888531dad7c026ead2a379be122f58476a45d6fea4b57334", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628236, "uuid": "fa61044c-3e52-4591-95dd-f45bd223eff1", "value": "T1464500244D9FE6899FACC1311A42A645DFC76482F376276AB1F7C9CEE006418BFB4172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628236, "uuid": "34278065-c34b-4876-9aae-f698081e2c6c", "value": "96:jjW8q575REW3fxgqFuPmvMQGxgqF+WKzxqqj08xgqF+s6cewnKin2eSkblol5n5B:jiY0foctJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770628236, "uuid": "54831a98-ac7a-4f53-88a4-6b668584e9cc", "value": 1237969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770628236, "uuid": "7baf974b-eeb0-49fa-bf74-43f1799c15ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628236, "uuid": "e41ea222-8a92-415c-8b74-bd30c23e048c", "value": "purchase order Purchase Order PO004460.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2618f2da-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597292, "uuid": "55f437f2-4508-4e83-8a9c-86a7eac81b23", "comment": "Malware payload (Mirai)", "value": "04b5ec4a8f277946c692ac52656c6895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597292, "uuid": "234bf1c0-2243-40d0-aa79-d5766df7f819", "comment": "Malware payload (Mirai)", "value": "86400bd0c54e69b5d4f15788b97663cfda6647a864bd10b184b5b8165875083f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597292, "uuid": "f6040e21-5ff5-488d-9d97-43b5fbf6c60c", "comment": "Malware payload (Mirai)", "value": "1c8d17c753b9bc6cf7abc76a676b3827a83306d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597292, "uuid": "e4783601-ef41-43ce-8daa-012de42117e3", "comment": "Malware payload (Mirai)", "value": "4f3067caa052f60c6d8096302613d993262664b6dc0af03c95a536da5bc9b56420e3167880fce209eb1f96565a544818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597292, "uuid": "7e202952-8da5-469c-8669-cddc14377fff", "value": "T1BE73126121A6DD62E2F1803223437E557A2288BB077463FEBC39972EB487E615C4C55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597292, "uuid": "198fb775-f6d9-41eb-bd16-35d09992e11d", "value": "1536:a8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmZeorc:hzRnwP0bMQ2RijvDZZ1rYGhG13ZeSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597292, "uuid": "cf94e395-9539-4533-a329-3f16c8fa6d1b", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597292, "uuid": "b1475b2c-d319-4710-8426-737e89f3bff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597292, "uuid": "8c43148b-f96a-4c8c-9ac7-0a28292428f2", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c55bd24-05d2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770653540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653540, "uuid": "c043f953-8c70-4917-bce3-c5385bbc2eba", "comment": "Malware payload", "value": "ad97448815cdedd31b4848b376177446", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653540, "uuid": "88ce8762-acc8-41d9-9b18-fed032fca438", "comment": "Malware payload", "value": "8724a4bdd77dfcca89c7d1a2381b4e0ce435f26aee123bf3e51de0c7c0178bf4", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653540, "uuid": "228818d3-9f87-47be-a5d1-1269b150621b", "comment": "Malware payload", "value": "7b2b21bd443ba28719ff643be1985d76dd9272c6", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770653540, "uuid": "72f79435-bd2a-4b6e-a409-a515b63d14d2", "comment": "Malware payload", "value": "15cde2e899596295262b734cf5e258494f39e4f7bef1afa7660700dd9f4bd6cf0b7699d75a9a0cbdfe4d9999ef85cad8", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653540, "uuid": "99105ab8-e3b3-43ef-a4e7-179a2ef8d31d", "value": "T14897334C6E11249AFD3E9535E9E01234D6B441298272EDE6CF1D33E53E83BC44BB5A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653540, "uuid": "9aaf98ef-db36-402c-a6ce-847592eb2b13", "value": "786432:yTWPxSIZzIlbcDGt8OjIluSuE1WtYWh7o/jbe3XV0d5aFsBBldAm:yYxSIxIFcit8OUQhWWJorgF0dsKj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770653540, "uuid": "7a34ab13-a355-4aa4-916d-10eb2b3f4d4a", "value": 39997643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770653540, "uuid": "02de64da-cf77-4c6b-9700-2a595c9846f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770653540, "uuid": "ee3f2c67-cd0a-4991-a68a-d3a5e8daa769", "value": "stream", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4202fdc3-0556-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600345, "uuid": "cb404900-e4f4-4365-9286-c939a575a070", "comment": "Malware payload (Mirai)", "value": "5d41114d31a08b64c1c6043887b26ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600345, "uuid": "ef8ebc28-d64c-40ce-9ecd-9e154bf172c3", "comment": "Malware payload (Mirai)", "value": "878dfc10d6b78b377c7ee2235e88165ee1e6854dd366eecd97759479c307ed88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600345, "uuid": "13d57398-fdb3-4f4d-a6ed-5b879b729440", "comment": "Malware payload (Mirai)", "value": "af51fd24f1833afa15846b9efeab365f6211c9a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600345, "uuid": "9498d61b-2b86-4560-929d-edb8c9ecef10", "comment": "Malware payload (Mirai)", "value": "8ed6bf04182d76404011b66ec28aa25ac4052997ef758d04cf777b3aece9cb2bc2c694bc72b26d8b1d107801a5f48528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600345, "uuid": "287d6e53-0027-4524-9cb1-5bb92a129118", "value": "T140B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600345, "uuid": "279dd9ec-a4a0-4c59-839b-1968509959f3", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHzs8rSR:t3SrlGWnKTU83AQB5A5Liy36fwUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600345, "uuid": "aeb301c5-1748-4620-a001-275d90cf21a2", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600345, "uuid": "2f2d63b0-3406-4728-8ace-11f28e787039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600345, "uuid": "fd5c8396-471a-4ab2-b125-74612fc6f828", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b7512a-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770623677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623677, "uuid": "fade21a9-376c-4bad-9847-8abaa2541597", "comment": "Malware payload (Stealc)", "value": "8d9b5ea6683dd502ea59d27956671bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623677, "uuid": "204678ea-fd81-4513-8a69-76a7c3084eda", "comment": "Malware payload (Stealc)", "value": "8807b01cddf4954b489aacd512f5a2f446026d461fa5f4499ac4a5f1cbee319e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623677, "uuid": "2af05c78-5fe3-4e45-9478-7dc3472f8e44", "comment": "Malware payload (Stealc)", "value": "914206e26a25e3ef798c1ddb4f5d04e09ca52315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623677, "uuid": "66e3edcf-fcca-4ce3-a74a-cc430424334e", "comment": "Malware payload (Stealc)", "value": "1a8bfef1a9f41ee3b3921d3cc7a944c3f54d69f75e40946c6a856ac75a4710a8802d08b3907ec03eab053475415c817c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623677, "uuid": "16da92ce-475a-4d78-8ed4-7477a7f9e9e4", "value": "T120A75CB2F89509A1C67FE13498605E91763138680B3E7BD37FA815660D2AFC46B3FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623677, "uuid": "62562135-ef35-4fad-88f0-fa9dbded5efb", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623677, "uuid": "6307418a-76c7-4280-a191-b86008c2f8e5", "value": "49152:lY6zC3+h/OzVX4dZEKCDfMY9BAJ2mWDj4kqA+c8OK1dm:rC3hVITPCDfMA9xqwUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623677, "uuid": "f61daea8-90d6-4a1f-b94b-3d9bbc2bd9bc", "value": 47247401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623677, "uuid": "e6af1f4c-d9a1-4b42-9d8e-0ada5e8f8d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623677, "uuid": "9ff28db0-b948-4866-a011-889b5e95e057", "value": "virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4371ea-05c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645887, "uuid": "fe242d04-42b2-48b7-adff-840e3cd2603b", "comment": "Malware payload", "value": "f17ed8c5c54bae6c74d0d793d7c7a72a", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645887, "uuid": "f916949f-4142-43e4-8354-70592cde726f", "comment": "Malware payload", "value": "88d767f02f51bc8baee5546ab7e021dcfab747556c13ac3ff976f8ec3ddcbef5", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645887, "uuid": "0625632c-519b-4d9c-a718-a34e299e2a01", "comment": "Malware payload", "value": "6f8fcfd5fc018868e93799449582d068370c7890", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645887, "uuid": "5e769f01-6382-4a32-a2d6-52aa97b1c91d", "comment": "Malware payload", "value": "4ec8b7ece6769ecb13367c47d58934c225a439e5264fcb72da5458f4458a097f0e169c5f9ade65e4a8f086352a595acf", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645887, "uuid": "f722bbb5-4f99-4586-bbe3-5c2629ab7e38", "value": "T12BF3C9DAFE4E85F0D2487B33C4F790011766DEC1AB52E68978CE3F4999E23B74580A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645887, "uuid": "527af347-b37e-458d-a117-87fc1b4ae938", "value": "3072:hzWAEDCR+O10TVPGlvwTVDAqQ0xOb1RF:hKTnTzVDAqQXbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645887, "uuid": "b0c5fa6a-e019-4134-843b-40a0e43682f3", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645887, "uuid": "14f8e303-f923-49cc-a3be-71928ed55977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645887, "uuid": "a38d82ee-fb17-43f2-8bb4-93bbe23cfa85", "value": "88d767f02f51bc8baee5546ab7e021dcfab747556c13ac3ff976f8ec3ddcbef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ac54a4-0606-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770676186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676186, "uuid": "ce406412-bb9a-4d03-af53-bb06df5db9a1", "comment": "Malware payload (Mirai)", "value": "6e11d5d28fda16b0953e4c100db75026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676186, "uuid": "054814d9-e2cf-49cd-b810-e67ecf668298", "comment": "Malware payload (Mirai)", "value": "891097a617ac7062859f66c4171351fb0da9eaf4d2e83f91dfea18fc5b1c776a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676186, "uuid": "e40fe62b-c58b-423e-96b1-064526d4691a", "comment": "Malware payload (Mirai)", "value": "23477a71885712726262906745901f12d0a0b52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676186, "uuid": "3560a629-bf9b-4915-ad6b-e312a321bc59", "comment": "Malware payload (Mirai)", "value": "b5b8a7675df52aa79b5f8198ab3daed77197126843e0e6e0cc4d42c36fa78f83aaed3cf2b15670642a0b56280d981ca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676186, "uuid": "03220bf8-2a70-4eb6-a12b-32e667e59cca", "value": "T119145A87EE890EDFC41BCDF086AE839B19E7559B8DD1F1F4487C8C08795D18A46E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676186, "uuid": "2c1f5db7-d783-487b-b72b-670b4e04b4b0", "value": "3072:DMpSPmL3ZpDiuBAmIP3eVGxgybYNu6QisfsCzY/4w/fXsZjCCGFqtr:Fe9w9eqQLQisfnzY/LkZjCVql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770676186, "uuid": "74bdd276-44b1-493b-933a-6898a9a3b08a", "value": 197128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770676186, "uuid": "a003d32a-f9cd-4fbc-a478-00c6691ecd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676186, "uuid": "e6a8f7fb-a761-4ba7-a706-18dd9ae48d95", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cc0599-05b3-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770640221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640221, "uuid": "01eafe4c-485f-4559-bf8e-3ded8b3dcace", "comment": "Malware payload (PureLogsStealer)", "value": "5672324501c83eba47bd4741d0b62d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640221, "uuid": "346eb5ff-addc-46cd-ab14-cc29a63b14ab", "comment": "Malware payload (PureLogsStealer)", "value": "8952434cad11232beeb775153f94d67b19eb5fa20fb502f1196bd3b52cc59153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640221, "uuid": "68a3d6e7-1c66-43c1-8d00-4f9dfd75ad17", "comment": "Malware payload (PureLogsStealer)", "value": "8fc1f29544bea9f562c96de01d6636183f803c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640221, "uuid": "e1f77b09-e0d7-42f3-b103-aad6c50b113b", "comment": "Malware payload (PureLogsStealer)", "value": "205604d2a2b228bac588dd163464afd451ea0c7afda1cf8d52ef3d857b459fe895e034065977009dded087817bfc55a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640221, "uuid": "e3b50926-6614-4918-b522-02dcb1eac2f8", "value": "T1944523B0229ECE45C0DA1BB060B2D2719771AE86F802E3568EDEFCFFB95A351055474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640221, "uuid": "00c00362-d3ee-4828-a23f-294bced02726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640221, "uuid": "92cf4837-27b2-4c6d-a32e-0433debafd91", "value": "24576:Sw+lgJMsCGIlKFy72p8/fsnP59UBffTVuK0ZTfU7VTNPoK87qGeA2r9guQ0:u6bxFy72qfuQfLdcart8Yt+uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770640221, "uuid": "d8bce2fa-9fae-475a-89e1-7a4724f764a5", "value": 1266184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770640221, "uuid": "d123a0e5-e659-48d0-9cbd-090b6ee192b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640221, "uuid": "60220aa1-bb92-430f-a48d-01b991d4a0ae", "value": "FacturaRFQ82637Feb2026.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed900eff-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632416, "uuid": "6b74378c-94d6-4e86-9a10-679c75449cb4", "comment": "Malware payload (Mirai)", "value": "0ed22325b96592f16c6629e2c80b9fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632416, "uuid": "818f901b-7f84-4795-a3e4-ac5cef7e97e9", "comment": "Malware payload (Mirai)", "value": "8965fd2d8bb1c9180f26af8087de5849fc11020b33e3b2bb33b8fdd16c39e1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632416, "uuid": "1c375ec3-5001-4e10-82f2-9bce914212f9", "comment": "Malware payload (Mirai)", "value": "1c81697e6021ec336a2acd2cf1e4532a1f1bed15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632416, "uuid": "c552540a-41be-4c0d-97a8-9ca4b3ac4933", "comment": "Malware payload (Mirai)", "value": "03bd16d100d40efd87b071f031970e20a9e237743fc0f5f71b4c398ce3bbb12abeca4e0041eb78c3dfe27bf6d28d56f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632416, "uuid": "cf52235a-4ae0-4abb-90ed-a3a416a5e1bd", "value": "T12CD30945F8505F23C6C612BBFB5E428D3B2A17E8D3EE720399256F20378695B0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632416, "uuid": "25245fb9-6508-4aa7-8d46-b486b1cad1f2", "value": "1536:pKC+lzl6y/wbRXGAF8bAZbo4VdTR3TUHVTfzBbe6uBxOFSElAcQwyw6jqLYYIJ/c:pKC5FWU8b94PtAVTfNfSCCvJS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632416, "uuid": "aed5ca60-d412-4c0a-9686-7af3fa75ac6a", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632416, "uuid": "a35ad6d7-5e01-44aa-9295-7f559228456f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632416, "uuid": "375277c1-4b59-4e9e-8782-725fc75ab100", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e2e524-05d7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770655730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655730, "uuid": "73c63eb9-c8e2-44aa-b249-dc4f07b7e476", "comment": "Malware payload", "value": "4ca7d7fd07fc92b25cae3f48e41a23ce", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655730, "uuid": "e1b3f51e-1c42-4638-a4d6-25cd6df98d2c", "comment": "Malware payload", "value": "898f785d61872d45ba47432c16db134c7256174b911e89429c71490bb0282c05", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655730, "uuid": "00ab0ffe-4b50-44c7-bc71-7f8f496079cf", "comment": "Malware payload", "value": "736fff156389e8c5c10b5de8284d8cd8257fe3b0", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655730, "uuid": "bfb8181d-3cf7-4e37-8747-479aabf0dee5", "comment": "Malware payload", "value": "3918e0a00172fa4a34fa63bb8dd30146ffb278683b01a90cda1edbffde672573dc4e7231bab886a4945c96f7dcb16d1f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655730, "uuid": "b9cbde3d-4b3d-4b0d-b66e-ef6aeb122b89", "value": "T1F963D739C5AEB03BC32D9DB8CD160D58CF637C8A5294BF93A7E41CE60EA69501F5C681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655730, "uuid": "5d67679c-f3e0-4786-9347-181779c2abee", "value": "de3e74bfd953870246567b962b98e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655730, "uuid": "a55fe66e-c9f8-4aaa-86c3-027ebca226b0", "value": "768:ZE0uMorTbGo79GWbaqvhBFhCWrtQRdG4W3ahIs48PMrOuj7HUDXCkB4Wz:No79UqzGGe48Urhj7HUDXt4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770655730, "uuid": "c5036da5-7bfe-4e97-8de2-e805757d3c90", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770655730, "uuid": "921942e6-5d82-4208-9bb5-782c53305279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655730, "uuid": "efbd367f-6a5f-4582-b601-52cb1dcde7eb", "value": "898f785d61872d45ba47432c16db134c7256174b911e89429c71490bb0282c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3482829-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1770597636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597636, "uuid": "2411d3fa-3524-481f-91dd-d1771097e4c6", "comment": "Malware payload (GoProxy)", "value": "ac709c46df915ec8203dada5a1798376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597636, "uuid": "a1aac664-43ca-4fee-9084-97e48054c4e0", "comment": "Malware payload (GoProxy)", "value": "89c172854d81923339f7e6cb7a06234fd1503b169d2b5371390cc5663e82c545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597636, "uuid": "340f57b5-6713-488e-908e-6a56d2e5267b", "comment": "Malware payload (GoProxy)", "value": "6e76e4473b9e06efdca5ed61e9df85de876682f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597636, "uuid": "0bca4613-aafa-44ed-876e-c1790d75d867", "comment": "Malware payload (GoProxy)", "value": "a9f2a60aa9171f56636d61863ca24b2871000dcd8fd309e6b15c7f1595a78a3118f78e572ceae1168d7f00ad7329f541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597636, "uuid": "0aa25f7b-917f-438e-8c52-2d8af153da81", "value": "T15F664B43ECA555E9C0BAE2318A679252BB717C881B3123D32F90F7282F76BD06E75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597636, "uuid": "88ab83e5-b33f-4ce3-9bd7-4bc57affa3da", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597636, "uuid": "467ea6e9-7527-4d73-b7c0-dc46f936fc95", "value": "49152:cjyWgZ2OdVqIeCrCw6ia6QQY5fD9BXGECwnsrRSA+6qtm7RK/jAe9Y5sNfKiK9KR:cmVV7yvDnGETnS2Ys6CbbE1en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597636, "uuid": "8eb787b7-32a8-43a3-9752-008c8ffe717a", "value": 6650832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597636, "uuid": "7a229cc4-e2ab-423a-a4d8-5bb1fc5493b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597636, "uuid": "efa0ccd7-dae1-4bc0-81e6-e094a4995284", "value": "SecuriteInfo.com.Win64.Evo-gen.47227459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9596360d-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770670923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670923, "uuid": "f3e339b9-8477-48e9-873b-83be02664f2f", "comment": "Malware payload", "value": "f9f8018118341eb8e9ce23f89e2f34c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670923, "uuid": "c90766b9-c15e-4766-849f-223cfda94b19", "comment": "Malware payload", "value": "8b82bc29a18c9851dce8346a4d496531c99ae1e022385c3c8332dccd15cc3b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670923, "uuid": "1ddb0b8a-752e-4649-95b4-8ee4ec780923", "comment": "Malware payload", "value": "8584e5915a5a164aae8aace07ac2f17a2314268b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670923, "uuid": "d7c45c9d-fff3-468d-adef-a83e83ce102e", "comment": "Malware payload", "value": "60a8843176bad463ca22db62def9f93029a341fcb555a9fc507ccbc308090b8dfc640a25f8604833868037a5a086cb0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670923, "uuid": "f349a047-9ac8-4e49-956f-84a6a7d90d92", "value": "T161F4E60CBD51FC04CE2D3DB3CBE690A11B7208C2BE12551637477EF99B693A659A207E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670923, "uuid": "cb10fa02-217c-4309-94f4-497fd634006f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670923, "uuid": "5e11d4cf-cf60-44fd-978d-6d4f08cf7076", "value": "12288:jbhHFfTYli+G7WRv38XgwHrDFpXAVB73vn9RNDUSjzxD:jbgli+9v3ogwLuZocz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670923, "uuid": "fa214a79-4cf2-4327-a99d-186e2f41c848", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670923, "uuid": "ea3b63f1-d8ef-4342-9dda-956ea1987c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670923, "uuid": "02917a70-3b1a-470b-9055-a7f98866212e", "value": "8b82bc29a18c9851dce8346a4d496531c99ae1e022385c3c8332dccd15cc3b27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051282bc-0610-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770680129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680129, "uuid": "0755ad91-33d1-4259-837c-882baf7e0d5e", "comment": "Malware payload (ValleyRAT)", "value": "79d5b4eb49f046f1a5f6421c40d95fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680129, "uuid": "cff83014-58a3-4c6d-a3af-3bde7a6172c3", "comment": "Malware payload (ValleyRAT)", "value": "8ba27d6500ead73d174e9c8147aa618a2b36cacb633b97b809f7f236d722937b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680129, "uuid": "216e41f7-0abe-4eb7-b39a-7db602a4deca", "comment": "Malware payload (ValleyRAT)", "value": "f7e669347b987d1e586d2f3bce84c2804da95323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680129, "uuid": "5e73b133-c5be-421b-a868-866e1b7e92bf", "comment": "Malware payload (ValleyRAT)", "value": "af2333c587938129e8a57360ef464bc9b5359d4873803a9f9e7b59c4f69884f675bc9bed32fd048757bae5913170c390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680129, "uuid": "68fae378-571d-4a7e-ad4b-870a50dddefd", "value": "T106362385E7E008FCE0B7E63889564D03E7767C1D1760A68B13A876512F737E19E3AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680129, "uuid": "f8f9d247-afff-4f97-8bd0-089e127e3ef2", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680129, "uuid": "28265f28-ec0b-458c-bc61-796d5a677e4d", "value": "98304:FzHZPyqPLaIid0DroXJNrlTdXrSgUWCbjUE8hAW2impY8vTeN8HJV:Fz5jPWIiqo5wFWiUdAW2iQY86N8HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770680129, "uuid": "ed46f821-0120-44a1-a696-2b6d2dc3bf70", "value": 5134198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770680129, "uuid": "a4531baf-8f37-4dec-a2d4-bccab1d3fc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680129, "uuid": "4894af4d-9581-4bfc-be2a-8dc3d49983cd", "value": "8ba27d6500ead73d174e9c8147aa618a2b36cacb633b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035af485-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646626, "uuid": "614163bf-eea0-4d74-b453-75d932408f9d", "comment": "Malware payload", "value": "946e7c181670cf031c92441b0dc454fd", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646626, "uuid": "5df9af70-e185-425d-ac56-4caaa496f00f", "comment": "Malware payload", "value": "8c0b93514191ba88fa970477af8a1dffb1499755013d77079c0c561c01d04a00", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646626, "uuid": "2f47360f-7489-4c05-b070-06870e6d744c", "comment": "Malware payload", "value": "8b6252c1d21c7481a062eef438c63948d64b9487", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646626, "uuid": "5474eb05-867a-4d99-8190-12237efad052", "comment": "Malware payload", "value": "b0fa86cc9a9fef6171e3950cec72d1e72ebdaa3eefab0a783954151eb9f31a560cefa5e92c33a51c2bd24ccb3044dad0", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646626, "uuid": "6536bcb1-9770-4165-82e1-47fe2fb03d2a", "value": "T146F29E22729F92087077464D4A7F06754B6FBA9F1E7E4089048EFA8A8FD35109D573B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646626, "uuid": "eade5b90-5ef2-48f4-8c48-703c581d73b2", "value": "768:fYAXAIffE2iFFFFFFFFFFFFFFFFF40pH5dDh4VIB7BjjA:wAXAIffE2iFFFFFFFFFFFFFFFFF40pZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646626, "uuid": "e1c68dc2-fb69-4cb8-98eb-ae537979ed69", "value": 37016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646626, "uuid": "79f7605a-3cdb-4b50-8290-75613536e170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646626, "uuid": "96297d74-cac2-484d-8ca1-ba254ed0a412", "value": "8c0b93514191ba88fa970477af8a1dffb1499755013d77079c0c561c01d04a00.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7652ea98-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770646819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646819, "uuid": "6bb9fb72-6d3b-4469-b1d0-012283b2f198", "comment": "Malware payload (Mirai)", "value": "32719c38d24c694d073c646a2af5bb08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646819, "uuid": "23bbd2fd-2a39-44cf-ab24-e879a6615b84", "comment": "Malware payload (Mirai)", "value": "8d78814ce0d0a80bdb74e459f9611dea2985db8d1bd5e6d8a510d3e26e31697c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646819, "uuid": "5754a2fd-3b3f-4908-9916-af053d28a9a7", "comment": "Malware payload (Mirai)", "value": "e8d49b66e4bfaa17c5838daf41bdf323319e9d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646819, "uuid": "d8cbee21-24f4-490a-9e88-531ad57c0454", "comment": "Malware payload (Mirai)", "value": "f824e4880f97063de6ad7d85ba7b17d2fe239a509042e8d3735fc0feb305c5b10cc7c0748f421ff133e9ff7d9afd9bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646819, "uuid": "02082f87-50d2-409a-807e-6aac46bdcb71", "value": "T19A533B89F783E4F0E90B0931105BF77E9A30DE165124DE6FD794BEB2ED32A12A11661C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646819, "uuid": "72e53d9d-ccfb-4762-bb62-19ffb7c0f6a9", "value": "1536:auBQh8HifWikDGKWU831gN7BR4AhEsGdr:pB+2icuKvRjErh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646819, "uuid": "a66f1386-8c3c-40de-8c12-123a50d66264", "value": 66172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646819, "uuid": "8b6f618c-c1d2-4a6b-873a-9a19aa5ea5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646819, "uuid": "54b0977d-f82d-4219-83ab-d893ad52d7eb", "value": "firmware.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe09f1f2-05fe-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770672816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770672816, "uuid": "dd1eb454-0464-407f-83de-62cbe041fd47", "comment": "Malware payload", "value": "fc9f8b18ab58db1d892b4d8c922c110b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770672816, "uuid": "4df56de8-4fb2-4c6a-b320-2319ed2ec047", "comment": "Malware payload", "value": "8d9661c5d2eddfddd7e88857d241123a782a47baf0719292c70f8225552ad110", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770672816, "uuid": "992098ac-1c31-444e-b82a-3f4c7081c430", "comment": "Malware payload", "value": "5f3b087d4a282f1ce70359de9fc447fbba6f8813", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770672816, "uuid": "ddac10ee-2d20-406a-8292-5bdf4968e197", "comment": "Malware payload", "value": "5f64bb9cd935848363aff913c976b951fde1660ba55684c6f1e95a16223a7ff5bb73c5988ec8401ff4a035226a25038b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770672816, "uuid": "3e8a17d5-a07d-42bb-bda1-7f8516963b2e", "value": "T13D41332CF1241D63059BE09DBD99E111789482470748BE4CBAFC81A93F8C02F89B9F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770672816, "uuid": "9f77d7eb-4be6-4ff6-9b36-159283708d17", "value": "48:J/U+XBKdYcyRWHlxDs+rWEFgo1+/l3uwE42Og+IT6L8:J/UmBKddy87rrhg+6uc2Jv6L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770672816, "uuid": "e539fca3-a104-4c88-9aca-d46d37348e7e", "value": 1922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770672816, "uuid": "622dff2b-9db9-40d2-a8ba-e4ba293637c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770672816, "uuid": "fd8ec174-d5f5-4934-887b-0bdab963a326", "value": "seventh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc54a035-0586-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770621166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621166, "uuid": "60a13838-1f96-4eb1-a61f-6fe81a0db9ef", "comment": "Malware payload (Stealc)", "value": "401c394e874606ce4a7de08be0c43e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621166, "uuid": "d773d17c-4d86-49da-a9f4-a6d94d2b80bb", "comment": "Malware payload (Stealc)", "value": "8da670ead3c2b1d4e08a7e3877425b82e0a9e72006f04c104f1560b2b4defd5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621166, "uuid": "ffaec88a-eb2a-40c9-9ef3-3b196a688283", "comment": "Malware payload (Stealc)", "value": "dd6554af465030a49ccd75885411fcfc6a18d8a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621166, "uuid": "8c894b9f-7e01-4e3f-977c-2a0f3dce1e7e", "comment": "Malware payload (Stealc)", "value": "4367076a165e52701e5973b226a04aeabd2590506c73049837967c8d3c308e15d647e3e992830bd2a0dabe58ae573f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621166, "uuid": "ddb01628-4301-4322-ac35-92f1be5b54f7", "value": "T129B63912BB9D45A2C6BFE33897506252BE31785443713BD36E9815AA0C2BFC42B3F719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621166, "uuid": "cd411f1e-900f-40c4-8f25-cabc38c149e7", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621166, "uuid": "5841d8c8-29d5-44d3-b6cd-8683ba8418c4", "value": "49152:VntqN3/icyDrvIgMWB6mAkdSh5iA43OzG3jhsKv0bhyMMcYz7jyEnK16vD/:yN3WvrdSh5iTOz0hsY0boxZPdvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621166, "uuid": "fc0b0ae6-34d6-4266-9075-9332bef65afd", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621166, "uuid": "682083d7-8abf-4871-82cc-c2217209214e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621166, "uuid": "18fe9e8f-30ab-4a1c-b53d-f1b1f6633d39", "value": "x8da670ead3c2b1d4e08a7e3877425b82e0a9e72006f04c104f1560b2b4defd5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff25175c-05c3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647478, "uuid": "398ceb45-ee24-4e61-a760-e3b613fa76ef", "comment": "Malware payload", "value": "c4851c0324e0e7de1fb359fef9473e71", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647478, "uuid": "9a3d0415-54e3-4999-846c-004f968f9055", "comment": "Malware payload", "value": "8e59292fe4edc3441e0a7a11d361e1242d94a63091f51c69c40317b5079f271d", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647478, "uuid": "b4a0940e-3e51-4ba1-a816-682d6baeb4bb", "comment": "Malware payload", "value": "7ff53de07e2eaf0b754f87f2da32acce15de15f0", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647478, "uuid": "8c0a990f-6821-4bdf-ba7d-7252d5b5679f", "comment": "Malware payload", "value": "1ca311889641d138af2324baae58f1cb5ee60a0e4c649530c1a2eb1fa1293f7ede86f2c7c05d009c6ba914af276be47e", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647478, "uuid": "cfbf1ee2-2565-4ca1-ac28-dd352dda80b3", "value": "T18A314C5056F56219F6B32E15A9FF9491442BB6BDAE36CB4C0010C24E17B1A84CCBBF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647478, "uuid": "7d7c6964-8715-498f-9474-d85543eed62a", "value": "24:QVR2PMO9xTtvboIzHYJZckH05ggJRPsGRx/MFkQWsGGFvshOZeiwLzvs5LmY+gjY:IRd2LzHYXvNgJRtR5SkQkbOg7L45tzCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647478, "uuid": "b9c17ef7-53d2-48f8-a755-d6f774cb4fca", "value": 1646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647478, "uuid": "95cb6154-b036-4cea-a30d-f7d701be4602", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647478, "uuid": "43a48a62-af44-4bd3-b848-ec5eb6887426", "value": "kdnyv_01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec37841-0610-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770680226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680226, "uuid": "1b9bf981-24ea-494f-922d-970c17060efc", "comment": "Malware payload (SimpleHelp)", "value": "b96c8e33099f86d1344c3e9cbf99a2a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680226, "uuid": "f53d6c93-a4d9-403b-87e8-b9cd35edac70", "comment": "Malware payload (SimpleHelp)", "value": "8e5fd30aa787d132dc8816b288a5dba18e7826ebae117aeae622628de29d1c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680226, "uuid": "b9240ad8-e205-4ede-b879-2042bf1d0d91", "comment": "Malware payload (SimpleHelp)", "value": "2965432964b8ccc77747ca8e7c6a9c4be5dc93ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770680226, "uuid": "0d8683de-e658-493e-b239-ac4d957fdf2b", "comment": "Malware payload (SimpleHelp)", "value": "489f93df2a488d7f61341c9ec45813b67ec12c64b70755a29b7c2d812af8c56f5902f743c52436eef17ca63e8a298e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680226, "uuid": "acc1a6b9-4ddc-4531-b50b-09d393edac92", "value": "T11687331AF39599FADE33D0FCC0854447EE9679E54382422717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680226, "uuid": "22684bf8-0cbb-4a0b-babb-b6d57d62746c", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680226, "uuid": "5df61e96-84e4-4d11-a743-04a672d3dd03", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1br:/uRf+nAu2FuQd73XyFeDMnKTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770680226, "uuid": "f73fa2f1-05eb-4c06-923a-029a48161f52", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770680226, "uuid": "9998805c-cf24-4ef7-acf6-cd9e883231ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770680226, "uuid": "16e75988-2876-4fca-a21e-a5cf0edb23b0", "value": "Access-EfinViews64-offline.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c274d439-054b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770595836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595836, "uuid": "e7a01545-b673-48c2-9c8b-57b3ac4ae3a0", "comment": "Malware payload (Mirai)", "value": "92a9b76ab53744594a54a4b7ee62959d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595836, "uuid": "a893e7a1-0fa6-400e-8b17-16a3c4ca0324", "comment": "Malware payload (Mirai)", "value": "8f2389f85adaf6ddcbd96333e0e311509b3a46e5a0e117b874d7f917360dace0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595836, "uuid": "6edbb656-39ca-41c7-9ef9-b1247cb698fe", "comment": "Malware payload (Mirai)", "value": "484240cb886fbdb61518d6bdfc4f41a6bfa92452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770595836, "uuid": "b26272b1-75f6-4b3f-aba7-946be9fab540", "comment": "Malware payload (Mirai)", "value": "7dc2d564fe1d7ba7ee08e9741fea29ee0fa6908f817dffaae4db393e8ecfe08669c68d0e94f69f67656eaaa9dbdfaa57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595836, "uuid": "b21c3d89-c7aa-4d33-ad07-09c9cb8908e6", "value": "T1B26302713B46ADF26D3D2077DF3DA4135541D2B0EB48BE332869C690B5760CA39E8E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595836, "uuid": "5cd99e77-f0e8-43a3-8cf7-854e95f892d6", "value": "1536:Si7bU6vsCHiI6t/XMAWfYmNao4J8M+ApEYg:SSb1s+lA/XiHKJzpEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770595836, "uuid": "b386f6a6-4ba2-4baa-aea2-45b2c21cc1ed", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770595836, "uuid": "76ac29ed-9ad6-4145-b99c-1548eae26082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770595836, "uuid": "fa37cfdb-21b5-48e5-9f6b-2a1cf171bc46", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1411f5-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632413, "uuid": "34c00273-460b-4158-8b4b-34d118d691ca", "comment": "Malware payload (Mirai)", "value": "fa143357d91f46ef123a98a1a03b4a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632413, "uuid": "0c334b0b-2b57-42d4-ba78-75962aac8439", "comment": "Malware payload (Mirai)", "value": "8f2e8dd8dd734baf770fb2c65880310fe5f67dda4beb8fceee3dc7df53648f33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632413, "uuid": "939b4d7a-ca38-47e0-b480-a941ea2fc45e", "comment": "Malware payload (Mirai)", "value": "d2978420ae9fb922c87fa867087741dc12173622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632413, "uuid": "dc7fc94e-de85-4d4d-8b90-0152d6297f66", "comment": "Malware payload (Mirai)", "value": "486f5d67d2558159a7eeaaa77c619fe84289da91a01773976266faebdbe02aac227f414352ba599b91a22792afb80152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632413, "uuid": "bf31a63a-0e77-4b47-b151-197cfcbe17a8", "value": "T1FAE30B46F8814B12D5D111BAFE1E128E37231BB8E2DE73029D246F647B8697B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632413, "uuid": "1cc0c821-a701-4f87-84c9-5ac77df27e2f", "value": "3072:XNeYY/qUUEeBsXED95h2apP9LuL73LALVLw5:9eYY/qrxsXe95ka3AMLVLw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632413, "uuid": "abe40e23-1206-49e3-9832-ca2273871658", "value": 144220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632413, "uuid": "e32f9ec0-a092-45e4-8668-50f097720358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632413, "uuid": "74d33663-45e0-4ae2-94f0-025785352852", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f63b93-0582-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770619272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619272, "uuid": "e74620f3-873c-47d7-a12f-e4af813426e2", "comment": "Malware payload (RemcosRAT)", "value": "9d52bb297e5dfb510b26c852af17e7f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619272, "uuid": "9a24ffe2-c7bb-4a10-9332-1e3021f1c9b7", "comment": "Malware payload (RemcosRAT)", "value": "8fce82f738c186f70e4d9866b011e0c16842bdc591ced3b627092e0a5444c3ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619272, "uuid": "7fdda294-09a7-425d-8d37-91690471af4e", "comment": "Malware payload (RemcosRAT)", "value": "6012fd6165dc1e96ecc902a57787e3e59a655b86", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619272, "uuid": "feae2f5a-47e4-4c27-b04b-28afcb336311", "comment": "Malware payload (RemcosRAT)", "value": "d67ba8bc18d2beea0cbe51370c03058c58a7b055daea4dacde9c39d297bc8ea255f79cf0e791227da2af2507f62cdece", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619272, "uuid": "4510afec-8c99-406b-af79-b3024dfd9c25", "value": "T13D06BE43FF8255F2E9CA417922E79B7F4E394D14A72489D3DBA018A9C8311D0A73F798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619272, "uuid": "c1ce1bd5-0fb0-46ad-9c97-af8be523ce2c", "value": "b268d030a3e79bd13d19a3729b6a8237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619272, "uuid": "48b74c01-0189-4ba9-89e5-586467df283d", "value": "49152:a7iMkSLBaqWsUldGEJBMzMuUoPo3lzLrFRmxWsQzUZjYAyGMYzDOA7qXgG8Fj:a7i01tUWOBoDe3Z/mQYZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619272, "uuid": "5d5ab08a-a3b0-4e76-9e24-49b17e5b8c8d", "value": 3761664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619272, "uuid": "f04bff93-1b55-4741-b321-54cc067700f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619272, "uuid": "081636cb-c1e5-4f81-83bf-c2f2758d4b70", "value": "9d52bb297e5dfb510b26c852af17e7f5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71514f1b-0598-11f1-a129-42010a9c0007", "comment": "Malware payload (StrelaStealer)", "timestamp": 1770628771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628771, "uuid": "d2e9b24b-35f8-442c-ba74-9e376d81d1a3", "comment": "Malware payload (StrelaStealer)", "value": "5dea0e1f8951f4477b275dc50b4d3e1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628771, "uuid": "904519ce-98d5-4bdb-a159-1c041acd9faf", "comment": "Malware payload (StrelaStealer)", "value": "90f5b54c027ddd863bc31608a97e5ac23149ffa282f05fd1015cbacf30174c7d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628771, "uuid": "6572ac9c-541d-45b4-8db3-003867b4f8cb", "comment": "Malware payload (StrelaStealer)", "value": "05b3b18631e1dc0c1820f0fc0b3d1a68be7edfba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770628771, "uuid": "c649e4ec-dda5-4fd0-8f32-890a78bb122a", "comment": "Malware payload (StrelaStealer)", "value": "1f13916f917a285c974ef16f95403df1c6851527dee04f2279b19582d35c2c63cb56fed74d7e9f3b84a2ef6a108fbf55", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628771, "uuid": "555e1a6a-2fd7-46c9-bf31-877e12983376", "value": "T14052942AB74449049FD3009158AAD526CB89A12A39550FBCF1FF301DBD0773F3ED2A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628771, "uuid": "9d10658c-fd78-43aa-85cf-ba8777518107", "value": "384:Ni/DFyIHx0Djxx0mx0TOx0D6SIVYDcrlaZp5wE7WYE7Es9Ac6sCoQJZO8Kh3ctA2:Qc5AtRye7VAEB8QidtKxsTI01OCdwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770628771, "uuid": "defec6a9-87ad-4aa4-be68-88a046012a59", "value": 13310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770628771, "uuid": "5de66edb-bc33-4a6c-83de-0c6c4123f0a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770628771, "uuid": "a042c18a-9431-4f47-8813-a11efbf56e71", "value": "285493125727623.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9041ee30-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598759, "uuid": "04fc9835-232d-46b8-9462-45ff84ad3781", "comment": "Malware payload (Mirai)", "value": "6cb77b3edcc3d5ca08e1802e6ef00ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598759, "uuid": "1a4c51f8-a490-437b-b4ed-a871f7ee3469", "comment": "Malware payload (Mirai)", "value": "9161478d1ada002eca22caa228993e7f9e9ec8e8834ae938517c7736ba46ad65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598759, "uuid": "07d0bb30-bd56-4b44-88ea-cda7b60d4b5c", "comment": "Malware payload (Mirai)", "value": "f0467d6801b7bcdcd3dcc11dc36d6dfdd749116c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598759, "uuid": "8a5e051e-663b-499d-bf94-e2e8ba48e013", "comment": "Malware payload (Mirai)", "value": "9ed5e2fdbf2269844646bb72f78852551a74c99f2bb7ecaa88f48ab12ffe01d0a09e7ce7c8fd047a73ab4bfbbdd39ddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598759, "uuid": "019e9e90-53bd-443c-a373-000ae5a6cfbc", "value": "T134145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598759, "uuid": "6bab53e0-aec0-4950-83a9-a9747baf0c55", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXNUaN:HZ15BTYCrYq1QDY6O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598759, "uuid": "ce8cd74d-8732-458f-95d2-c389c3398e4f", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598759, "uuid": "6d8d48de-2777-4d68-96b2-38caca830208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598759, "uuid": "29d19a26-5e6f-4277-b3fd-806b31a7cae2", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ff6f48-05cd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770651759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651759, "uuid": "732633f3-5da6-4f43-b2ad-f72ab5c0193a", "comment": "Malware payload", "value": "f86b71bdfdfa11d8ecd46190e593a152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651759, "uuid": "1a4c1147-d2d3-4cac-8132-d9ea60ada5fb", "comment": "Malware payload", "value": "91f128a2b4da8280239f8bc1218a2a5ba7cae767394913a7dcade94038204424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651759, "uuid": "ae041327-be7e-4dd7-ac2a-3d4ecc0ecb8b", "comment": "Malware payload", "value": "1f613e064119aa25d57164025a16b6dcd8fd3148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651759, "uuid": "b2429ccd-2df9-47a2-9eb0-98d53a3f81fb", "comment": "Malware payload", "value": "e80f5045c41a06aff5b56f8059a13870d35abb7eb1fe94ce36afffea57b31cb8a8c1f9898080291763e5a4364b95c62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651759, "uuid": "3e3aba95-1b5b-4069-b026-448f82a30975", "value": "T113853847B89154B5D0AAE2318A665292BB70BC980F3163D73B50B3BC2F77BD45E39318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651759, "uuid": "b5d55243-d722-4bf7-93dc-7a099d0a7543", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651759, "uuid": "d6adf414-c621-466f-956b-c79430399070", "value": "49152:Fms4YIx2D37nrb/TivO90d7HjmAFd4A64nsfJ3p5EbNYgyrP83FKKD1:wI37DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651759, "uuid": "6c415e4f-2de2-445d-89e6-02a79b24b831", "value": 1805312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651759, "uuid": "4ec5f15b-0a71-45b8-8c29-22bcc1b5c1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651759, "uuid": "17b5f1bc-f9c5-4f27-a27d-2184c76761a0", "value": "91f128a2b4da8280239f8bc1218a2a5ba7cae767394913a7dcade94038204424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8073c372-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632233, "uuid": "ad407894-764e-4eec-b08e-999cbbd6c1aa", "comment": "Malware payload", "value": "b562aeea33d0f259040f73b60bffb3ea", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632233, "uuid": "85ef894e-e895-4154-81c5-2eaca49608e0", "comment": "Malware payload", "value": "9456beb8943a30384114de62d9d8e96b58a0dd7b96d55372443c96915edc4774", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632233, "uuid": "2aaa8874-d4f7-4339-b138-4ea87c1456a0", "comment": "Malware payload", "value": "310532b37f7cdc83a7142e035d3ef6fee4629f8a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632233, "uuid": "b997db9c-a36e-468c-9709-0f6e438b7840", "comment": "Malware payload", "value": "d877f150083d32020c53248eb23f5df39a04abb36f92aabcdd730306079a1c050c61707fe91deb834ee8879852da23f9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632233, "uuid": "e0c687d3-545d-43f7-8975-df60f7c48fd0", "value": "T1D8E34A724517FEFE3A7D2EC0D8002E451D6C29970A1AC198FFCC51FAA7EA950CD2A476", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632233, "uuid": "f5b71f7f-0fa6-4f31-8a8e-9f68a3884656", "value": "3072:IFbREbmYU6x8OP2iXSl8CEx3YKZEVmlnr0wpHktQ:yRIjSa3YKZEVmlYwpEtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632233, "uuid": "3eab7026-80d4-4d49-8cb5-0a99e576f038", "value": 153510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632233, "uuid": "93df5034-cf37-455a-8971-f8c2ec2fd481", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632233, "uuid": "4a5a7eeb-5b35-417b-8394-bbcbfffa6440", "value": "run_updater_wsh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e6f327-057e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770617829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770617829, "uuid": "2bc8ae5f-75b2-4ca8-b469-3db8d74c19c6", "comment": "Malware payload (Mirai)", "value": "3c891655cdd62ad7b5359368291acf7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770617829, "uuid": "0c8a6420-38ea-4056-bf1f-252ee5f545f6", "comment": "Malware payload (Mirai)", "value": "95118c37e8674a12d30b970d7fc45da6baa823c3387a443cc7544d25837a00d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770617829, "uuid": "c0f50ff3-f304-492b-af09-cba6206a6e62", "comment": "Malware payload (Mirai)", "value": "91abd39fb37a0df5eb1c61b86d9848165a48868d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770617829, "uuid": "44edd8dd-a447-407c-b0c6-9fb7ea918d3e", "comment": "Malware payload (Mirai)", "value": "45c634599ab0fed8e1f777837bd6bcdb9b8de546abef5bf135a1a00be96bae5df476154d75933022e5d6cf99ec5c86ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770617829, "uuid": "0da3a0a5-522c-4fac-a661-b4231fc5b3bc", "value": "T1B4F48D06FB0C4573D9630EF01E7F03E6C365595304F9E51A260EA7A61636E3E9AD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770617829, "uuid": "a12b589b-3aea-4918-9067-213ed187d471", "value": "12288:cL9axyoNUSkPYsvorYDRt5u/NEpY/nGH6jNlTqA2ipUzIDKivxD33:8MG1DhuQHWAAYKKivxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770617829, "uuid": "dc2a5d97-2c33-453e-9b52-96f37234b0f8", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770617829, "uuid": "ea95bcc0-afe8-4545-9126-9ff6d9237325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770617829, "uuid": "9a7825a2-e56e-4475-bd0b-b468b6a91046", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b432b37-0588-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770621782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621782, "uuid": "d72844be-868a-4517-a2d5-1666f3270613", "comment": "Malware payload (XWorm)", "value": "3051104f210e5d7009b70a3fd23cfd3d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621782, "uuid": "ae0e6b3e-292d-4a95-bf5e-7e802716df2b", "comment": "Malware payload (XWorm)", "value": "968cbd067c814ed1bc9a433a26114cc1b7bdc32a3780dd599032075f3ba2bc2a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621782, "uuid": "399ce522-011d-4bdb-b652-65785d737332", "comment": "Malware payload (XWorm)", "value": "bc6835fdf65915593b0e8c52c09ec2e4a6e2e5b7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621782, "uuid": "694e7d80-97ba-4f5a-8404-389263e1fe47", "comment": "Malware payload (XWorm)", "value": "d7a1b042ace0d5899bcda0ca3d02efcf7ae622cfe035a0428ca5bb547b511e7ff909a40d7bde0a6ddb49c130b2ff1a85", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621782, "uuid": "1c13b206-9d46-4360-be2e-10ae6585e764", "value": "T14852A22A8919EFF00E2E3291A55F681A39510365A934392D7C4FD5EE3B37A40CFE14AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621782, "uuid": "9aa940a4-9183-4e5c-8923-688fb5859297", "value": "384:K31dfQ0r8roAbw0OzBvhuVH21c3caSsldD:K34IB8zll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621782, "uuid": "f8d63b06-9fd1-448d-aa21-bfd9732c2ceb", "value": 13488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621782, "uuid": "05834af7-bd8b-473e-a780-cbd8ce4e726e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621782, "uuid": "b3f25f4f-c62d-4926-9166-05b1314a4aef", "value": "original_draft_bl_shipping_documents_docx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba8ce3-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646353, "uuid": "c46a1a79-cae1-4d51-8970-cb42d7ced57f", "comment": "Malware payload", "value": "cb71d716e00e4a549fdcd09ca210da95", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646353, "uuid": "376a43f2-3c1e-41d3-b4a0-f0665d47d86d", "comment": "Malware payload", "value": "972fa5a416057b28ba0a442f81765a9f775435a789acb9338ae89208d47f0dc7", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646353, "uuid": "37a22729-65ce-4a9f-a143-3349273ec6c8", "comment": "Malware payload", "value": "4d237c9cf44fb6a39936f004e934fabac7edd06b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646353, "uuid": "998397d9-d635-4089-93ac-1e5df608dec5", "comment": "Malware payload", "value": "400027cb2694722c0466b0a08bbd7ac94c09f45b3192c5a299a798f1b06f4e22671da51924c1012b92e00bb19cb763ea", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646353, "uuid": "d01db38e-59f0-4621-a596-4ff6e1d4d911", "value": "T1C02413ABC44BCCE6CC3EE03E62348ED9B219790BF25678352829646E351179F315DE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646353, "uuid": "05bc2c76-84d9-412b-af7a-d9855602eac0", "value": "6144:VJ725geUsZIUbbuzuQjzbU23umBhqkW4A9TKlf6WWLYF:fMGaXCCe0ou2aQicF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646353, "uuid": "75ae19a1-88af-4d94-b27e-56bc68303c6b", "value": 229387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646353, "uuid": "6558a771-9219-441d-b46b-8e66d3d93531", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646353, "uuid": "60d32ea6-df8c-4a0d-b0eb-3b79fbd40eb0", "value": "CP02ASCARCMET4722BMP.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813a4d36-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770658004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658004, "uuid": "87bbf26f-2db9-402b-a2b1-f401e13664ea", "comment": "Malware payload (RemcosRAT)", "value": "8b82ae56138f58d2cb5362192a3b5de1", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658004, "uuid": "04d347ed-e6fa-42a4-bf8e-a58411e97004", "comment": "Malware payload (RemcosRAT)", "value": "9764d62f1d304e1330a9cd7f9f6b97c71df852e9329ada40dc05d9ae4d749864", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658004, "uuid": "4a814151-78bf-4bcf-9774-9c7258221ba7", "comment": "Malware payload (RemcosRAT)", "value": "6104ef14d7a66cdc14c8050ab50501b8d9270ba1", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658004, "uuid": "94767085-86b9-41f0-aeb3-3af500a909ff", "comment": "Malware payload (RemcosRAT)", "value": "7e2ef8ceb7c78c386463fb508bb0a5e09ca0e33ae05de20fc5ca122bc19628ddf64aa1684b7b2e41a46410630c242c69", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658004, "uuid": "88185909-2737-47a0-ab14-9548b57d5539", "value": "T19B86D5735241A9B23B233FAE02326990AC17390375CCEB14F1CBA1A677DDE12DA755B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658004, "uuid": "308ad5e9-d7e8-4412-b976-fe58c9e67468", "value": "98304:F6CXFLuMXKRT3KFVzwQjlytQAZi9Cv05Cgvw3ISpYZ:3XKRT0VlytQAZUCsfMV+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770658004, "uuid": "31e72624-b07d-4da9-b029-2afb8f85ee51", "value": 8581472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770658004, "uuid": "fe02b371-1a69-4c73-a609-a4a23a5ad2d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658004, "uuid": "12730396-09d9-4a44-aaef-6d6e7c87008a", "value": "9764d62f1d304e1330a9cd7f9f6b97c71df852e9329ada40dc05d9ae4d749864.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a3c572-05da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770656961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656961, "uuid": "cf32e89a-930e-481c-852f-51910698dd17", "comment": "Malware payload", "value": "2b08ea71a8ab75fc543cccebc9997ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656961, "uuid": "33f36448-2f2b-420c-aed5-db8a69271ee5", "comment": "Malware payload", "value": "995ec18dae9cd100eda1a1f0531aec5cf862325ace78bdf6580b9b37d506417a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656961, "uuid": "bdad4752-f46f-4eb3-9afb-acf47571cbea", "comment": "Malware payload", "value": "fbadd45fbf9e9fcca5a050d60a94ea71cc85cc65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656961, "uuid": "9514dce2-cace-4c0d-a9bb-c0ed5e1dd09f", "comment": "Malware payload", "value": "c0bcda7d03a0772655d443dce55759eaa66b73cdbecf3a6d0386db3ce199c1156ff8ea4c629016beb006a909d8952aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656961, "uuid": "e45bc399-7935-4243-b1ca-1365c1e9e8e8", "value": "T1C133E735D96EB0AFD35AC874DD430D02CD12BCDA8BA0B6DB57915DE20EAAF509B2C341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656961, "uuid": "9788e8f6-c70b-426c-b0ec-abcf1f08e8f5", "value": "b67b200ba3931caf8aba3c9ff8544b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656961, "uuid": "30cdc26b-d4a2-4f6c-982f-4ea21ecedead", "value": "768:++fDsi9mO0bEGs2frRqasHLG8wenQ936BrCzx/b4ROU6FQ0B:UOUEGwSvenQ936o/b4sU6FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770656961, "uuid": "60c80460-d2cc-4418-8a62-85f223d1dbb0", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770656961, "uuid": "602ac53c-3ae8-49cb-89df-72cdc341da8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656961, "uuid": "d4df72e2-ddb9-4597-a54b-936d8f4a325d", "value": "bdbe1fa6c7c83a005f898d4017705078e32673bdbffa22da78b15468cba1d4fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4922271-05f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770668881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668881, "uuid": "23a57b8a-e8ab-481b-956d-674e5ab2219e", "comment": "Malware payload (Mirai)", "value": "9151065b92aace3ff424d10d412594ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668881, "uuid": "7d7ef99a-73c9-4ed4-a3e8-779532394df0", "comment": "Malware payload (Mirai)", "value": "9aa1a5e28a1fdd70b964ab5b96b350a5f999cb4c1f64df2fe180bc652c950d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668881, "uuid": "9d5a88b0-f5e0-4a9e-8ab2-e27b794bedbe", "comment": "Malware payload (Mirai)", "value": "62f1480bcc66dcc1efa758e42a242719fa6c2d91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668881, "uuid": "6c80d393-b669-4384-b318-75c93ac050fc", "comment": "Malware payload (Mirai)", "value": "ebe9e6d7dd5d746bd83b9bc0438d4e67b5a40cd297f6acb201ce91242b55c2ba7cce3c91756eaed3176c3a5572be7d21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668881, "uuid": "bde1b9a6-2336-4b38-af87-840a084524dd", "value": "T1BFC33A92FD81D612C6C721B7FB6E428D371713B8D3EA32079D216F21238A96A0F77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668881, "uuid": "d160380a-c68a-40e2-b67d-094cf704e9fc", "value": "1536:s9CQ1Vj6Dkqw9NP2UyEPADFkxBswnUcRyUyF4MTPDukpqDjwJ7iq0Fen9OppTs2u:s9C0h6DRS0w5RgDtpNuq0o94uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770668881, "uuid": "f736cf5f-7376-430b-ac32-c07586b6be08", "value": 120020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770668881, "uuid": "baed0993-3622-4d08-b3c0-dc085c9a397f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668881, "uuid": "5b4a8089-432f-4d86-ab1a-a1c5c1351665", "value": "arm5.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cfe150-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645454, "uuid": "cf1493dc-4b50-4644-8eb5-0780c2e80633", "comment": "Malware payload", "value": "9bd806140270289a5e94cd6c1140fa22", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645454, "uuid": "2fa75bbc-633b-48d1-890a-796bd20e418d", "comment": "Malware payload", "value": "9b8442f1f57779344f392d1360878a3fb9676697ed447c9004ea21ebad3e03ed", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645454, "uuid": "4ec54afb-7501-49d2-9a91-f38fe5ff0e74", "comment": "Malware payload", "value": "01affe3e8bc242555acf6f0bc2868a3dedb027ba", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645454, "uuid": "f4b526bb-be83-4b84-bd95-af7d64b159b3", "comment": "Malware payload", "value": "9b5d0174db6e9681833ab9ef9195997da93ae670dafc9cacc5b92ef71ad62adfdb6453ec60827288268dd72f05994320", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645454, "uuid": "6f890993-a093-49bb-80ac-7edbf69724e2", "value": "T11EB2F796B7D64069D5AF5EF68DB293020635F3090C33D77D0CE8A2B949B7BC18790B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645454, "uuid": "4133d30d-1a13-482b-aabf-cf6c32f37401", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645454, "uuid": "5d21f0ca-2a1e-49f5-bf63-3bd3d9ba4a01", "value": "384:Kz8RTk/yxndjnaPDsn58LSJdwpxsFLMaxg5LN9p2zbRWtwAyyQfHirDju6kAjfi0:Kz1/yxd9ipbwupKHir3u6kAj6h58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645454, "uuid": "fbc175ea-eb59-47b6-b8a4-08c81061e30c", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645454, "uuid": "afdfa27a-6aea-4e9b-8b07-b204280617ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645454, "uuid": "02ff8b7c-4a5e-4d29-8627-d77db7cf2047", "value": "Keylogger.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b0ed67-05b1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770639494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639494, "uuid": "4b5c27ea-4b07-46e0-bda2-0d9061cc37cd", "comment": "Malware payload", "value": "24c52157444dc9c17ff8232765ca7b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639494, "uuid": "637ca2f6-d223-4199-aa71-a28a9c14b3a9", "comment": "Malware payload", "value": "9b89f9aed666f5512c83ae42dc11555d3853452af0227c03b531a890fd9c0d9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639494, "uuid": "016e5f4f-d1ea-4b6f-bdc2-fe1611a6dda5", "comment": "Malware payload", "value": "e0bdd03d8dd3f1700d052591ca2c690afbe2d87a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639494, "uuid": "c3b465bc-d2b8-43f6-ba02-58af20e4fc6a", "comment": "Malware payload", "value": "c10ff17e6426909f85d878a15a99bbc929604bd665aff8149fa639b8df0b24f4e021973949a6c371911076661fbe3338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639494, "uuid": "6449d7c2-ffa8-440a-b77f-77bdf3190cef", "value": "T1DBF475627F59AE0FC6A9323956A6C13473C77A41C1E07032CE93D7091FAE2B4D85ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639494, "uuid": "74d77862-9513-49ff-acf6-0468df7521a1", "value": "6144:8pXzT1Af7gjEXMc4FpAePthg5mh+cQa43H4gnmWDimt2fDabOEAOhcela3:8NzT1gkjE8cOPth0n3H4gd2f2HCela3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770639494, "uuid": "25d16636-c435-4396-9e23-15bbbce72347", "value": 733995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770639494, "uuid": "fa4925c0-2586-48db-b8b5-662348621a1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639494, "uuid": "b3620e41-3072-4380-b347-ca65672f1010", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea48e20d-0583-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770619955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619955, "uuid": "3cba1499-7f03-4bfa-9179-9da97729baf0", "comment": "Malware payload (Mirai)", "value": "56251391a5b755cc448a2fef354db381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619955, "uuid": "dd5bb037-034a-4add-814a-f94a93051248", "comment": "Malware payload (Mirai)", "value": "9d2c75db8bab8d90dff888b10ba3473100b08401bffdd3ca70680bbf09de6505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619955, "uuid": "4239c632-f3c3-4887-9c9a-a4bea7534423", "comment": "Malware payload (Mirai)", "value": "e9386cb3225dc705594f3b6915ee316247ee79bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619955, "uuid": "e3231a47-b712-4b75-b9bd-ae51c302da10", "comment": "Malware payload (Mirai)", "value": "09af982bd8dedbdf26ca598c63694c495d3c64a0bb0fe99c6c8b6cfe800c90f42183a21695c26dce271691758bf4409a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619955, "uuid": "0dc042af-fe1c-4e79-ba77-5059ae7d9752", "value": "T1E1C44A55F8809F61CAC52976F79D869C33134B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619955, "uuid": "5428521d-6e05-40d2-995b-0a4f71de9141", "value": "12288:eoLRjowYivkl5S0XR36XulSTGgqRgpEorw4C:8Ukl1YGeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619955, "uuid": "ec9affc6-13c1-4a09-8d25-2e28ac1e801e", "value": 587496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619955, "uuid": "0b2f05f4-0700-4864-b010-7cfad7840656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619955, "uuid": "3a2f88ca-c1ff-4ef8-b3a6-f1e66301cc74", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9af200-05c7-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770649054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649054, "uuid": "6b1a133b-a927-45cc-a31d-f381dfb01878", "comment": "Malware payload (Formbook)", "value": "7f67161d19ad39509ae77b73139c8d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649054, "uuid": "fa821b86-d01b-4174-83c9-ae833851cff0", "comment": "Malware payload (Formbook)", "value": "9d8be1b8c4032e74447e04189d711c80cc41e4df6ffd2b4539fb1195148276e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649054, "uuid": "363c3116-6726-4b79-9677-91a77acefae7", "comment": "Malware payload (Formbook)", "value": "448551097283405ec7dc6d2e5abee96e7f8358c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649054, "uuid": "db1f2c72-3394-4f6e-8c6a-c795fe035203", "comment": "Malware payload (Formbook)", "value": "337e7e13363e5451350d377ed7226a059924645f9daf0a9b7448dd528d153daf95d3043d8cf9ab3c74c920e7f93a8978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649054, "uuid": "8067a99a-280f-443c-ae1e-1213e83e98dc", "value": "T1A453A920C11472858900D692E9A48B4FCB95CD6473226DF6F42F5CEDBBD65B32E1B8BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649054, "uuid": "ea8018a9-bafa-4819-990a-cef9efa41538", "value": "192:pa/S/qIdtCqWGbTlu09GCAHbhicKoDeiaSd+W9gbfwbbgm45OORaPjKVq05KLmOn:v9Gi5OVYDSM0f/vMR8NdgyBXzl4FURn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770649054, "uuid": "f1754fa2-f696-447c-8684-d28034d053a2", "value": 63661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770649054, "uuid": "6e283def-5f0c-482d-aef7-ac836d95842b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649054, "uuid": "13bc2192-d41a-4ce1-bb25-1c06c981a754", "value": "PO017642.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd6f574-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645352, "uuid": "0c303187-d8da-48fd-866e-fe9d376be471", "comment": "Malware payload", "value": "c3f93a4b7d22acdc23f2ced05d3ba352", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645352, "uuid": "cfc0828c-6800-4ee2-ad52-23ce230a120f", "comment": "Malware payload", "value": "9d9cfe5b31a3b0204e3c65d440d8355e33f7c056b087ec6aba3093ae1a099ac0", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645352, "uuid": "0758d7cd-7a64-440b-a5e5-248dd56a4504", "comment": "Malware payload", "value": "d56b44e59f0022738630fe43b82cdc20aadb5e58", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645352, "uuid": "cb5f191f-8fd7-43a6-b7ff-39f4357991e3", "comment": "Malware payload", "value": "bc92d4a067a555590b4bf112740c44521bf41541c6322b2baf0cb2bb5604572060b0f3226fc6846a5a7f02e98856179a", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645352, "uuid": "3746cbe6-4b77-4aa3-8bb5-27f9573ff251", "value": "T11BF29D16718F961C70B3068D5A9F02740B6F7A9F1E7E808A058DE68B8FD36159C5B3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645352, "uuid": "7bc579d5-a757-4713-8965-db68c5ab99e3", "value": "192:l/ofXggLM/ofXggLKFcFfFUF0FvFPF4FbhF+F9F9F9F9F9F9F9F9F9F9F9F9F9Fe:7Yiud+aoO/+EY/FZPNVgASO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645352, "uuid": "70800308-7d79-40fc-82d2-5d9e6dd415ff", "value": 36964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645352, "uuid": "e1c1395c-be8a-438b-8a54-3c0759ee3819", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645352, "uuid": "b60fae14-e3d4-48c8-b7d2-4bd449269ed6", "value": "9d9cfe5b31a3b0204e3c65d440d8355e33f7c056b087ec6aba3093ae1a099ac0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1b09fb-0556-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600520, "uuid": "5be3fc7d-6738-4115-8d1d-b6b52f825078", "comment": "Malware payload (Mirai)", "value": "2273bb9f7ef31715d44e7dd085dd9931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600520, "uuid": "37c08a15-2c5c-4b0b-8b8d-161ea67441f7", "comment": "Malware payload (Mirai)", "value": "9dfe8344b4955e58824071c1ef033569e23815f4d816a223d338222e7c975ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600520, "uuid": "87da8542-7b4d-49cb-8ad7-9ae6af9d41a8", "comment": "Malware payload (Mirai)", "value": "7979be52271610876304525a3de451dccb7fd986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600520, "uuid": "2bf1c914-9076-4732-b762-e10a27e67f52", "comment": "Malware payload (Mirai)", "value": "e1ed025f50437d7b2f74ecb47f22547e87025b976c74de3a40232ef046f90560f623fa95de1b8b5fc994d409a05110d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600520, "uuid": "7e4b4c7c-38bd-4541-b508-17cad91e6799", "value": "T1FE53BF61C46CDD9CC65545B8B690CA399723640861A32EF7EA4BCB86C04BEECF0587F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600520, "uuid": "b32874e4-7a65-40bd-916c-75b8deef3040", "value": "1536:raOhbt793w5gup0YkTkPnoBOCofs3uOuYcgNuBm0Cp:rnhbJ93mj4TwJbf+uTYdNuBm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600520, "uuid": "5a521b67-f649-44d6-8b09-c40410bd6d94", "value": 66576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600520, "uuid": "173edeaf-01d5-4429-846c-ec2c8efd6305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600520, "uuid": "e888d129-d30a-44ef-babd-59e247f46cb2", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86e0333-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770632407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632407, "uuid": "bc7875d1-09ab-4798-b142-c654cb284ee9", "comment": "Malware payload (Mirai)", "value": "903d196f6241a52d0e5e57bf1346d975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632407, "uuid": "d1c4bec3-4866-49b2-bf5c-50decdae5966", "comment": "Malware payload (Mirai)", "value": "a138edfda464ba8930ba4d02b5df8c31330150e03eb106008c0721eeb2547fa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632407, "uuid": "778287b4-1f03-4c9f-95d2-6777c83bf6ac", "comment": "Malware payload (Mirai)", "value": "33cc0dace55b6acf4452c135948b908cabab6d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632407, "uuid": "cac8d58f-dc9f-4052-85f6-17736377b1c8", "comment": "Malware payload (Mirai)", "value": "fb1a7a346d7b060d5157ab4b2cca720e9694763a5faa5ed457069f82edf1531e4587d5ceb42a23375f1db78dd2482067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632407, "uuid": "061522ae-fb37-42ab-b714-f431d7abd5fb", "value": "T13F042A45E6404B13C0D627B9F6DF42463333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632407, "uuid": "2881e891-f01d-4c79-a05c-40343cf5f591", "value": "3072:FKheVFfZ84CkO3veAQalEpgvjqsOIpLLtR3j57no7M/RewpHZRrzn:6eVFBCkkWAQalEpgvjZ/LtR3jho7M/R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632407, "uuid": "378068d4-d6f6-48d4-a7c6-d188ccb44cc5", "value": 181562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632407, "uuid": "ad399437-4497-4702-86ee-407e8357f5e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632407, "uuid": "0a3ebe0a-deb8-468a-af54-9e29282ac1e3", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d0b583-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1770648506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648506, "uuid": "70a658c3-4b1f-4699-b149-0e8d0a5ebc52", "comment": "Malware payload (AgentTesla)", "value": "35fac7d6242f006f67d1424a05b5542b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648506, "uuid": "8ad47310-b939-4469-8fd2-b99e81b7c683", "comment": "Malware payload (AgentTesla)", "value": "a2909324ee9763d9c6b48ed73d2bb082d622eebd35d22641da2894d9cf94cea9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648506, "uuid": "497a439d-5c3b-44d5-8107-f782340d88d2", "comment": "Malware payload (AgentTesla)", "value": "55d55d83118bd618174f6258cd338f6067438ba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648506, "uuid": "124ba0b0-9973-46cb-8356-9a2b90930d37", "comment": "Malware payload (AgentTesla)", "value": "54db245a40d7cab68338736717747be387fa5dbfe18ccfd0bae3c39debc1433395febbcc11a1dad4a313dd80852b266c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648506, "uuid": "8d0deedb-ebc3-4b40-bb41-5c5110e1b364", "value": "T13E25E01123A81668E0BBA73E46320B0187F1FC96D9F7D71FF9446DD92861F419EA1B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648506, "uuid": "53a4603c-cd7f-4da5-bf44-663ba657984c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648506, "uuid": "c9310d9e-58dc-472f-ab56-6b3211b22ad9", "value": "12288:XhHaozKcV23hZ7rxMkdwtffPdvgZQ/XWd2pfyO9ToGj4h/VPtlaqMiYaNn:k7623BM1lKoGOyO9ToGj4h/VllaqMi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648506, "uuid": "d144c411-2c69-420b-ad6c-19461b2e79bc", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648506, "uuid": "ce073c8d-35a0-4df8-9da6-99d62b7565a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648506, "uuid": "8d7bbcf3-355e-40d4-be3a-c774b0afef46", "value": "ORDEN DE COMPRA...06022026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d185068a-05f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770668876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668876, "uuid": "ea005e3d-5b66-4f03-948a-8f81d3c73ac5", "comment": "Malware payload (Mirai)", "value": "15d86a4f8771b7ae2a36dc6057185eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668876, "uuid": "fe96fb5d-cba1-4dd8-a60f-85ea4dd0eb64", "comment": "Malware payload (Mirai)", "value": "a2b918a2d4c57714b026eb469c3cd66c5e972ba2fab1b7558e19dba8c9ce611e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668876, "uuid": "541c2c74-b591-426f-a84b-60101bc51991", "comment": "Malware payload (Mirai)", "value": "f8be4fceb415c06bd2448ded961d9b47ff60cc44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668876, "uuid": "df161dc1-e708-448b-b0df-efae05c44b6d", "comment": "Malware payload (Mirai)", "value": "97151f2e193a151f1903d5654c821df0288c3168527afde0c3630ae08de7c251b059699f442911fff531f06d34eda726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668876, "uuid": "c898d62b-c4bd-43bb-b26a-8604b28987f6", "value": "T18EE33A56BD81DF11D4C731FAFAAE418933535BB8D3FA71129D206F61238A99B0F76202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668876, "uuid": "9e7e4a94-24e0-47e6-b59c-401659145888", "value": "3072:lWcdoVG2aFftrGbZL0xNj1+RtaCaSffmzC6rceQHzcz8whH:lWVxcftQZL0HOtaCaSffmzFrcpzs8whH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770668876, "uuid": "d22c3d7a-2f67-434b-8774-f4f6dea834c4", "value": 149172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770668876, "uuid": "590b12fd-c7ac-4477-95db-5cde1413ceaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668876, "uuid": "f8f20524-b700-4dd0-a896-8600fe7e7369", "value": "arm7.nigge", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f725f30f-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1770646605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646605, "uuid": "7fc44627-1c5c-4897-98e8-add4011a9951", "comment": "Malware payload (Gh0stRAT)", "value": "10d180bb8d7c1bacf75480eb40d6835a", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Sabsik.EN.A!ml", "colour": "#5D1467", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646605, "uuid": "02a960f0-e757-495e-8109-7bbe94fcb408", "comment": "Malware payload (Gh0stRAT)", "value": "a3e3e8d4e7db5af4f1248478f65d71d9d826a12cb9b48e2d6eebd8227ae13792", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Sabsik.EN.A!ml", "colour": "#5D1467", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646605, "uuid": "3c828a99-4ad8-4bec-bf71-a150e3db6440", "comment": "Malware payload (Gh0stRAT)", "value": "db08bb6bc160be50ad315a8fefcec9472ef346be", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Sabsik.EN.A!ml", "colour": "#5D1467", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646605, "uuid": "1ec75695-118a-4498-a35a-f5021d88b965", "comment": "Malware payload (Gh0stRAT)", "value": "7556509f96807f36bef4844b66930ac17da85d065da5379611a7e0ab9ae6048c3d5b7e25c9ab93d1c351e3480a030453", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Sabsik.EN.A!ml", "colour": "#5D1467", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646605, "uuid": "7c23f3b2-9e8a-4f4f-ae02-0c16e62a0292", "value": "T1FF573321B6CBC232D65E027AAD64FE6E0969BF73033055D7B3E87DAA44B48C15778702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646605, "uuid": "f98bd8a0-4ed6-4474-828f-a3744de3c76e", "value": "786432:PTgJ+QX0T/HKgQVUhNLReZvvw5YZOjQXrItzU:PsJxA/BYZw5YgjKazU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646605, "uuid": "c3a8ee77-c2ad-475b-9ee2-b3e2a31b09a4", "value": 28512256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646605, "uuid": "167e944e-3ec5-47ae-bb71-bb5b753d7047", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646605, "uuid": "69fd2fa8-e3e2-4036-bc8c-82f6222ce623", "value": "111.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3ed1a7-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645327, "uuid": "7f4b2887-ad04-4d65-b0a5-0b0e045cec5b", "comment": "Malware payload", "value": "73c53ad9cbfc6f5f918d25e64381d04c", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645327, "uuid": "22ead549-a1d6-4985-a8ed-546c4baad969", "comment": "Malware payload", "value": "a41cfb8e8b30e955625d7deb62b8dac81a9c25b43ad1a42c267604a073cb8e63", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645327, "uuid": "41a3b343-2026-4670-96bb-4361e4dc8f8a", "comment": "Malware payload", "value": "110f0e8a5124240ee3597e86a4febd13df52afb7", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645327, "uuid": "2c3cb849-6a1e-4553-aa13-4d1a321ef4cb", "comment": "Malware payload", "value": "ff51c3c0f71f33c5fe3b072d1a6fa14e0899d205bc48f584af487b6b1db4d2acab44d5d38bcfa8a0cd44e22f3b7ea46f", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645327, "uuid": "a3d94171-a93c-4d51-ae7b-730f5d4b7beb", "value": "T1C7F26A12768F960870B3464D5AAF02744B6F7A9E0E7E4199008CEB8B8FE3914DD573B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645327, "uuid": "aadcc0a5-7a6b-44ff-a349-e16a2a5028aa", "value": "192:C/ofXggLM/ofXggLOb8V7cuUFC+aoOeErWPNNogiNCNJmig5N9lc3VVzrq3Q3FF/:m8+ud+aoOf+NogiNys+qA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645327, "uuid": "2a13b665-33d0-4d2c-98bd-41c0f6ab93b2", "value": 36884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645327, "uuid": "7942ed0f-e62d-462b-b407-a84b1ca5a17a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645327, "uuid": "916ee9f2-c0d8-4883-ad1d-1e000b51e98e", "value": "a41cfb8e8b30e955625d7deb62b8dac81a9c25b43ad1a42c267604a073cb8e63.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5de40e-05b8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770642452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642452, "uuid": "c099020a-b8bd-4f2a-92ba-59a003868dc7", "comment": "Malware payload", "value": "0d08257a76aa4f14a0425ca210413775", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642452, "uuid": "1551a6c8-8d8e-41b2-bb74-9af8d1a6d279", "comment": "Malware payload", "value": "a4d1844c0a492f4f0095e8f2d0c84e99a6cb2093ce57d750e76f8b3d345d0e7d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642452, "uuid": "e4c82e0f-98ef-4a68-bf8c-e0e6db489df8", "comment": "Malware payload", "value": "c84b96f954fae992ea16c14945e2a9d5e622040a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642452, "uuid": "c7de4677-a2a0-4be7-b5b6-c3cedfd563ce", "comment": "Malware payload", "value": "a31c64fc25b5f48d137fec7ed9b33f7ef4cb530fd056e6fd1a58f514f4ee3e0eb1e388b75cb014fd455098c7e3e84ded", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642452, "uuid": "3f4160d9-134a-4447-a927-42ef39f87b30", "value": "T165B733217A8EC636E25D4073997EEE0E81757C67033041C7A3F4B95EAE319C06A7DB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642452, "uuid": "9113f3c5-4432-4f0a-9aa8-ddf9bfe2322d", "value": "786432:lG1xYlnXB/BZKOBouTXUPtRBF5ZyrUegbB21b4N4E1NfwSJmYS0yOTPapnFenqO8:lG1UXDMl37NIrww1bbE1NJDtyOTPQnq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770642452, "uuid": "a3084a43-4d50-4322-8d8a-4788aa2ac399", "value": 48435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770642452, "uuid": "03fffcc3-aa61-4c14-82d7-0c67ad147769", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642452, "uuid": "a633874d-4ec3-490f-bce6-2c559498ee27", "value": "Dwglq.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98a3bf6-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645240, "uuid": "c364fe21-3a43-491c-9fd1-aace9069a257", "comment": "Malware payload", "value": "cc60b4d716e0561f718c0c563521f449", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645240, "uuid": "80721572-30cb-4f20-9dc7-638b9d59beb5", "comment": "Malware payload", "value": "a675f5a396de1fa732a9d83993884b397f02921bbcf34346fbed32c8f4053064", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645240, "uuid": "2b92d7db-cd29-4a70-8a70-414ef1ea9478", "comment": "Malware payload", "value": "350dd1607d45e08deb0429b4b76415fc19799f69", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645240, "uuid": "fe98e36b-9a07-488a-b9f3-2c79e261a105", "comment": "Malware payload", "value": "9e43c563b5e302668927039271b3797212c330a50891134f4763c77736910744ab9eceb3b91a8a41bd018613cecd4b8e", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645240, "uuid": "a5210b05-62b9-4ee3-8ff1-cd5b341c05c5", "value": "T1AEA32A17764752B1C1984BB5E0E7801403F2D3C7A673CB5B798A134A8D527FACA98BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645240, "uuid": "d6b5fe36-4652-4836-b27e-421ed7b56234", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645240, "uuid": "c504667b-5bd2-43e1-9046-a94df384b6bf", "value": "1536:66pMPjqZNSHl3P0OKkCFJkifVTWfA5JFnO4hjk5Ninp9tj9b3L/13qn:tymZNwdcOKJSf2FnlVp9tRb7/12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645240, "uuid": "0479c4b2-c99b-4293-8a26-6d433058f7d4", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645240, "uuid": "01c5f283-84ee-497a-96a5-55189bcc1772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645240, "uuid": "34103c30-768e-41e5-a7d6-1619bddd9dac", "value": "ClassLibrary3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb145690-05a1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770632788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632788, "uuid": "3c3d711f-c40b-4d5a-a780-dd67c716d818", "comment": "Malware payload (Formbook)", "value": "327f7bd4e1b1042ff8ce39957f5cae24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632788, "uuid": "20af1a0b-8a59-46b9-b387-8e65471cd7b0", "comment": "Malware payload (Formbook)", "value": "a6a721af414a65e45747b0d66bc5b9a4bc98badb8eb2fc234bf8a6bc5841b4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632788, "uuid": "9e1d16d4-20d3-44ac-be57-d84d6665e909", "comment": "Malware payload (Formbook)", "value": "ec4e26c717c2c349b10ff3318a1d3a6f97e21126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632788, "uuid": "47f7712c-9eaa-4a42-8844-bced0c4d63cf", "comment": "Malware payload (Formbook)", "value": "3e9e6bcdab45c1b6c2de4a860d3968091ab40af3f59c6ba81469b9cc142cd7c40a5a02c33fdf92e923d187142e73c008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632788, "uuid": "1cca0a2f-ec83-4ea8-918c-e730e6f25b16", "value": "T12525125922E9DF57CAA92BB55131E33443B08F987562E352DFEABCEF751AB050004393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632788, "uuid": "58e57909-54e0-4222-a06d-e7a074f605ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632788, "uuid": "608332f9-1907-4133-8401-da2116053d9a", "value": "24576:f6V4guQqZEP/GCyczOdHg2eOceuiSWgHlyrznPfV:CVduHTJxgMceudY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632788, "uuid": "2f38393b-485d-40c5-b902-f8ed150373d7", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632788, "uuid": "76360b2a-ebd4-414d-af49-67e5c2fba5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632788, "uuid": "6bd60462-87a9-446c-9373-b474e4b8c298", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f8568-05b7-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770642170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642170, "uuid": "fe72323e-031f-47e5-9d48-082fd6807319", "comment": "Malware payload (NetSupport)", "value": "4e30e4120d648b7fe9f4a258ef9f3937", "object_relation": "md5", "Tag": [ { "name": "chamberopera-net", "colour": "#EE611A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "harpsdesire-net", "colour": "#D39454", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642170, "uuid": "432f88a6-6206-42b9-9032-2f569d23a594", "comment": "Malware payload (NetSupport)", "value": "a76c2d7cb4edef36b1ca82c1740f0ac9106bb9052dffe12c70774eb98fb131e5", "object_relation": "sha256", "Tag": [ { "name": "chamberopera-net", "colour": "#EE611A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "harpsdesire-net", "colour": "#D39454", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642170, "uuid": "5a332052-3efb-4e05-9714-a0549eb14e0d", "comment": "Malware payload (NetSupport)", "value": "352a85846fa1336b5bfa8ee333151d589516b54b", "object_relation": "sha1", "Tag": [ { "name": "chamberopera-net", "colour": "#EE611A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "harpsdesire-net", "colour": "#D39454", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642170, "uuid": "59e593f0-12f5-4d24-9646-ffe2735e7158", "comment": "Malware payload (NetSupport)", "value": "94ce6fc80cebb522dcb76b93789fc483322c2c26232bd42c924c16849e172d524943c366d4522fce02ee5a6f8b3bfc17", "object_relation": "sha3-384", "Tag": [ { "name": "chamberopera-net", "colour": "#EE611A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "harpsdesire-net", "colour": "#D39454", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642170, "uuid": "c368fc6b-2480-4010-9efe-90e9fd0a6ebf", "value": "T1B972D066E8D3CC24F23BF1BC892D1F7595CF6AE60093601F6DB3773354A09238086998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642170, "uuid": "72e2475d-d038-406c-a0a2-da80b1d47019", "value": "384:XuhNKkV+DrRXN6Qtcr7eZ2tqL59CMyUAXTrPNk/I2UaeMRSs:8Kq+JXMwC/oLnCMyUYTrPPOSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770642170, "uuid": "c0c0fc63-deaa-4a9d-9ca1-7269ab5c9159", "value": 17068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770642170, "uuid": "c8ee1910-405c-4883-a14c-7b571a66868c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642170, "uuid": "a68900af-c181-4a38-915c-449271279e6a", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa3f35d-05cd-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770651639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651639, "uuid": "7ca8b4f5-ecfb-496a-95e6-b3db64e27293", "comment": "Malware payload (Formbook)", "value": "17cbc0e301b60d42ee8468faa0dd1231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651639, "uuid": "1da60011-56b4-40a4-bcd7-f0d909733119", "comment": "Malware payload (Formbook)", "value": "a97cf85714df3d50f1d98bffa034efffea9ee380ed9f19a8a0166f9b4258e877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651639, "uuid": "8e92dfae-2b47-47a4-ba41-18e3e7fece0b", "comment": "Malware payload (Formbook)", "value": "e23003d9db912de33bf5b8662395473d85c88b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651639, "uuid": "88238e92-372e-4537-8aab-37062b5f1f37", "comment": "Malware payload (Formbook)", "value": "7c3511312e43839cd7d7e14f15bfbcca2a1f89b6de845049c73ff4549749182b0307b75bf661a11646c506227db6f843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651639, "uuid": "f1bb704e-0b8e-4a75-8705-85e4c7b4cca8", "value": "T1E75423C739416FB2F8902DB263781FCDCEE2D5A66C36683A7026DD7CD025882526B5F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651639, "uuid": "e9b0f3d2-a6e9-400f-8016-cafc31b3c4fc", "value": "6144:AwiZjmH/5JRTQJ29Cbu6Qr9px8JOYj8sm/HeB0WAnelUnI:QZiRJ5q29Cq6QTy0Ik/HeB0VUUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651639, "uuid": "688c6bd4-17c7-434e-996c-b9bc10ccc11d", "value": 283266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651639, "uuid": "5cec87dd-3802-43a8-82f1-76492426245b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651639, "uuid": "c456092c-f730-4d23-b26a-9dc72097b581", "value": "ieAjkmc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92f188f-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770648649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648649, "uuid": "9b40bef9-6513-4571-b159-84b3cfe9d945", "comment": "Malware payload (ConnectWise)", "value": "7820d4b64a44baf3e20a28c29bcfad28", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648649, "uuid": "02c9097d-c3a9-438e-9204-cc50c0901870", "comment": "Malware payload (ConnectWise)", "value": "a9f122e2f212291a1b9b3287b37e29764982c69def60762500e8cb7e4608bf2f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648649, "uuid": "ce3c20ed-2fc8-42e3-911b-47feb79decd7", "comment": "Malware payload (ConnectWise)", "value": "824e29ccd829cd07bf0f32b23ad524c366d8768e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648649, "uuid": "352c846c-e7d8-4e89-aeaa-ca27c519abbc", "comment": "Malware payload (ConnectWise)", "value": "fa1569bc4e2f5ca03d43b68453eca6e748204331b8228c3df693a94783cb77c0e5eaaabcc8f6e3bf0759e62517821d9f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648649, "uuid": "03e03ace-da62-4b4b-a472-67139887a286", "value": "T1DEA6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648649, "uuid": "125dcdff-70fe-4c20-97d7-99c068534975", "value": "196608:6KaLNkbgci4QvKaLNkbgRKaLNkbg7KaLNkbg:MWgciHHWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648649, "uuid": "a6ddb6ce-9c2a-4336-855e-1bc2266b0161", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648649, "uuid": "85b2c658-1ccf-41f3-a509-55f5035af1eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648649, "uuid": "ed90363f-4b77-462d-9cbb-c9d9ce9b0621", "value": "invite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d850b-05bc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770644074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644074, "uuid": "ac464b0f-0061-49d1-a750-fde64aa4b87a", "comment": "Malware payload", "value": "3101f505e41968fa8b40ebc0b59277a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644074, "uuid": "5208dae3-b0b7-44ea-a630-b5bd7aee0867", "comment": "Malware payload", "value": "aa4806b7791a76b4f1dc204a8498982ec15e270d7dc4ded873d832c239ff6621", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644074, "uuid": "0a5b7cf0-a701-4063-8820-381b3ea342eb", "comment": "Malware payload", "value": "ddb80f21c34a37390417d79d34ef112298ff1863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644074, "uuid": "2a58532c-eea2-41ea-902c-0a0a12f229c7", "comment": "Malware payload", "value": "dceb56d8ce41a2be838be6769d63d7f1a59bc2c685d7abf7e62a3fcfc4965057f1cd7d04bdbe8ecefd2c5be132384ca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644074, "uuid": "eb2bc871-f5f8-46c4-9cf4-5e9436b984cf", "value": "T16B955C4BE4D250FCC5DAC0354B2BD963BBB178AD42247E7B2694AA312B63F90631DF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644074, "uuid": "1e28d72b-564d-44a5-9762-5435b4bc412b", "value": "49152:gkSX74zDPu7KxVHOgTtyy7GLAKuk4zX06WOESLAsNFeuLSgPE9NeTt2d:g8DPu7AJOgt5Gnuk4zX06WOESLAsNFe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770644074, "uuid": "25bf4b6f-d793-489c-9c76-3762a67fd0c4", "value": 2046468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770644074, "uuid": "333f3718-24c1-49dd-9c5f-c1986c127b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644074, "uuid": "80d5a0d6-7ae6-41c9-9026-614571e29fa0", "value": "f33.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0943428-0566-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770607483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607483, "uuid": "d17165bc-5599-41ae-981c-e56768f8ba51", "comment": "Malware payload", "value": "11c85bdfcf097918ced4c07c93cb2575", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607483, "uuid": "ccd75910-1227-4fa3-9d3e-c043d6032158", "comment": "Malware payload", "value": "aa51fbc2c5f9fc436069453c024a2056fd005010f578920ae635d93a1aebabd3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607483, "uuid": "0c134910-527f-43e7-a3dd-d3949dc4e794", "comment": "Malware payload", "value": "4a76fca507ba80e43467e3214e0498df697538ca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607483, "uuid": "f7ed260d-b578-4165-856f-b9ec00764e2b", "comment": "Malware payload", "value": "b6cd94e7cbd8fba648ac3394e12bf978c13ab7861a31607e40353748d6c692b407e7dff113ca8348d1fad10e6574c087", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607483, "uuid": "9fe6097f-b849-4b4b-978e-293fd7ef3bb9", "value": "T15A0633BA734AE271C924E5F8D2F146F35BB2F414DEC1B9814AF3B9312B631B1991CA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607483, "uuid": "f451184b-48b2-40ae-9f64-2e85b8173f73", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607483, "uuid": "2f208836-72a1-4ca4-9b49-3d11768bb4fd", "value": "98304:ouIrSjhIG5GXnSxrZI+T+aX6knclHVKICAXSHnsQ:ouIlRnSxlBTl6mm1ncs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770607483, "uuid": "bfc8805f-270d-4508-8ca7-5e26b0befbd9", "value": 3953152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770607483, "uuid": "a3f3ca9e-e768-41d9-be8f-4c0c576aea02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607483, "uuid": "70321cf0-a8e4-4094-ba70-9d63b9142fca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf9745d-0587-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770621463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621463, "uuid": "84c022ff-a033-48c8-a9e5-6d5cd01b03f2", "comment": "Malware payload (PhantomStealer)", "value": "62adfe9698d41c314673ded214708f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621463, "uuid": "fcb8aca4-b404-4468-ac2a-c9e6cc2b5ea7", "comment": "Malware payload (PhantomStealer)", "value": "abf4b038965806a304b371cec0afde2312895ebadc36aba7f037096ad16d66f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621463, "uuid": "cbba60e1-d100-4a57-81c3-1606587cecb4", "comment": "Malware payload (PhantomStealer)", "value": "2bc24fd4ee702fcd4e1f7ca83f160da9c9130c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621463, "uuid": "4afa6ee4-0c2c-489b-96c6-63896c976968", "comment": "Malware payload (PhantomStealer)", "value": "80d56b9dfc5f4b36a1bb14e61774157cc152812587c93025757c57344ea96ada78d9a9d33538518290338e15bca173a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621463, "uuid": "632e760d-b084-47ac-85f6-424cf3c22ee0", "value": "T13C85011523D44B68F87F97386839511087F1B91E9B22EB2EBF8851DA0C25F4EC662773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621463, "uuid": "8f76ac75-d6c0-44a8-8715-b8ae9b9b272b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621463, "uuid": "54443945-bb6f-47de-835d-333e9d273123", "value": "24576:4e/kfd1HK6/XZfSkv3ksjU6UsHMcrE0Jv3oqv5BYg9AxMkD8zfuPf:afd1H7Jt/7xUsHtJv3sxMHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621463, "uuid": "e3cdfb65-8f51-4eff-a0b4-5d9abb105959", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621463, "uuid": "50b4043c-df44-4ec6-b29c-6934af08cf87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621463, "uuid": "5b07c5ca-00b7-4b57-85f7-f66add8a5ad0", "value": "Neue Ordnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6bb855-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645082, "uuid": "9e2ceb86-5698-4b46-a23a-65ed037aefa7", "comment": "Malware payload", "value": "0f4d27039d95f9c16bb864c5b780c2e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645082, "uuid": "35901ad3-6abe-4b37-b99b-e185fce66e58", "comment": "Malware payload", "value": "ac13de80cb14378db72dfce9ceb17de56340b73c1ef3c84865dedf70531e2a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645082, "uuid": "c9f6deb0-48dc-4444-a45f-396d73df40b2", "comment": "Malware payload", "value": "3e32ced74eeb1c09b7c4aeae376f85d35ed05571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645082, "uuid": "3db4bd3b-bbe4-4419-b7d9-864c4180632b", "comment": "Malware payload", "value": "10a64db8475691ac4860e8e6e167761c7e05ece14b6ede77e7a9fde36d9ca2b58366abcae5d201d29dacf75c7417957c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645082, "uuid": "c29fa075-4723-4321-943b-2beed8ec49f0", "value": "T1A4F486696FC32B65C19C0BB849DD635B62803F455A960A3623E4CBD53543B3CFF9A8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645082, "uuid": "430af809-c64f-4d4c-80a1-ca78fef04fc2", "value": "6144:q7pRnZJF9T9+KntREmQ2HCs8HYOE8jdEIZXhmN1Zy5p+ryhM11N1KpmKE/ssP9m9:qXZJFJtREmnHA4O6Zyvh+4pjE/shx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645082, "uuid": "d479368b-e104-4fe7-a6f6-71e57b176204", "value": 783235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645082, "uuid": "8e30f13f-96fa-4a66-9539-11cabd24fe21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645082, "uuid": "b0ddb8a1-c6f9-485a-b5e9-89c9f197c366", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcde9b9a-05f4-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770668519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668519, "uuid": "f7041af0-bb8a-4d2e-bf9a-180e1106fe68", "comment": "Malware payload (Formbook)", "value": "433bf2e2fce1caec352e5fbb6d18f2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668519, "uuid": "6cba7c9b-f19f-423c-887b-53e2b0a107d8", "comment": "Malware payload (Formbook)", "value": "ac36e1a80e5bce46ba7b0810ee10075cb7fd7c8f0e2603048a8a1e6f0adc7266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668519, "uuid": "8e8172a8-44c6-41f3-aa7b-31ba6e1b62f8", "comment": "Malware payload (Formbook)", "value": "0c6e362df7069769123d4a48c4881a049a5c3a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770668519, "uuid": "c285ab9a-8101-47d5-8271-29569fc573a2", "comment": "Malware payload (Formbook)", "value": "c363084f00ebc0a8b3a078e70d7e943a6d7c74454fd0fe3bfe28cc2a1ab77839b29c17dd5941001a1624d629a3102289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668519, "uuid": "10dbb3bb-5520-4d2a-ad1e-cf1821c8db73", "value": "T1DE3522203799CF69D4B223F42431D2715BF8AE2EB122D31ACDC99CDF76AAF405524663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668519, "uuid": "aaf386e6-d339-4a88-8446-f28948e8c252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668519, "uuid": "5a227192-4a32-4cc9-a0a4-ff20cb3af960", "value": "24576:+jguQOpNYtAFAoMLLwWFcwTGP61qBNVict:DuIAmcw861aNQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770668519, "uuid": "a51154f6-4990-4aed-886e-6eb3b28776ee", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770668519, "uuid": "81c5cc06-d2f1-41fa-8ca9-9887e70a654d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770668519, "uuid": "174bb245-651c-4c38-a384-3029c62587e3", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.MUC1.gen.Eldorado.30354.23277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea19f5a-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646645, "uuid": "cec2c6f8-278e-4dc1-9377-cb3218dbdca7", "comment": "Malware payload", "value": "01fe704f1cf903283f945b00d122a08b", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646645, "uuid": "fbb4cb0f-1ee2-4f51-a8d9-da1ee9fa69fc", "comment": "Malware payload", "value": "acd3349a268a15571db5fec11a82844095b9583559b127fff3b8142b56c27443", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646645, "uuid": "28cae052-b843-4fa0-8635-6ee0a57e2bca", "comment": "Malware payload", "value": "ff4cc4c8e0f9c7d577264bd21a7de00a7056002b", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646645, "uuid": "a89139cd-9a96-4fc2-a7d1-4ca92110a46f", "comment": "Malware payload", "value": "2d48c983e11ee371a0e27103daf947c08ee16da06fcc5db2141c5c54e0e1244d49bc8cf7511104390fccf864cdcf6d6b", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646645, "uuid": "27249c2e-8d1a-40cd-872e-36f80e85b843", "value": "T13CC1490057F99B08B6B36F05A9BFA551493BBE6D5E3ADA4C0048C54E17F2A44C8A3F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646645, "uuid": "45a13d30-c0bb-4b9d-ae0c-ca721173b858", "value": "96:KOyEBs5sZ5MfOOtEyFwFiODohsZ59HAZU2AMxdEqARMLHGHAtt+g0jdxvyOU4Pn5:KOyeuf9qFicmU2AMxdE5M/t+RpJPfR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646645, "uuid": "43ea47c4-2044-4ad8-942f-d17fb8f315c3", "value": 5872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646645, "uuid": "92c8cff4-887b-4b3d-a74d-dd023d0e01f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646645, "uuid": "b129aff7-6de1-45a4-807e-2d920b52b171", "value": "acd3349a268a15571db5fec11a82844095b9583559b127fff3b8142b56c27443.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78f9a33-05f2-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770667544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667544, "uuid": "dc552c20-3f7d-4cfb-9a23-f77fdf46fb6b", "comment": "Malware payload (ConnectWise)", "value": "8648ce198874a4d121267ad68efff6fe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667544, "uuid": "ef98428d-d359-485c-8355-1d4955e18041", "comment": "Malware payload (ConnectWise)", "value": "ad6a1a226b2169699b8ec40bc5e8d951a08518a2d9da60ff6fa7d46dfd85093d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667544, "uuid": "ec2eb575-0b56-4ba9-8cbd-c6e9a40840cc", "comment": "Malware payload (ConnectWise)", "value": "dbc404ca7260d62a60e1468bbbec3683d010c26e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667544, "uuid": "8fe2e563-0b6c-48a7-8529-2d53a0a1ce84", "comment": "Malware payload (ConnectWise)", "value": "834edcd8fb8fabdd8c4f8895e531b08d7496b8ea124ff1671a0a2dfc745364635dc2048b850145b7f2ce2bac5fa8a9a0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667544, "uuid": "951e1aef-dc7a-44b0-8680-f80256239796", "value": "T1FFA6231172E58179F1FB0B39FD3A91B16A763C699E63805F1394391E1A72E50CAB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667544, "uuid": "bb7e5d54-dc93-4c7b-88b8-742887345809", "value": "196608:EZJbjFd29NxmUZJbjFd29jZJbjFd29bZJbjFd29:E3b29NwU3b29j3b29b3b29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770667544, "uuid": "6132d78a-af38-4fce-8ef0-a1a28543cfea", "value": 10067968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770667544, "uuid": "60b62b3f-9f66-4313-8abd-57ea2ff2da81", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667544, "uuid": "16dcc0fe-89fb-4d0f-a737-1003d4afde33", "value": "Login.Gov-client.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcc2b2d-0550-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598006, "uuid": "0b6761ba-e3bc-4025-8980-d628a1ae799a", "comment": "Malware payload (Mirai)", "value": "fbc9ebc67726326beef0e3e44b8b564c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598006, "uuid": "e82eb51a-7e5b-4896-bf0e-ec0d39687a11", "comment": "Malware payload (Mirai)", "value": "ada4e72c9a15e66be779e2bc9b70b942ff87da526818fc68157f7f8ebf00c303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598006, "uuid": "8a7f8cba-4231-45ca-a6fc-c7dba78c374c", "comment": "Malware payload (Mirai)", "value": "f1df90448d81783138b184604b3e3051eaa3b538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598006, "uuid": "ab811e54-3450-47bb-bcf9-92dd7696f20f", "comment": "Malware payload (Mirai)", "value": "929de74a46d221fc26c800bdced741f1da0bcfaa0a678ab5682beaf675fd113f5334f21440fd38f6f49d2640980890cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598006, "uuid": "a1f1555a-6e61-40a8-86ea-5115f8cc2973", "value": "T1AF337DBAE81A5E64C08901B074289E751F23E5C893871FF719AAC2799443E9CF915FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598006, "uuid": "09f36e13-bb3c-4a09-b356-abf107608faa", "value": "768:DaLr8IeaMYy4W5GLrqb0WshodCAnBdWBdSK6FAKQ6CAaToE4QKjIVk0CjtKTIueI:DaHH0/f5UA0WfGKQ6C7krFl0CjjRWWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598006, "uuid": "a0086544-193d-44e0-93bc-deb75a06d4ba", "value": 54644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598006, "uuid": "f458b192-bcb6-4208-8137-3eb764a7f067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598006, "uuid": "cc626616-21fa-4c7c-ab3f-4c23794e9c45", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16de7e38-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646659, "uuid": "cff6a206-9776-4440-a3fd-7209204d4554", "comment": "Malware payload", "value": "6e133bfebe8ead1f9fd00621bcb4d1ca", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646659, "uuid": "0d7997b3-5d89-42bf-8f61-bba97b6004d9", "comment": "Malware payload", "value": "af9a2c15908d00870b8465ff0724c5c6d8b9302e3ba1f0460daa06c4272bebb9", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646659, "uuid": "930175b8-2d07-40a6-afc7-83b3a1d156dc", "comment": "Malware payload", "value": "485049d14634062b4a17d830b260371da2af3266", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646659, "uuid": "9f3b4fd4-3d58-4cbb-b500-dccff0af6319", "comment": "Malware payload", "value": "833093beb27d552b730b94afaa9cc5a58d9a3d422c6dca899ddfd14ba3e21d9c16221d67fa7dd5e6ca2e000f77004f16", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646659, "uuid": "2d6b600c-7bad-476d-b92b-a8561253a3cf", "value": "T119C14B005BFA5608B6B36F06A9BFA055493B7A5E5E3ADB4C0049D14E17F2A44C873F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646659, "uuid": "d81ddbc0-b6fa-4e08-ba82-11cd30d16d64", "value": "96:KOyEBs5sZ5MfOOtEyFwFiODohsZ59HAZq82AMxdEO2RepH7HAt6+M80DzvtZUWav:KOyeuf9qFicmT2AMxdEPeO6+sPsjpe4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646659, "uuid": "ebd79a00-359c-4415-ad7f-68066c10f990", "value": 5890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646659, "uuid": "a0279703-97e3-4a1e-996e-357f35af2877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646659, "uuid": "aa41e53c-61e3-4675-97df-02ad4fa314b7", "value": "af9a2c15908d00870b8465ff0724c5c6d8b9302e3ba1f0460daa06c4272bebb9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d742e609-05be-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645263, "uuid": "7c4b4f24-c665-4017-bbe3-5ce32c8fd016", "comment": "Malware payload", "value": "8f2f2b1a5666036ef7be2cd4d42eb281", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645263, "uuid": "7b66d351-09c8-44ad-b59e-054f95eb10ae", "comment": "Malware payload", "value": "affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645263, "uuid": "f4e7b055-d212-4ffb-8671-df17c8f18a7a", "comment": "Malware payload", "value": "5e9280fe941fc73351e802db7165f6bc94957a2c", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645263, "uuid": "9b21fce3-559e-4444-9c12-01e83c0182a2", "comment": "Malware payload", "value": "76037d0e7429a26c5d182ba05874190d6b12dd174a6d0c77b2da10a94d94918f05e102082e7baec6368085f395c6dfa7", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645263, "uuid": "0c6e3524-2431-444d-90ad-c7e4918b2562", "value": "T1CAF3C9DAFE4E85F0D2487B33C4F790011766DEC1AB52E68978CE3F4999E23B74580A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645263, "uuid": "7b1cdaa5-afc3-45e6-9fd4-a8851b2c2df2", "value": "3072:uzWAEDCR+O10TVPGlvwOVDAqQ0xOb1RV:uKTnTuVDAqQXbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645263, "uuid": "9b8bcec1-a8aa-4414-897b-0602b16dd3af", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645263, "uuid": "9ea0b3c7-953c-4c62-810b-83d48fa8c946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645263, "uuid": "462b8237-b726-4eb7-b84d-7fa699f5591e", "value": "Microsoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb80918-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1770632227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632227, "uuid": "c6e67769-c886-4ccc-b029-1989374aa554", "comment": "Malware payload (PhantomStealer)", "value": "9fb66f12f98ff8e8e3ac72aec6da10a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632227, "uuid": "d09cc7b5-30ac-4b60-927f-cc12cdeabe74", "comment": "Malware payload (PhantomStealer)", "value": "b060654929d73fa8d21b8c4838b1a68cd118c789a12aef9362a38bd7676d0dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632227, "uuid": "d285712a-f46a-471b-9eeb-99b81087b14f", "comment": "Malware payload (PhantomStealer)", "value": "2d0c67502f69594a390feb3363fbbad9125bbde0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632227, "uuid": "33d91110-923b-420d-a1fa-d4e8bed60451", "comment": "Malware payload (PhantomStealer)", "value": "1284c493078d13e857209a4373a61e6ad54b253917c72f035e00f9f430899a38439577f359899576b2947b66ca2bffd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632227, "uuid": "9742d73a-0b56-4781-be66-b0b1ee3819b5", "value": "T12285E0027391C066FFAB91734B5AF6115BBC7A260123AA2F13981D79FD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632227, "uuid": "9599ba53-92b7-4301-8e9e-18351cd26416", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632227, "uuid": "b0b7653d-e475-4350-901e-05d4352af435", "value": "24576:N5EmXFtKaL4/oFe5T9yyXYfP1ijXda1J9NZ64x4SDP8mnRyWR2wIHoix8Ra2xZ:NPVt/LZeJbInQRa1/69Sb8mR4Tx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632227, "uuid": "2c2e5372-8709-4256-87e1-532663e050a6", "value": 1723904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632227, "uuid": "858bc468-5396-444d-a4be-1ddd2ff4c840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632227, "uuid": "0d275bf9-6a02-4ab1-9994-d3f7b41799d7", "value": "767421009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dcd6f9-05d5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770655134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655134, "uuid": "34ffc242-22c4-4c8c-bf03-7f7a63b07219", "comment": "Malware payload", "value": "b8de5d42e40b6bead5baf5d2f128503f", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655134, "uuid": "1e2e9bdd-1ec5-492a-9230-ac19ff82540f", "comment": "Malware payload", "value": "b106e30b8b9c96a20f5bfd0608ff24668a1e4c6249e9ab77ef2c53de31337c93", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655134, "uuid": "5bc846fe-ade5-4586-a6e9-dbc6e96794b3", "comment": "Malware payload", "value": "1d8c20408a90fccf08231e4ee89f23febb54f78e", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770655134, "uuid": "bdcf5b5e-1307-48b2-80f5-4eaa8f73f948", "comment": "Malware payload", "value": "9b200718ea58e324dd8e97d172b39b08cf6a1796ce3f9dcb1b698c753664fa645a8540c74c714d36a58db40e592c3186", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655134, "uuid": "278e2f4e-d0c5-4f53-b55e-2f1c7eaa894c", "value": "T185143B7A395302DCEDB3957CC9676541E77D390E0730C9FB429402AA294FBD8EBBA811", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655134, "uuid": "9fd4e020-966a-4d7e-9ee3-32f9cd067836", "value": "49b96d7bb51ec4bfd0e12b472d5dac56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655134, "uuid": "5bbdde89-c3ce-4025-be6b-74b92ad46cde", "value": "1536:RKuFV6mbPDfTjs74PIKusd6TYTDvopxpvcfVdyOoJ46bHhlnBzumrL/2stV3Hzyn:oufTI74y/KvaX0do9uCLrV3Hm3fKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770655134, "uuid": "9f511416-65c0-4817-be7e-152b5c65691d", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770655134, "uuid": "7bc0d10f-be2a-4839-8e5d-bc292dc8c213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770655134, "uuid": "b33fcf39-7d6b-482f-b966-bee3be9e05a8", "value": "b106e30b8b9c96a20f5bfd0608ff24668a1e4c6249e9ab77ef2c53de31337c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42bfad9-05c1-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1770646600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646600, "uuid": "1d7823c1-42ac-44cb-be3b-4959243478df", "comment": "Malware payload (DarkCloud)", "value": "8a392bb04eb3c74e14a5202ade7068b6", "object_relation": "md5", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646600, "uuid": "940cc595-1fe0-4dab-af78-da4d2335f0af", "comment": "Malware payload (DarkCloud)", "value": "b1dea7a2864aea776a8c249abe0896c508f61b772c80d8e44cd8aa22592e0f95", "object_relation": "sha256", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646600, "uuid": "0212f995-e2a1-4258-b8b5-8fc72b0719f7", "comment": "Malware payload (DarkCloud)", "value": "dacc32b2c43df9d95bffba0fb7bc5830d4c81cc3", "object_relation": "sha1", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646600, "uuid": "de9e1a3e-849f-4278-858e-9c410dbb5b0f", "comment": "Malware payload (DarkCloud)", "value": "9578e9ce52229dbe2f5845b3ceb8ae41f9db9aadf7aec89a011207613800e514e05150e0ae7f7a9bef7c77ea0be03459", "object_relation": "sha3-384", "Tag": [ { "name": "corehub-org", "colour": "#371286", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646600, "uuid": "bb0c9a76-36fa-4175-abbe-f3f62241ad3f", "value": "T111F27A12768F9608707242895AAF02744B6F7A9F1E7E418900CCE78B8FE39159D5B7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646600, "uuid": "7ec4e911-7714-4776-9574-09a035c1f16c", "value": "384:ZpQRRgAVDLuuuuuuuuuuuuuuuuulZxjXd+afP3U14LRVp4YbpLM:rxjXdDfPm4LRD4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646600, "uuid": "f5ab8928-d7d3-4ad9-ad5a-1ce7db48a820", "value": 37044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646600, "uuid": "c50d59a6-ad0b-4a7d-aa58-a89a2c96a0c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646600, "uuid": "cbf4668e-449e-40db-aa1a-834d7aaa5a77", "value": "120512202510251503skbmt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf7cb93-0606-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770676222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676222, "uuid": "ad590790-2714-4813-b1fd-eaa0c1d2a487", "comment": "Malware payload (RemcosRAT)", "value": "74d080c27ae9bec6b66cf151f7644ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676222, "uuid": "6a46875e-1777-4e66-acd6-8d543d1221a7", "comment": "Malware payload (RemcosRAT)", "value": "b1e244358b49decdf85bf7c31cf5f37f3f11a3dfb668e4059676f267d74fa0f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676222, "uuid": "a134b504-4aad-4654-a8f2-d4775ce70469", "comment": "Malware payload (RemcosRAT)", "value": "bedcc5c3ea2712cd5c24246ec5ed97a05cdac9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770676222, "uuid": "61f3a6b7-b6ab-41de-9720-288dc9821b80", "comment": "Malware payload (RemcosRAT)", "value": "64203b33e1f152aab02b8d7c19fe3ad16f85223ec7d57b8a80026dbcfa9eee830057203a839f53e89d0d1d8f5f2e8b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676222, "uuid": "fb6653bb-dc28-4878-bdbc-66e6485a475a", "value": "T1B6B49E01B6D2C1B2D57654300D26E775DEBCBD2028369A7BB3DA0D57F970180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676222, "uuid": "26326b4c-c70c-40bc-8fa0-f749f4a71f14", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676222, "uuid": "ce3edcd6-051f-4e46-bd27-4f8a1133c1dc", "value": "12288:86pxxGI8gvGOHJpAbDYGxLhZ+sPZtYmPFN:86pxxx8U+bDYGxLhZtZhPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770676222, "uuid": "c22b28fa-2a65-4775-9774-930eda8bf86a", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770676222, "uuid": "e660f14d-a2ff-417e-8920-b4e3b25efb39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770676222, "uuid": "e04fc93f-90c7-4e00-92be-2454e5a3425c", "value": "74D080C27AE9BEC6B66CF151F7644CA7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02328c69-05cf-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770652207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652207, "uuid": "080c48de-6ee8-46e1-aeba-58a81c121a8a", "comment": "Malware payload (Formbook)", "value": "482a15e9f8f6d5ccdc2d1897368acbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652207, "uuid": "29fb85bc-cdd5-4678-831f-50b206ee0957", "comment": "Malware payload (Formbook)", "value": "b32d05c6d0606ae99980ac52e9acbae681e7c35936abca1aa7bbc66bc25bb0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652207, "uuid": "d50b12af-a1ab-4bc9-bb63-de661464b4d9", "comment": "Malware payload (Formbook)", "value": "6023b8e28f9dd68bf7188da8c4d7489ab30040c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770652207, "uuid": "6246249d-21b0-4cef-822e-f35cb8cdda3a", "comment": "Malware payload (Formbook)", "value": "03a5c7ef39abc269fe06a0b3de04e1bcc37c75918d95c66105005a53ea52fa630f14a37b10623bf815316ccdc8e3d39f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652207, "uuid": "a6287e37-d5aa-49ed-9d90-d1219fc106c9", "value": "T1B91512B032ADDD59C09D27B5B132E37557F59E96E413C32A8EE9BCEF7A2A7804404342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652207, "uuid": "fdc1b9ea-8a0c-495c-a759-93881fa34e81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652207, "uuid": "c040ce78-acd9-4f60-ad21-098065de273d", "value": "24576:5cFguQf8FUuSyBzExr14er4vBstc3A5tDmZNv4:GyuiURSyBgxr14er15tDmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770652207, "uuid": "836ed203-b86c-4f1f-a349-6c692a588ad1", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770652207, "uuid": "94766bbb-255f-4fef-869b-18b40613c4d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770652207, "uuid": "7c5254a1-4e52-4933-8298-8a1eac0fa4d0", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30882984-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645413, "uuid": "48a8a02d-7491-4fe3-9b66-6ac10a7770d9", "comment": "Malware payload", "value": "38062c8ee923234fd54eb818ade2950a", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645413, "uuid": "f634e05c-f1d2-4ec2-94e2-6a15a0179601", "comment": "Malware payload", "value": "b4aa0b8740c4a135b9b3307321a6abbf4c5ee4e402f9e1bf986afb0809ff53b4", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645413, "uuid": "ce64957f-7295-43c4-b026-b5458257672b", "comment": "Malware payload", "value": "6bb35e109ea2c4466a03abe03108912d8b6a1852", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645413, "uuid": "0144c1c5-227b-4eb2-a0d0-1e02b62d323c", "comment": "Malware payload", "value": "aca9d69ebe93e262fc0c47902792e44ba9c32965468c9453623dd01a54ccd22cb475fa5fd1c39e19c5ac55a0fb92c1e0", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "manikandan83-mysynology-net", "colour": "#5B6CB4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645413, "uuid": "c16dcceb-1b4e-4597-ac7b-06202abfc38c", "value": "T1CBC167005BFA5608B6B36F05ADBFA061497B7A6D5E3ADA4C0048D54E03F2A44CCA7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645413, "uuid": "faf16d2e-e279-49fc-bf72-de106e3a7e1b", "value": "96:6yEBs5sZ5MfOOtlyFwFiODZhsZ5eHAZd0AMxdx1qRyVH0HAtR+A0jPvFsJz3ZOuW:6yeufMqFicMd0AMxdxQy7R+xzMhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645413, "uuid": "d43ab52d-e2d3-4892-8c59-b2e0430635f3", "value": 5946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645413, "uuid": "c6d46978-7adf-49d0-8d24-6367ba47dfca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645413, "uuid": "c816000e-7b95-4e2d-af99-a6d4b95a83dc", "value": "b4aa0b8740c4a135b9b3307321a6abbf4c5ee4e402f9e1bf986afb0809ff53b4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25438201-054f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770597291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597291, "uuid": "13bb2751-9e72-41bb-b59c-8a2ecce4fc05", "comment": "Malware payload", "value": "47525f495f92cc156cf2710cafd4240e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597291, "uuid": "7ddbf4bd-69bc-434a-8b2f-cfe1d743c8f1", "comment": "Malware payload", "value": "b5088ceaccbdb5dac27b7753cd45b90bffe5c100c1ecbc6bde91aeae37be9b96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597291, "uuid": "36009092-1953-4017-be2c-f9ab64e088e7", "comment": "Malware payload", "value": "db004c71a7268fe91ef7d6efa2c59d160e12e6c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597291, "uuid": "8dc83a1e-4c0b-4f37-99d0-ed693ed1dbfe", "comment": "Malware payload", "value": "b0fa96799783e76f7082b7bd07f1877c26b031954ddaa963943bcdb2f0977dff790eadc76671d726c8f0cec7a3d90f5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597291, "uuid": "71a776b0-1fad-4ba0-895a-5f6cdf81e36b", "value": "T1BCA484696FC32F55C19C4BB84AED635A52803F8656A6093623D8CBD43543B3CFF5A8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597291, "uuid": "6fec5552-72a2-4f39-8366-a4abaeeba4c8", "value": "6144:q7pRnZJF9T9+KntREmQ2HCs8HYOE8jdEIZXhmN1Zy5p+rF:qXZJFJtREmnHA4O6Zyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597291, "uuid": "da5fa2bb-8989-4f3d-8cf6-2151de9ed7b0", "value": 461743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597291, "uuid": "08433046-0d7c-4196-9041-56c40fe735a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597291, "uuid": "742d963d-d9cc-43d8-a67c-f90b875651e9", "value": "bizy.mpsl64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7890e2d5-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770632220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632220, "uuid": "c16f6abc-7c0c-4ed5-b1f7-8a4b83e5f011", "comment": "Malware payload (SnakeKeylogger)", "value": "4b89a4a18ce3d7768a64dd059a40ec63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632220, "uuid": "35bc39b2-7fdd-4b4c-ae8e-0e2e23fdf81f", "comment": "Malware payload (SnakeKeylogger)", "value": "b59169914f10a914d135c2617eaf75bf9a9eb3816b3d5eadc3f192d817f2698c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632220, "uuid": "f844e6d4-dd6e-40e3-84be-ef36e061f9e2", "comment": "Malware payload (SnakeKeylogger)", "value": "0c05bef74e58c688cc8aa2732c2f475acec2c367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632220, "uuid": "8896d56f-c8c7-4537-9986-98b20a35bd7c", "comment": "Malware payload (SnakeKeylogger)", "value": "81589ec3992c6b91798e40859c98958632c5e43b4cd27d1713f945560fb67f5051b6d2001edd5714c0cc3c516b5b36c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632220, "uuid": "11a4571d-8afa-4628-9b39-c852df044458", "value": "T15035AE0273C1C062FFAB92734B5AF6115ABC79260123E62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632220, "uuid": "7b43b5e0-d644-4305-b2a7-16a95e38f09a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632220, "uuid": "ae50d394-555a-4b2a-a624-624efc3c400a", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdaK2+y0WSA/3x3t:wPVt/LZeJbInQRaK2DR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632220, "uuid": "3231e284-3d09-4a96-8724-3210f87253ab", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632220, "uuid": "b8998d3f-99e5-4364-a89c-f0437e4e4ef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632220, "uuid": "eeb8a013-45b3-4473-a8a5-51fa1bdb24ce", "value": "270212633-041346-sanlccjavap0003-614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0e93ca-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632252, "uuid": "e541702e-f095-4532-b197-f775f2644211", "comment": "Malware payload", "value": "e3a87b5478376298c63953e38d2c139f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632252, "uuid": "48b6da3e-a6dd-49cd-ace9-6ac315782560", "comment": "Malware payload", "value": "b629b44e802266b7c49d569bc8ad02e6cbd7b8cc8988d2dba53610ee2317fad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632252, "uuid": "53bb5eac-12e9-4860-844f-18e4293a4709", "comment": "Malware payload", "value": "e204d0d9a538f709331e0043ec5f8c1f4da73c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632252, "uuid": "e22430f1-dca0-48ba-99e9-6f54d7bdbe75", "comment": "Malware payload", "value": "459f2457113f8d45452ffde0b45214f6583f8069dc10ee06bf74e9ea5b3e474a4a5ec1eed39fe4122c5a7d7501a7fc9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632252, "uuid": "5d295fec-2d16-4016-b8f6-27060220cdbb", "value": "T10E85022523C94B78E97E6B3484FB562083F0B9CAC736D72E95DC60FE0925F599980723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632252, "uuid": "ee6ff343-c0d6-4d58-baa5-4f92b5c8babf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632252, "uuid": "7a70c400-284b-4586-8e39-5f8cadf30d67", "value": "24576:IqY5bM9XFHlRXIeB/eG9B6VjqIkcSAQ962:I1ZMnPB/IV+I7G62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632252, "uuid": "ed200827-207f-4dbe-ac36-2f461dda6385", "value": 1714176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632252, "uuid": "8ec125f0-91de-4035-aa64-e480e3faf74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632252, "uuid": "b8c81b6e-c78e-461d-925f-5bcf36745587", "value": "Teklif Talebi.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b2e57a-05f9-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770670574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670574, "uuid": "f2770449-faa7-46a2-b75c-11d66b46d47f", "comment": "Malware payload (AsyncRAT)", "value": "d3884fbe0e53b14e8d9b296982e2650f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670574, "uuid": "5668092d-ae1b-48ad-91d7-07963ecbc66c", "comment": "Malware payload (AsyncRAT)", "value": "b73602feeec72bb7ee7c20a0eedfd03fc3d1db35d086aad45ed9fa72a601192a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670574, "uuid": "1cf88baf-5ecc-421d-bb79-be3093175c43", "comment": "Malware payload (AsyncRAT)", "value": "bc9136fde70574f43d957e791778b5e7858b0c74", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670574, "uuid": "7ab1c0cb-babe-4ae6-9ff4-7685389cf447", "comment": "Malware payload (AsyncRAT)", "value": "56b473a4bd70bbf21f7ae8efac8dac9a41289be32eb5acf532059a6f062440f6b0ce4ca37c7b3b20655fd7e00f9867c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670574, "uuid": "f66b885a-5650-4afa-b4ab-fd458da5e7ba", "value": "T1BA738C2C37E50026F0FFABB019E53213CA39F7631903C65FA4C9029A5B27A89CD516E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670574, "uuid": "ada0be58-cf71-4ee5-a342-0071a891cc5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670574, "uuid": "c08c5e47-034b-42d4-a4a7-ef3f949fcf85", "value": "1536:ze4NPhI7/0XUmJmDkuv3YEYzC+yrbXG33BGBJ0S6kj6sxwOGMyYtCq:S4N40XUmJmDHv3aYbW3qGS6k5xwObyY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670574, "uuid": "050be7e5-9f7b-4869-ab9d-f97c9bf85e6f", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670574, "uuid": "9ff623a7-63c9-47dc-b2e6-7acc54d7bdb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670574, "uuid": "dd8c7d80-6cec-4324-a85e-9bc3504c2021", "value": "b73602feeec72bb7ee7c20a0eedfd03fc3d1db35d086aad45ed9fa72a601192a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef17a2a-060c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770678482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770678482, "uuid": "ac3cf3d9-ad98-4e9e-9fe2-205ad93e3e80", "comment": "Malware payload (Mirai)", "value": "3508f5a3ff94d3cbdac3c23a090eb86b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770678482, "uuid": "272a8aac-aa60-4188-89bb-5b6eb5ed0310", "comment": "Malware payload (Mirai)", "value": "b834f2cc49bbfa1544f2d9e7c0add3c73ae1e12dced4d5dc21c6df199439a1ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770678482, "uuid": "eea4513a-5d16-4d66-92f7-5c408e448c94", "comment": "Malware payload (Mirai)", "value": "5af790e5a93ca31f7125de9caca3ef5cc6328dc8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770678482, "uuid": "c06c1e96-fbfc-458c-b472-616f6402614a", "comment": "Malware payload (Mirai)", "value": "1e846cc98b76eb3fe001cd30d786cd6db966079d061592faf5c4cebca0e95c31ae886820d3050787c7aeed4ce33f1ceb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770678482, "uuid": "7fd6a350-07b5-4c57-9de7-e07510a492ba", "value": "T1A6310CED5332994F0E28DF8DEA51C45CC226EADF0B2F6FA86994483D40CC95B6111D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770678482, "uuid": "accb3bf8-9aa1-4a53-bf8e-8c385560d080", "value": "48:X3r3j3x3T3w3v3a3rz3n3n3Ah3Aud3sQ3s63Y3Nn3M3VgMT3W63W0/53T373D3A:HbTxj6f0rD334THziN32VgsBdZjLzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770678482, "uuid": "2c078758-4073-4155-ad86-fafa2442654e", "value": 1806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770678482, "uuid": "41d74804-ea6c-4558-a0a4-9fe35ae5ff41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770678482, "uuid": "dfd2d2f7-c01d-44de-abf5-e247a706e2c7", "value": "move", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51bfbbf-05f2-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1770667540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667540, "uuid": "89eedb01-3bca-48a6-9aac-ea0d1508e5b7", "comment": "Malware payload (SimpleHelp)", "value": "32b8d6f8f80d48cf568112a46451c93a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667540, "uuid": "6f35579b-0914-4572-bb42-c269a3e5f72e", "comment": "Malware payload (SimpleHelp)", "value": "b92f4c4d4d7af88e516d785be3e37db47f419f49d22c5f7ec7fc74c24f2c7fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667540, "uuid": "089b076d-cac5-41d4-9ca0-7971af151a26", "comment": "Malware payload (SimpleHelp)", "value": "5f8d9cfcedcca97f78371912fb8914c4244d27c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770667540, "uuid": "ce7d4c17-9e3b-4adc-88af-c823321ee5bf", "comment": "Malware payload (SimpleHelp)", "value": "08d5e9f08798a1e5833adf1560ca33f3b64901227a5830614eb0230fcf67d5a9fece3f92d37cc87fbdfbf432ffd8c5da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667540, "uuid": "76a3e1cb-d1d5-42aa-a444-e01b784dc14b", "value": "T11E87331AF39599FBDE33D0FCC0854447EA9678E54381422717F085EA4E606E98A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667540, "uuid": "11891c43-975d-42b9-b826-0b8405f965a2", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667540, "uuid": "62c32560-b8a5-4f35-9085-bfb23b453d51", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bg:/uRf+nAu2FuQd73XyFeDMnKTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770667540, "uuid": "aa31ae44-25f5-4287-b173-97afe9a84861", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770667540, "uuid": "f47ed66f-8412-40fc-a4d9-d4b496795361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770667540, "uuid": "ac7e16d4-e3f1-4955-8b49-7d5f7bf1cc37", "value": "spinviti!!2856.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1c5746-05f9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770670610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670610, "uuid": "e3faa667-5ced-4590-8d4e-0dcedf67bd31", "comment": "Malware payload", "value": "7b40dca6c923f2a3060128b2b7017d91", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670610, "uuid": "064a07ca-77b5-4855-b1ae-9e174f163244", "comment": "Malware payload", "value": "b93573e3035bdf2ffbfa194808799c0c9cc097faa248cfcc705c9869e6e3d1ab", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670610, "uuid": "05bba89f-3881-40f0-89f4-76205a817f0b", "comment": "Malware payload", "value": "8b171c1c2c5da8171faa841d7e448e25a8fe6e1d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670610, "uuid": "4cafc5f1-8721-434e-9fc3-3bd8f80086c0", "comment": "Malware payload", "value": "c2455a48b9efcf9e5ec886341f3a8355bb4a93d05d577260970788f64875e09c7c907c8aa8424fcac9f218d9738aff41", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670610, "uuid": "71b3e501-1dea-4302-998d-590ff5dc491f", "value": "T10BA6237127E88429F1A75F39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670610, "uuid": "58016026-c6ce-40b1-a1bd-22aa2cb9493d", "value": "196608:PKaLNkbg7i4Q0KaLNkbgRKaLNkbgTKaLNkbg:nWg7iHqWg1WgrWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670610, "uuid": "c8d0da98-3871-4e68-979b-79c2603f747e", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670610, "uuid": "ba9726ce-26ca-4936-9603-dc2f10598598", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670610, "uuid": "08d56fdd-62dd-4a59-bfe6-b29b80e4f7bb", "value": "b93573e3035bdf2ffbfa194808799c0c9cc097faa248cfcc705c9869e6e3d1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da69a7c0-0583-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770619928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619928, "uuid": "812258f7-7331-473a-a113-94e1c3066358", "comment": "Malware payload (PureLogsStealer)", "value": "21fbb6493f9ec39e36dc845946c23c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619928, "uuid": "ae4cc6b0-c69b-4af7-83d9-91a41203050e", "comment": "Malware payload (PureLogsStealer)", "value": "ba353320f1fe870bc4b5da6847b8a86bf689efa4a1f08ad9330362e288a09346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619928, "uuid": "84c9c0df-7923-45b7-89b0-6203dcbebde1", "comment": "Malware payload (PureLogsStealer)", "value": "6fe18d7b3c426fba90bdd94fa7cde8d1271e9bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619928, "uuid": "ceebb4b9-8d3c-47f6-9d66-9bb0d9454752", "comment": "Malware payload (PureLogsStealer)", "value": "8070e138207a05b2bbef7df771afea5a19a8881ef41e9c92a158844cd249a07e1aee2a00af057771b528444e1038b73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619928, "uuid": "76c98b83-ddfe-4dc8-906e-16ab758fd7f9", "value": "T14184233B696A8964C9C798B6CCD7E4F210ACD265A417E6E5BA8F050E31133FEDE4C11C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619928, "uuid": "756ef5a8-bd76-4742-9db8-341c66d21624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619928, "uuid": "d9ae84c4-da8e-4f73-874e-e67dd745f1c3", "value": "6144:1ozOCaBiEe/OgB40jb/4isOidfSKfbXaeWxtZcB0tdHUgiOOuK1OaHkckYocnF:egPXg+2b/D3iJSKz3mtZE0P0l5uK1OI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619928, "uuid": "a8df78ef-30cd-4be8-a509-e6a29c4f003e", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619928, "uuid": "d06a54ba-3b49-4e6b-a5d7-124c288fd901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619928, "uuid": "d7a74ea4-0957-4cfe-b7de-4e64ee0074ce", "value": "21fbb6493f9ec39e36dc845946c23c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e4408c-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645333, "uuid": "31453105-b9d9-4ca2-8dc9-7ded9c299bc8", "comment": "Malware payload", "value": "b6a1e0b1aef05f4f56561ac28f3383af", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645333, "uuid": "d5026546-6795-4539-af0c-01d15ac27392", "comment": "Malware payload", "value": "bb8233b9ba59845746ea78f613138da69dfff3b41f8e99b64070e965d8a7be9f", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645333, "uuid": "631a564f-9f19-41ed-9b93-cb5902ac45f9", "comment": "Malware payload", "value": "4bca94be3427cbc3720d348ef24cc8beb550fb24", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645333, "uuid": "608d9512-c968-4fc2-8c2b-6e4e0824dc2d", "comment": "Malware payload", "value": "5ab4e0e6ac0b9a1a6cc138326f5e8633de835c70e50b07b591115a3140c89da6f76dea26c5f138840c5a5d7ed1b5ec0c", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645333, "uuid": "edf75fa6-7fee-4655-ab3b-3b0be86469ec", "value": "T10FF2AC1272EF950870B3468D4BAF02740B6B7A9F0E7E818945CDEA4A8FE35159C477B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645333, "uuid": "1e049cde-c462-4b91-a38f-6f55bae1a64e", "value": "192:2fI/nwwb4fI/nwwbyd40OROEq/zH5NciUFC+ah4RCrWZNI48egSCNJnNVDiJ5Y6r:KSI+id+ah4M4I48edqVD4ma7/3TzXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645333, "uuid": "b9e56a40-bc21-41e0-88da-a945a0cc39db", "value": 37022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645333, "uuid": "5a3d857f-e7a5-4e5b-aa25-c65cae129765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645333, "uuid": "4ed9fce5-cf46-421d-9429-a4648e263589", "value": "bb8233b9ba59845746ea78f613138da69dfff3b41f8e99b64070e965d8a7be9f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3cdcfc-0574-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770613333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613333, "uuid": "a789b169-387d-448f-9ef6-d47f2ac7f2c7", "comment": "Malware payload (AsyncRAT)", "value": "f15bb069bace0e331f981e55e09b2000", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613333, "uuid": "913d975a-ac16-4721-95dd-feb9cc9adf0c", "comment": "Malware payload (AsyncRAT)", "value": "bba5872983c6d6d41776f3ac59efd6a8e05dd592dc63b6b26d2e8af8a9ceb96f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613333, "uuid": "5e3d0961-77eb-4027-8bce-5f1a07026ec7", "comment": "Malware payload (AsyncRAT)", "value": "5b33b3d94e4007bc2fdfa53f25aea662158cedb8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613333, "uuid": "908d58e1-0864-4ed1-890f-b663ac6a9629", "comment": "Malware payload (AsyncRAT)", "value": "221530db56d0882b2b048beb3f24c94f000559e0a2b2fcb45eab4c6137473dd4e40d48ca02b3568ad97bc52bd59f6866", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613333, "uuid": "3cc2c69f-e324-42dd-949c-1912d88bc780", "value": "T1F6D24A08B3D48561E1FD57B94D7292048775EE4BA963DB9E2FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613333, "uuid": "542223e4-c6d7-4634-b63d-d64a01fcb5ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613333, "uuid": "5474e4a3-14c0-46af-bfaf-9803f2590777", "value": "768:vzCiRXbBJYMgsg/cIRGqo+/Rb7fB/dT0/+:v+iRXFJYMgN1iwRbN/e/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770613333, "uuid": "14a86138-6ed6-4b14-80d5-45ca3e3a5b5a", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770613333, "uuid": "9bf9ef0a-6a59-4559-b2e5-c8262553ec46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613333, "uuid": "41140c13-a863-4a1b-93a6-13f7df2142c7", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6454f4-05ea-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770663826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663826, "uuid": "acab2021-0cf8-43c9-8457-8413508f38e1", "comment": "Malware payload (AsyncRAT)", "value": "ead152233cb6712f2fb1920d08fe13b9", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663826, "uuid": "751e4a44-1b10-4ff0-8a40-b2e1659e7218", "comment": "Malware payload (AsyncRAT)", "value": "bc1f349fc4db55e0ce087a043d3f7708994b65982f00599ddc52cfeaff55edba", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663826, "uuid": "8483a379-501d-403a-ae2a-8ac354bb0e99", "comment": "Malware payload (AsyncRAT)", "value": "31e179c2e6aaa4f0185f280069c094c1e2f6ef72", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663826, "uuid": "f78c078d-60c8-4b3e-b1c1-281d3b146a49", "comment": "Malware payload (AsyncRAT)", "value": "9db07bd1e639ff1c6fbb16a59ec8333eeb5c1b67ffe5649035d44869aecda516698310ecda3652aed18c5e1edff0dab4", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663826, "uuid": "110a2d8b-ffa0-4d2a-9f49-7c7c799a2235", "value": "T1AC334C00F7E9C52AF1BD8B3898F322494679E557BA03DA5D0CC4159B0B13BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663826, "uuid": "7fd7c52b-8f81-41ba-97e1-32b87193e7c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663826, "uuid": "b08b24e3-882e-4eda-bb42-3b11a0ebea3c", "value": "768:PfwStm8MpXwNGQYby2AfoacJahMOCiob2gbOvz+K1uprUn/SgzX2/RcXJYWz+:PHR6u2A7MOCvbpbwq2kYn6mG/RcX1z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770663826, "uuid": "ffcccfe7-2853-4fe2-9f3a-cd84cb89b6b0", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770663826, "uuid": "d14aae30-bdb3-43a1-ba84-9c6b66709547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663826, "uuid": "cd188b96-71ab-445e-9276-4df28ac8a4b4", "value": "bc1f349fc4db55e0ce087a043d3f7708994b65982f00599ddc52cfeaff55edba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b403d0f-05a6-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770634828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634828, "uuid": "5b407eff-df9d-4ec8-a15c-a7dbb013835e", "comment": "Malware payload (PureLogsStealer)", "value": "4cd788254d617fd7bed4fd79c7abac0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634828, "uuid": "845b0388-71ef-4214-b08b-89cb5116fe23", "comment": "Malware payload (PureLogsStealer)", "value": "bcd93ee0b2eae28bc5097daecfad35d2a4cc0944f3eddab9696e02ed40ec6efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634828, "uuid": "de58d7be-c94b-412e-9b3c-c09aca221d3f", "comment": "Malware payload (PureLogsStealer)", "value": "98d96d86d0e855137e25d37582708afb10065c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770634828, "uuid": "55fc493b-2ac9-4cdd-838a-75983bb9b1c0", "comment": "Malware payload (PureLogsStealer)", "value": "b0e214c0417d4b654ffd18650cb12486370a6dc72c18ef9b3e355c9a6d2509f9601798c751d2d94dc2615c3d6419031b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634828, "uuid": "c7e7697f-49c7-45c4-a0e1-9f2e9d07ced8", "value": "T17C45239566DDCE16D1E91BB42562E331E7748D86F003C3568ECBBEEBB93AB014018397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634828, "uuid": "01372020-26a4-44bd-91be-e630a58358e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634828, "uuid": "7b3394fe-1610-4145-b4ab-462ba280291f", "value": "24576:Ks7guQAWldAsllcvFRvX59tIjniCISnacNEvQ4kcs0KAUjzUOEXjMl:fEuQlC+2RvX7CTnacOVs0KZjzDIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770634828, "uuid": "6dc28f7b-636a-4fe2-80af-bd09e540522f", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770634828, "uuid": "7ce78cf6-0fd2-4b48-96a7-b71abd79c11e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770634828, "uuid": "bd4a5e69-480e-4e75-a8dc-05af96548579", "value": "CE-HMB2020034-00SH26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a76bb-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770646678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646678, "uuid": "dbf980c5-b1b5-4369-a91c-3b4d4982ed90", "comment": "Malware payload (XWorm)", "value": "b1d464b3f0951c6371f2804cf7c93a19", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646678, "uuid": "15b71b76-960d-48b3-9d4a-cf89a8a14df9", "comment": "Malware payload (XWorm)", "value": "bdb5a1f4184455b6181f276dbf2a3898bd9645d59ea36e6d153c2e93833ce3ba", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646678, "uuid": "486e2000-51e7-47f1-a4f5-0c6dfa11806d", "comment": "Malware payload (XWorm)", "value": "f71e1153e0ccfa3b5f44b311f522e78827f19071", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646678, "uuid": "222579ea-a119-4d2e-9d09-418e6c3d2d9c", "comment": "Malware payload (XWorm)", "value": "5d6041f74c9c37ffad51b3976932375ba0ef311fa5cb2e4cdd4576af7610296517f0e5d0d232915abe1af53665a7fe00", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646678, "uuid": "faa511a0-ad77-4cb1-807f-fce5204d5aed", "value": "T18DF27B1572DF860870B346894BAB02750B6B7A9F0E7E419D04CDEA8A8FE35119D877F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646678, "uuid": "be68f99b-bfbf-4ce6-bd64-a9636abc87c3", "value": "192:gfI/nwwb4fI/nwwbeXsedFuciUFC+ah4RMrWZNK4bBCWCNJ3XPZuwDbiyPCC/4fR:BedDid+ah4y4K4bBrgPCllv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646678, "uuid": "84d5fd83-95a0-4720-8226-cb8592010ceb", "value": 37158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646678, "uuid": "dbde590a-42a6-42be-9d4f-5c59b5289825", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646678, "uuid": "ecf46307-a3e8-44d0-9f73-8cbb6da18e14", "value": "bdb5a1f4184455b6181f276dbf2a3898bd9645d59ea36e6d153c2e93833ce3ba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a0120f-05da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770656943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656943, "uuid": "78286a5d-19f9-466e-819c-1c2871554e3c", "comment": "Malware payload", "value": "92074f200d8d045c88f4fa941197b68a", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656943, "uuid": "4c2702b6-7a12-478b-ab62-85cada1adc37", "comment": "Malware payload", "value": "bdbe1fa6c7c83a005f898d4017705078e32673bdbffa22da78b15468cba1d4fe", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656943, "uuid": "565d628d-df42-4692-88f1-645409387eef", "comment": "Malware payload", "value": "1653067971420bfd472c071329984fccbe044e2b", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656943, "uuid": "ffb361f0-2024-4121-a7c5-30836fbe1323", "comment": "Malware payload", "value": "ff7033e5384adf1cacd18d6d0d91c7266e88c678f60c7d635a78edfdaa64cadf91c9af4de6296fc1664c02a431525000", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656943, "uuid": "0605485b-5c3c-47a8-aaf8-a614c64fec9d", "value": "T12AC2E18B8F12F7D0C1290BB097F5065C73083431559533778FA586162EDA238AE27AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656943, "uuid": "8964ab3d-8237-439a-afa0-c1070475c6f5", "value": "e1a457c60a2fd9c6200af061a3530ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656943, "uuid": "127c3e0d-35b8-4e36-99d1-559a2012dcd1", "value": "768:+XceFA3cN49UwEBSM35j+rXOE/7S6T2L2r:6cqA359U3Yrein2Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770656943, "uuid": "fb35e3a7-ff5f-4fb6-80e1-031222aca988", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770656943, "uuid": "3342b04e-c992-47c7-8612-a1f4538de762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656943, "uuid": "86877937-5509-4d55-b0d9-786d42cafd3c", "value": "bdbe1fa6c7c83a005f898d4017705078e32673bdbffa22da78b15468cba1d4fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b8c800-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645424, "uuid": "c93bcacc-9a7d-43e8-bd39-96810b1befb4", "comment": "Malware payload", "value": "a7e491669c91616118fde0d64eed8359", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645424, "uuid": "e16fd34a-b3c8-4a2e-b9cb-a0ba42ddfcab", "comment": "Malware payload", "value": "bf36e4d682e7f83a02ae82cb1412752e8c55d9e13c468201a0d2ba16a6b2904d", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645424, "uuid": "40284472-08a0-4d46-b7a0-65d1d49df3e4", "comment": "Malware payload", "value": "761669a1e97aa34e04ebe977f6a6ea07a75d4ce8", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645424, "uuid": "b9fa4c56-cced-403f-baaa-9224a43752d7", "comment": "Malware payload", "value": "a9f4a566ac8f9cc73d31a5f6fa29b034a2e3a4caca20b50492969b92ba36686e2e3c85548b9c611131bb765b164f18a8", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645424, "uuid": "f7b19033-ca05-4595-852f-477174addb44", "value": "T19AC158005BEA9604B6F76B06A9BFA550493F7A6E5E76DA4C0048C58E03F2E14CC67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645424, "uuid": "2058f598-588b-45c2-911d-53424bbeb695", "value": "96:CyEBs5sZ5MfOOtdyFwFiODBhsZ5/HAObmAMxdmrGReCHHHAtWM0jIwv7jIIKZ778:Cyeuf0qFicybmAMxdmCe3WV8Kn0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645424, "uuid": "c8e7dcbc-df04-4d75-b152-064e1edeb3f9", "value": 5884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645424, "uuid": "5e1f9f5f-b3d3-4b4a-bf53-1646cc8f42fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645424, "uuid": "26836fec-ae74-441d-ba7d-cff82b4caed9", "value": "bf36e4d682e7f83a02ae82cb1412752e8c55d9e13c468201a0d2ba16a6b2904d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba499053-0591-11f1-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1770625887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770625887, "uuid": "84b84cf9-cd52-424e-bdc5-863bd6a9aef2", "comment": "Malware payload (SnakeKeylogger)", "value": "17f73eab567f3d322c6ffc55f3c6d83c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770625887, "uuid": "53141771-7f38-482f-a2d5-ad030f443fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "c02c29e0bcd5b9f4110d716846c22e6797083be601b4c4af629b3804ce556d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770625887, "uuid": "e67e4414-7d52-4797-835d-1ac91fc9a45a", "comment": "Malware payload (SnakeKeylogger)", "value": "f7530fd8e3d17c4b05870bfbccd25b7df71d2c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770625887, "uuid": "b7bdcfe3-dd47-4890-a618-31547c246263", "comment": "Malware payload (SnakeKeylogger)", "value": "79c969b069a2d7bb4202837856197ea8b7f317bdaabd00782638066835952a63b76a7397d69e6c4bdcf44cd8c8281552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770625887, "uuid": "b8bd11d2-7fc7-4f83-91e4-98f6b8a1d048", "value": "T1AA2512A4329CCF6AC2862BB9A562E37143B4CC4AF403D755CFDEBDEBB955A510409383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770625887, "uuid": "14ea62cb-b08b-4eb3-bc1e-1ac1028556c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770625887, "uuid": "afd32164-8132-4602-aa99-ec36c438f34e", "value": "24576:BnZguQaUzdAO8j61MQYxmOQfWu8HOAQwN2IIAXfdP5UC1L:9WuNk6g1MJAVWu8uAQ+FV5Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770625887, "uuid": "0c241cc2-6d01-4379-8b2d-d765d4f55344", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770625887, "uuid": "a9ee8214-c053-4f92-9a4e-8fe089b47718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770625887, "uuid": "9057e29e-03d8-4473-ae38-66c223d7673f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.10171.4565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15d8138-0587-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770621577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621577, "uuid": "a847104c-5301-4ea8-8c83-866e3e6e57e0", "comment": "Malware payload (XWorm)", "value": "3b678c12830bf6f6ea738963ef6d4c44", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621577, "uuid": "7661b895-04e3-4188-b86d-f79c9897b969", "comment": "Malware payload (XWorm)", "value": "c083d6e0bdd28c709206b2700e08aed2d25c32d5e329cfca737b26b61328054a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621577, "uuid": "31d2c1ae-286a-49c9-86a0-0fbb79c8962e", "comment": "Malware payload (XWorm)", "value": "e0847ff9045f11a35305b8ff3f60a1c78988efb3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621577, "uuid": "d30e3002-05c4-431e-86b2-57fc110d5d9d", "comment": "Malware payload (XWorm)", "value": "3a56e86ef073417c267ca5f6fec4161c32a645407a450ff94bb950005d37a47fa81a2d62895ece6f82d51c6eb9086d25", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621577, "uuid": "28059d04-c31e-4fd7-8c8e-c4ea3d10c3a6", "value": "T120F1887CC5BAB8C0875B7341B8D6DCC92183D6577E635E5CA9DC06A42B60325EFA81CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621577, "uuid": "db55958c-0f44-47e7-89ec-fadfa38005c4", "value": "192:SFJ2eKDGbOB8pdHDJXSXAfYKWWXpmGkukOU0Q872:SFJ2TfB8hSXmuKpmGPkh0z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621577, "uuid": "af00b8fc-9436-421a-98f3-af6e9359a012", "value": 7730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621577, "uuid": "1cfc62c5-723a-43e1-9988-34a79f626068", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621577, "uuid": "ada399af-a2df-4081-950e-3a57e79f8bfa", "value": "awb_tracking_dhl shipping documents_02_09_2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2450cf6-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598923, "uuid": "9abec213-b84c-4dc0-aee1-bcb0e5edfc06", "comment": "Malware payload (Mirai)", "value": "0b3fa464c63d407f0e8f5b4f7504eee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598923, "uuid": "d3a9f9e9-c1f2-4298-9c45-b44bffe82429", "comment": "Malware payload (Mirai)", "value": "c0be5f74384d403fb6d27ea91df3c568fc37bf90881b0fccd9afa7b86ad74f1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598923, "uuid": "3a70fdcb-de0c-4916-bbd8-844486112ebc", "comment": "Malware payload (Mirai)", "value": "24bb5e13f83a680fd2ecbd4dd52b2ba848c5e7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598923, "uuid": "eb8300b8-ef0e-404b-b939-313789c6438e", "comment": "Malware payload (Mirai)", "value": "6aebe015fcd23ce529aa90083be7050dd61964d5e97b9f7f14ed83b29a6422e3c52438777c776446d8f68dc0a9279c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598923, "uuid": "90c143be-8f4f-4931-8ef7-198219cbe3c0", "value": "T1AA5302F690D43DCCC1599774020B4A473E827779608AA53BB6C4EAA58BF2390CFD8BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598923, "uuid": "3f2de626-c450-41bf-983a-436160839a0f", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAbnLkg4azHJ:CM5az1Fy0oPgdZX6hTo8R0LGazHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598923, "uuid": "7779787f-ec1a-41a4-b660-4d0e8982e4f2", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598923, "uuid": "7cf0170f-e397-4c62-ada6-e133db3fe57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598923, "uuid": "268f3957-0f73-4d18-8f31-29533be241d1", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1405f06-0589-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770622517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622517, "uuid": "2b554388-b936-4aaa-aecf-cebfb65f431e", "comment": "Malware payload", "value": "7ff5f4987c8904bf0cddd9f476bf7637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622517, "uuid": "7ec4f26a-f399-4149-b0c4-217a3110c021", "comment": "Malware payload", "value": "c10cc85116b91de6e65a35f6c06550279fc97550445e4a6bc381dddc44ea657f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622517, "uuid": "a952baf3-5bfa-44f4-ae24-968460b7c5d7", "comment": "Malware payload", "value": "099654577b6ed3220e911c3c83866926a086449c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622517, "uuid": "dfbc06b9-c80f-4547-8a56-fe793a858df6", "comment": "Malware payload", "value": "d00fe78651f67119881b55fbe94ec8da8c5f34bf36967d75e164b9da9c3ceece8123a1b46e6aedbcf4b19a2ddd37f635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622517, "uuid": "df99e4c9-020b-4605-aedd-5f996dabec19", "value": "T1CD459D07B3B500ADD067C1788917571BEBB2B80513349BDB5690CA6A7F23FE1667E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622517, "uuid": "1fb456ba-d59f-4025-8a26-73494c824b4f", "value": "ea1efe4bce615a02b593552b99ce08ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622517, "uuid": "d51072f8-d2b9-479e-acbc-0e5b03ee90de", "value": "24576:stHboaLOuCOQswtRa4SQwz92KZh/NJXG9WfB1LCeb/rff:DZqQsP4SQwBrh/H71LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770622517, "uuid": "7bbaca0b-82eb-4c69-ba0d-d8c13c643107", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770622517, "uuid": "b5857aa0-99ee-4d41-ba53-a9484539c12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622517, "uuid": "91de00fb-c65c-460e-a87c-09fd9aca094b", "value": "SecuriteInfo.com.Trojan.GenericKD.78849754.29342.20420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362b23ab-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1770646711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646711, "uuid": "3b6efb8e-f2f4-4fbe-970b-cba49d9408e5", "comment": "Malware payload (XWorm)", "value": "be6b53b772e922c5ef10ce48102d6c93", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646711, "uuid": "bfcc2dcd-ad15-4c2b-9340-9c3a478b3479", "comment": "Malware payload (XWorm)", "value": "c20ac19b658e82e20a457e9e937d4f95395c34c31f38fc2e3c9066181c711271", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646711, "uuid": "ab427eda-8ca5-4241-be46-082edb493e4f", "comment": "Malware payload (XWorm)", "value": "33f662e7b9f8e369eef92f6a6253e76bef31db5c", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646711, "uuid": "9a7c29c3-a665-4979-97ab-6dfb84623489", "comment": "Malware payload (XWorm)", "value": "629500dce8b44be55703fb61340d0be53ac15a017752ec8d50e8fb2b377da8e7cb9667677d389febc5d5085c26bceba6", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646711, "uuid": "27e9f4c1-94be-4be8-809c-be772a8a1d46", "value": "T1ABC14A0057F59708B6B36B05A9BFA164497F79AD5E3ADA4C0049C54D07F2A44CCA3F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646711, "uuid": "a47c395e-5d9b-4d3b-9992-8e7aa3f087b7", "value": "96:6yEBs5sZ5MfOOtlyFwFiODZhsZ5eHAZZ0AMxdxDQRMLH5HAtq+b0javRtaQuZzfm:6yeufMqFicMZ0AMxdxYMOq+QI8jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646711, "uuid": "23762d40-6aa5-43de-82a0-0384614373bc", "value": 5892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646711, "uuid": "cc1c82aa-4b29-443a-a680-bb36264dad88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646711, "uuid": "11f9f863-3c65-4631-8a75-f56d8f5667d3", "value": "c20ac19b658e82e20a457e9e937d4f95395c34c31f38fc2e3c9066181c711271.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c946af4-05b0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770639045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639045, "uuid": "057db9fd-7ec3-4ca7-9ca7-04813743ef69", "comment": "Malware payload", "value": "7d896fc8f7192704f7854fa9c9dc3071", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639045, "uuid": "0bc8babe-d925-4550-b67b-dadfb7a141be", "comment": "Malware payload", "value": "c2a0f0bc0e9863634eb7c817c7390add3c7211746036c3d3483b7652d84f6489", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639045, "uuid": "0641121b-e811-4de2-8a0f-f60118eed44b", "comment": "Malware payload", "value": "7f3b38690b550e2bf0a97476cc94a0f82f23e93c", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770639045, "uuid": "351ae6c3-ff2a-4933-b959-676409646d0f", "comment": "Malware payload", "value": "b8e9b03caed3305654f56078713cc184b0bd65ecda892da32244d10c0b77939741c4aeac7958b399624878d38d97b501", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639045, "uuid": "2ffa6945-d331-4e89-8d31-30f64a1d053d", "value": "T160A4F8376E296D84DF941FFF8635D5A28CD9E9C390A5C4E0BC400901BEE9BD4F9186A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639045, "uuid": "1173cf39-7de1-4a71-8435-4fce8792b5ab", "value": "6144:ylPg2KD6e0ReDfZxMl2tgVSrCzVWkWn46WVL:IPg2a7009SggV9g47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770639045, "uuid": "cb56ee8b-74c4-44dd-bde0-3c294ba37606", "value": 458259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770639045, "uuid": "b2b5dc83-146d-4b33-b0bc-95317cc5d3fb", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770639045, "uuid": "35e4db76-61f3-4279-9401-876f763fab40", "value": "Installer.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365845c7-05c4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647570, "uuid": "054d32f4-7f6a-4ddd-85ca-7e2195416641", "comment": "Malware payload", "value": "855ecaaa5a5bcc88b657408f792f4865", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647570, "uuid": "98305c64-7ec8-44ac-b871-64effc7778af", "comment": "Malware payload", "value": "c42ae6e4598a746b1c3caac78da9304c9a04ff0c4f1cf7e6749e0d993bb23701", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647570, "uuid": "159cf946-8cda-4b34-85bc-33c2d2426155", "comment": "Malware payload", "value": "4dadc0eba871aa03b04bb6357ecc81bab27c331c", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647570, "uuid": "6084bfba-22c8-4ddf-831a-0292ca9d2bd3", "comment": "Malware payload", "value": "80bbe42eceae0653479fa8803907b13457ea3604c544eab510a0d84ea6ae6edeae78b731c4d6f35b207526357a05d609", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647570, "uuid": "8a3dea48-7a3a-44ea-a622-fca7abd1f4d4", "value": "T10CC169105BFA5608B6B36F05ADBFA051497B7A6D5E3ADA4C0048D54E03F2A44CC67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647570, "uuid": "5ba64a87-90b7-4fab-ab76-0ca8cf70c438", "value": "96:6yEBs5sZ5MfOOtlyFwFiODZhsZ5eHAZd0AMxdx1qRyVH0HAtR+A0jPvFsJz3ZOuE:6yeufMqFicMd0AMxdxQy7R+xzKhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647570, "uuid": "985e1485-5ada-4f01-ad9e-fe8d4a313770", "value": 5868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647570, "uuid": "28153110-b469-4eb2-a841-94089d3540d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647570, "uuid": "c607f432-1a97-4f91-8c6f-671ab106c378", "value": "TYzoX.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da36b598-05ef-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770666314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770666314, "uuid": "4717591c-a7c3-4d59-9ec5-d6d41d1a25e2", "comment": "Malware payload (njrat)", "value": "9b10a549fe0e05cec1acd3ba55ea514c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770666314, "uuid": "a718b05d-5023-4ac0-b557-7c661701c793", "comment": "Malware payload (njrat)", "value": "c57c030654ed282e9a79d9e94d4c75def4c66333e39dae059580e68ab1bdad94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770666314, "uuid": "80262976-7a7c-4994-9f26-a98a2b1958ee", "comment": "Malware payload (njrat)", "value": "aa93d3b577adda3a5a2ff2bf39368b368bc0aaea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770666314, "uuid": "ea50739f-5b6b-4f43-90c3-0c27a1064104", "comment": "Malware payload (njrat)", "value": "331a4df6bb483779f6744b7f8534b4a09bf8a12d8422908eb7df1aaa7538621c3cd9273012aa508dfafafe0e293084a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770666314, "uuid": "c81a61dc-6e53-4aee-bcb7-30b2e3c52789", "value": "T1A425C091B7F4850BE1FF1B75E4B149494BB7B952AA36DB4F0894A0AD1EB3740CE003A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770666314, "uuid": "1f26db77-1e40-4085-b54c-c6db8565ed18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770666314, "uuid": "b313a076-ba1c-478d-895c-d5828e5a9aa4", "value": "24576:ZF/pbxJzck+uGW/yFoBkkAQd/qKtzno5cayo:ZF/pbTYjqqanTQKdipy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770666314, "uuid": "4fa84dd8-85bf-4ca2-9935-aa0bebf2f29e", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770666314, "uuid": "2aaa7f02-f7fe-4176-bbc4-a44b40540591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770666314, "uuid": "d4b0a13a-9204-4a33-aa12-a4c37c134ef5", "value": "c57c030654ed282e9a79d9e94d4c75def4c66333e39dae059580e68ab1bdad94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac78d7b-0556-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600521, "uuid": "72a9cce9-d296-403b-9d0a-0af3c8fc75a0", "comment": "Malware payload (Mirai)", "value": "cb3a73ab23b12d8588c12018da482cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600521, "uuid": "6759e09e-c955-4ab4-856e-2478a397e459", "comment": "Malware payload (Mirai)", "value": "c662e731d8a0c0f92bf4c006493f17e77d7150e1f790be521450a6915e0c6fe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600521, "uuid": "cbcee768-a672-4412-aa9d-2e2bd3e3ba87", "comment": "Malware payload (Mirai)", "value": "0f274cc4094d8b84937d5939d8aecae5352db9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600521, "uuid": "1c64c9e0-4f14-493d-a339-fd90d295894a", "comment": "Malware payload (Mirai)", "value": "344be2a653e88a86d517eb7389c8fb6719255dd8c81345b2a6f87a954cd9e3fe43b0d8dc4f66d28e2d0dca72f3762ae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600521, "uuid": "e6faa055-21dd-4044-ba15-be5f8417b4dc", "value": "T154536DC5E243D8F2E81A1530603AE77B9E72D49E2169FA86C778D571FCD2641A133D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600521, "uuid": "ca2b89d4-f852-472f-a250-955ed73be27e", "value": "1536:/CrsTU3gDZnco5lzoe7N2x6hMiFnXGosxQGrRD4qd:6rsT0gD5cszoe7N2x6eit2hiold", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600521, "uuid": "1162a9cd-ed04-4715-8583-aa9f6e55fe09", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600521, "uuid": "0e4c83f3-460c-4e87-bd2c-ed4b27939b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600521, "uuid": "0a329f71-34f3-4ba7-9b80-ecbfa5ea6c18", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0c4dfc-05c9-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770649835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649835, "uuid": "4498d2dd-024c-486d-b825-f753fa1d1df1", "comment": "Malware payload (Stealc)", "value": "1c092a8eb30f3c606c6271d250bbcd60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649835, "uuid": "809a5733-6743-4c5b-a665-54e8d247578e", "comment": "Malware payload (Stealc)", "value": "c69ff8d9dc55e9ea03bd12ba21d07e0a5f251e44d79a0d1282aec507b8a78e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649835, "uuid": "1e4bf72f-2b65-4c45-b65c-c27bd8df47cd", "comment": "Malware payload (Stealc)", "value": "a7653b515471ccf0a03ba1cf76049ba477cc0c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649835, "uuid": "e313108e-1eed-463c-b146-68f8f1b62dbd", "comment": "Malware payload (Stealc)", "value": "8732c1b0be7ec6f982038e5a3ca77d3e2eaa6a1a2e6e790a97bebd6574c48e0fff0d9644aa389a82e04b0a1b27deb9b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649835, "uuid": "5d0f4e14-f6e3-4572-8cb0-9b849cc51c95", "value": "T1B4234A05C6149EB2C67F53319C87981597A46B216B352A0EB0CD6E9E3FB5361CFC02FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649835, "uuid": "cd1e7704-f1db-458d-a329-f5c590c60e4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649835, "uuid": "c205ba6c-2174-45fe-905e-a61102a854b6", "value": "768:uoyGst+PMAcgEKrjJSP2Ew3Nfy+hw+QKOq9j0nLrLBSMB7:CXxKrjJSP2EwdK+h3VJ9jdMB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770649835, "uuid": "288997f7-8998-4e32-80df-8836d5851bb1", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770649835, "uuid": "8fc6ed35-3bb8-4559-937e-fe40efb4cb17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649835, "uuid": "79db6b20-326f-4817-a8c6-7bb1267db566", "value": "1C092A8EB30F3C606C6271D250BBCD60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4051b85e-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597336, "uuid": "1dd3737b-e515-4a87-841f-d10d8583e214", "comment": "Malware payload (Mirai)", "value": "fcfbac97b40e78c50e24962bb2284bc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597336, "uuid": "17108136-d0bb-4495-8651-a529256cfe24", "comment": "Malware payload (Mirai)", "value": "c725efce3435c8f2cfb950c5b81e948ee4e2fff75725bbc980e2c03e34fccbc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597336, "uuid": "40a8da3b-8e63-4281-a6e1-388b14ad8529", "comment": "Malware payload (Mirai)", "value": "b1a3e5483a0bbae3c7f825dad8a734e1ca15bf93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597336, "uuid": "70c70afc-f209-4593-945c-b6e072d3ab96", "comment": "Malware payload (Mirai)", "value": "793160353e24dfedccaa10efe9881832739c01a4246354640bc3f62c8c5e324b4f02ced2658b01041b78671e25e98742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597336, "uuid": "c6f0e8c5-2d48-40cc-9e4e-9090795a07e5", "value": "T18AF34B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597336, "uuid": "ae24596b-59d9-4fbf-8dac-e022d65a939b", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHOfam:9FJMgWPZr8IaCWReS1WpPe/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597336, "uuid": "7284882b-55dc-4910-83eb-39d473bdecc8", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597336, "uuid": "93db83b5-f42e-451a-a4a4-ff60e7ad7c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597336, "uuid": "21593738-b160-48c3-908d-9d354ab0280a", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a191f47e-05b3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770640449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640449, "uuid": "bd6fcc51-3ff5-4382-81b6-aa7a8bcaec24", "comment": "Malware payload", "value": "b603e057725908da30d3fe3eb9227c61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640449, "uuid": "a5727c1f-f0ec-4065-b77a-cd2c94c07e94", "comment": "Malware payload", "value": "c7999c2abaf0f4ba610d9672ed0266d4164ba217ed994322c28a5c53840c6e13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640449, "uuid": "b13155cd-fedf-4b9e-800f-72e11aa50bf0", "comment": "Malware payload", "value": "a883801adb8418e56e510510ee540214320b51f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770640449, "uuid": "45379092-8dd6-4d92-bf25-5607b7d96654", "comment": "Malware payload", "value": "c65dc7f63a49d8da5fe9667d74d95684092e9f26976273329c2f4ac25fdd5e70b1db828e83ba7210605e81590841923b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640449, "uuid": "81781eda-8062-46e3-9bd1-182419132f51", "value": "T159313B8F61B10A4285C8CE4171E189CABB06E5DCB1E6C63AFC530F768D89D643219EB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640449, "uuid": "2a055bec-1f05-4cc4-bf09-a1fc46c354cf", "value": "24:BDdkG1WLeBM/hOR1blZ2wG6fwo76gKfJJ4nH9:wG1WjPo76c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770640449, "uuid": "ba17f355-eb61-417c-ac47-a03bec552ab2", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770640449, "uuid": "25614540-25c8-424c-829f-e2ed40767474", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770640449, "uuid": "5e7f85ea-b20a-4611-9df4-12a08c5d8f47", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f4bfaa-05c7-11f1-a129-42010a9c0007", "comment": "Malware payload (SystemBC)", "timestamp": 1770648910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648910, "uuid": "c0d811b0-ef6c-4409-b21d-41d3cace917c", "comment": "Malware payload (SystemBC)", "value": "1332dcf34d2270deeb8575e69a3215d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648910, "uuid": "e6841f09-0efd-4421-9537-1904afd5581c", "comment": "Malware payload (SystemBC)", "value": "c80102440da5b70221b649b0fbd320606ae365dfaba015c86fb0fc67a391781a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648910, "uuid": "bed9bdcc-3025-4b9d-834e-4e8143fe6cf5", "comment": "Malware payload (SystemBC)", "value": "6b1cf38ee9d528697a9cc2df180eedc8be581e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648910, "uuid": "371091f5-8a36-4993-818d-a19a8abb67d6", "comment": "Malware payload (SystemBC)", "value": "fdb5ec8ee401e3324d906b684d99581c2e29436db49fc4dde7b7f6c075c5e71acfecdf8e2245659b9aafbcd24dd82c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648910, "uuid": "e3a61584-7ded-4eb8-96bd-dd1559ec4d65", "value": "T1E072F9A7386188A9C411CAF43E6FA660D47D747652349039EFE04E18377EAE3E712B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648910, "uuid": "69546608-f919-4636-9c3d-d2a29704d6e4", "value": "b83b4c7be0b1cdd8e117bba9096d9768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648910, "uuid": "43d4fed7-8bdf-46cd-ad81-fbd4d1d3a1d6", "value": "384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648910, "uuid": "f81f9cb7-7876-4c79-8061-4c10e3e3621a", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648910, "uuid": "1bb4f271-1926-4f23-b7c3-0cf7298f52da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648910, "uuid": "a1959222-5df5-419b-aa4a-3b965d7a5c6d", "value": "1332DCF34D2270DEEB8575E69A3215D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9493d8a7-05db-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770657607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657607, "uuid": "4806ddd3-24d9-4660-a1ee-82d0bb35701b", "comment": "Malware payload (AsyncRAT)", "value": "49a07aeee1b84c9961ab45aadafa0745", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657607, "uuid": "30a2f195-33c2-4788-b6f6-472cdcaa8067", "comment": "Malware payload (AsyncRAT)", "value": "c8599fd8e72fa8bc85f32a78ce7d5550a9211855d9e40479a50b7ecdfd105096", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657607, "uuid": "6d68fd09-9a56-4078-9d7a-b0206030b806", "comment": "Malware payload (AsyncRAT)", "value": "7a61b53285f271ba790fd8f7cdf5c262d2071e25", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657607, "uuid": "540a7176-693c-4b6c-b5f3-ce2ff5d5231b", "comment": "Malware payload (AsyncRAT)", "value": "86d31ee8bffb51d17cf6e0a813510d527f999b95a39b7ed578aa29fd484f2d0501be952f87a32138b768b84412553ec5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "saudedocorpo-org", "colour": "#316538", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657607, "uuid": "783df274-348d-4fb0-b55f-694ca8d2e63c", "value": "T1CEE22B4877D44322DAEEAFB52DF261061270D517E923EF6E0CE485EA2B67AC047407E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657607, "uuid": "03332508-aebc-405f-a7e6-cd3b27e7fef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657607, "uuid": "1a71b0ee-46fc-4f68-aa62-f28325a8acfa", "value": "384:DPmNYo85DCeup3fEhjLuwt3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisIVFxOL:bA8wlaPBt3Tw49FzVFE9jROjhwbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657607, "uuid": "0c4c2b57-9868-467f-8c21-948eed0d1a1d", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657607, "uuid": "1a8170ec-75d9-42c0-be5c-11967970bf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657607, "uuid": "76799bbc-8835-48e3-abc3-1502f43de81f", "value": "c8599fd8e72fa8bc85f32a78ce7d5550a9211855d9e40479a50b7ecdfd105096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7365378d-0582-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770619326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619326, "uuid": "7343559e-aae8-42f6-aa1e-b396f0d1d8a0", "comment": "Malware payload (Mirai)", "value": "1699e90dc91f5ac6148ad6093780a56d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619326, "uuid": "9c7ca975-bd5e-411f-8617-77652cef719c", "comment": "Malware payload (Mirai)", "value": "c8a5efb9d93cafa0c5eb419aa1e5cb954bf77cb1a8b708ff46b0776334d48fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619326, "uuid": "8485f549-1d84-4aca-a61c-3f3c0483a7d4", "comment": "Malware payload (Mirai)", "value": "b203e3434411dea73e6a2cea3a4e6eb2fd2d16ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619326, "uuid": "9dc39eda-a598-4502-ac8f-8529b54e39dd", "comment": "Malware payload (Mirai)", "value": "fbd93729f5709020405654a7b2db1bbaebc435898e353bf2f538ebc094f45ed762e795b89883c2cc6d1862efe37b8756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619326, "uuid": "43bb6d82-776c-44d6-8af5-0338a8cfb5e9", "value": "T123158DD8EBC6E4E1F16300F1025EDBF61678A12A5013FAF6FF45266370727616F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619326, "uuid": "ef4e7dd6-1da9-47c2-9a0b-840db9cb5cb0", "value": "12288:P3c342l5d2GhqIhz1+Vh9Qqw3Cglf960mkE1Brt09PyI/vlUpV+Lug:E342XdnhqIhGh95wvJ0rkEF0ptUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619326, "uuid": "c1109fc6-2890-4229-a14d-d3c231d5f58e", "value": 899096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619326, "uuid": "027ab3d9-3294-4525-a04f-df5ad43d5588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619326, "uuid": "3287cdc3-c4c8-4b84-871d-d969018bb032", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4414004f-0588-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770621824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621824, "uuid": "e9827626-4842-4ae5-bb38-b9fbe2de161a", "comment": "Malware payload (Formbook)", "value": "e3acc361a9859297cb5e5fe3c533846e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621824, "uuid": "e2c05b4e-a01e-4999-b73f-16dbec1a100c", "comment": "Malware payload (Formbook)", "value": "c8f6c1c71ed253a570fd27eeb3cbdb611fc246003f3c5bbea7a925e1f3ecfb3f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621824, "uuid": "0b13a919-519a-4b8b-b05d-95415f97fd0f", "comment": "Malware payload (Formbook)", "value": "86652ae8de71a431aba64fd7763e384abac2cae6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621824, "uuid": "74403238-2387-4e48-a6dc-8a3aee5a6947", "comment": "Malware payload (Formbook)", "value": "ab164db8ad6b8b9766d120bf219496fd061bf84b8ec0ba4549e9ae0ac5c273b4beb6cd387918b03ab2ed12ed45bdd111", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621824, "uuid": "f08b363d-77cc-4bfc-bb6b-1f9523ce50ea", "value": "T1E60512928ACE346CFFE5467963BD05F661DE82628EA90F0D5E49F51031632BD89F301E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621824, "uuid": "db6a8e95-f1b0-4cef-b06c-14f8875de9fc", "value": "24576:b2gdrFt1JRa1A7XOcEAlI7V+yAGrGqzQAB4vVbNmkPW9aj5WA:zxtfU0+cEAOvA+GwivVRjPj5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621824, "uuid": "d627f8a6-7bfb-4c5d-864d-6cc3aea4792d", "value": 858649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621824, "uuid": "d86d40cd-0400-4581-9200-410ec3dc067b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621824, "uuid": "e28ea944-7b78-43f5-93d0-932b68e65533", "value": "CIXXXPLXdoc_02092026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be22d7c-05c0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645969, "uuid": "c470eab7-c5f3-49b1-98af-4cdd0d1f6bd8", "comment": "Malware payload", "value": "0f8576a71e21a3eb0489c63b96adcd04", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645969, "uuid": "2e839acc-69df-42dc-87b2-d73a5b6e674b", "comment": "Malware payload", "value": "ca6a5f4df6d679ca7f465eaea20660f69e946c4d215b34b270891afac5833f08", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645969, "uuid": "20ba8fc8-5034-4228-a151-54264169544e", "comment": "Malware payload", "value": "b9b0250edd564cd9f0934abeaaecbc8aa365211a", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645969, "uuid": "b6f46a6b-3d68-4e77-a5eb-4e532ea899d0", "comment": "Malware payload", "value": "a5cc31eb7004dc7bc10c9f58824bb1090d95475cb9051bc2db3e8242cf5c286598e79dc36d15854345e086bb701de9db", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645969, "uuid": "44a30af5-1ecd-4b1d-9c2c-b55c900d4038", "value": "T154A1420763D72FFBAA4A4DE95398620724F6C0BB38127A7DF7E51593742AA41BC31234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645969, "uuid": "c6b4bf77-6334-447d-9b37-76871bb08713", "value": "48:KzEphUL05GS0K1yGSa7jGSaaZK1yGSapz5ZGSaaq5K67iDGSatDRGSaai:Ki+1c8ocfe35JsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645969, "uuid": "9d862681-4514-448a-9b08-ee972a3aaa8f", "value": 4886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645969, "uuid": "90735b23-7ff8-4b45-8230-dbbdfd4c1f33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645969, "uuid": "99418b8a-3d32-433b-b894-fb0ce949f503", "value": "captcha@142.93.242.144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a6acfd-05d9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770656718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656718, "uuid": "dc520a0c-0694-4b24-927a-f9687d66eab6", "comment": "Malware payload", "value": "f2e996919c60e667d9cacfe7176b151f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656718, "uuid": "49e44854-6aee-4c73-bf54-0b309e9547f8", "comment": "Malware payload", "value": "ca85b0ffb95595de78a0c40da168cdf42a7d31599ed9d89a31dbadcc161de2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656718, "uuid": "dcc8c1b4-7f8f-45ce-a448-e7e18e1d0374", "comment": "Malware payload", "value": "bc91b3f3a255111d052380d7c684ca99c7321fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770656718, "uuid": "80f13f52-275f-4821-907d-a50dcf9479bb", "comment": "Malware payload", "value": "bda7d8ac25ee57a84dcc66ac4aa7b3d849e4a1f0b399dcb503e1a655b82049f4eb97e750d1aab4c832d29182a86be6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656718, "uuid": "edcdc38a-7c40-4bf9-84f1-f317aac4792f", "value": "T167B302AAEBECD9ADEBDF837F1811BC6D9C40821E5249D00F6DF815F625823E96247311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656718, "uuid": "9f8b4ae1-ebf4-4f36-b4b0-11ef5b5f86ac", "value": "3072:1N3NQhHvjCz309bq0arVFALSEns5Yoout:15GHvjH9e0Yyrns5HoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770656718, "uuid": "afe6d2fd-1583-4061-835d-bc0be6b8f594", "value": 111692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770656718, "uuid": "82392bf2-dbd6-402c-b3d6-cbd3d4f6fef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770656718, "uuid": "de3c7dbb-128b-4e98-b98c-583e76a00df0", "value": "optipng.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5339b41d-0588-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770621849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621849, "uuid": "89b4a2c6-2810-41c0-a9c1-5471f553a158", "comment": "Malware payload (Mirai)", "value": "f73ab4778ae29f61deb4cd023939820b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621849, "uuid": "e64096c7-febb-406b-96b6-86aa12953485", "comment": "Malware payload (Mirai)", "value": "ca86fd7d3e5d4c490b199b0e33b37dbb4c0351d1a7dd04d2eb34130084f18f1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621849, "uuid": "d05f3a44-8bbd-493e-93d9-0db93a26d785", "comment": "Malware payload (Mirai)", "value": "029afd9ed54d746dde679d0cbb3d6bf3844b1542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621849, "uuid": "9ca531c7-bdd3-4ca2-96c3-6c2e892b3cba", "comment": "Malware payload (Mirai)", "value": "ca7a3b19ec852ce0f9bcf57160273285a8d9a06e8ec236d09d814b3e9c44f9e8c96ccce3764dfe34eab9d59627de583e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621849, "uuid": "21758489-5a13-4586-a8ce-94a401ea9a3e", "value": "T150056C5BB2A374FDC057D43443ABCAB2A935B43502226E7B65C8D6303E26E701B1DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621849, "uuid": "113cc6f9-ba12-4486-af7c-bcdaa3c99b5e", "value": "12288:ws0ciNb0u9i84saoD/3kt8L2xxrvzqvtOdtc0/BF355OOqdzuFE1Jyk5YypkzXHX:wsi5d4stkt8KP7qVOdtNT5gky+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621849, "uuid": "59dafb78-f859-4eef-9fb6-66490a67dedb", "value": 870920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621849, "uuid": "103cfa06-c1fb-47fc-8574-a478bfbae6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621849, "uuid": "a5b70074-64ed-4686-97d9-d3b5be2182ee", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc871e42-0586-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770621167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621167, "uuid": "f141007b-05dd-4b00-8a9f-25ad1e4f7f58", "comment": "Malware payload (Mirai)", "value": "c2e457868d07e45653490b9f6825c86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621167, "uuid": "a4746a67-0e3e-4170-bdc6-0643460c064b", "comment": "Malware payload (Mirai)", "value": "ce4fd8ac566ad9cd8391155a9a93618f9308e63c576bd7978f9a33eca395c397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621167, "uuid": "d8c788f7-76f2-42fb-b0cd-64a64ed101ed", "comment": "Malware payload (Mirai)", "value": "15f83eb6ac89d99acb0d018f19a399533dc46854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621167, "uuid": "b3214e4d-c6fb-4dd1-9ad2-73ea3f1cc1b8", "comment": "Malware payload (Mirai)", "value": "3e4c10238b5fca818b5a9727d904ad9cc420584cd61b46db6e3fd3ce11851534495d0da95df381de9f10c63188524bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621167, "uuid": "5dd8dbf2-433e-408f-ba26-440e21d2f749", "value": "T16CE46D9DFE4E3C42E2D7E3789E4987E1731771E4D32391A33982434CD5CA9E98BA1522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621167, "uuid": "e0c67e48-3249-43f6-a31f-5aedb871a8ba", "value": "12288:85Ghgds/Y4sshMLMREzkMJsvAjHO1anFQSNWpG6JuKHw5dzUUgRxy:85Ghgds/RsshkhavAju1UFBwMtI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621167, "uuid": "e29d0431-6370-4cca-856e-ba9162107c6e", "value": 665664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621167, "uuid": "fd60553c-3b14-4ffe-809a-a8561dada371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621167, "uuid": "790fab8b-22bc-497a-8951-1f6ce3a9ed0e", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9724d0c-0574-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770613404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613404, "uuid": "ac56f68c-cff1-4d50-a2fc-d644d6078971", "comment": "Malware payload (AsyncRAT)", "value": "67f254f51cb841e805e25ab507d1152a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613404, "uuid": "6f578db7-b499-40b7-8832-8efed2fd72d2", "comment": "Malware payload (AsyncRAT)", "value": "cfa280aed1af637f0d80931193df8a58416d025232042cb3035a38604f480447", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613404, "uuid": "c0e5dee7-0dba-4c24-aa25-6e79d0f0ed73", "comment": "Malware payload (AsyncRAT)", "value": "8dae7aacd11e50f042a5ce9192f97c174e023814", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770613404, "uuid": "eca6fff1-63eb-4ed6-8550-4d9b8e3d7778", "comment": "Malware payload (AsyncRAT)", "value": "0a1e9362e2921ef3363c4863d88e7a2398a40d9aaab44a39ffee61cbc8f3f0f2635f82a980c87834ce0cc9942feeb97b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613404, "uuid": "5b2f0d72-9e76-4ede-930f-ca7047cdfee4", "value": "T122D24A08B3D88551E1FD57B94D7293048771EA4BA973DB9E1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613404, "uuid": "96c4c92a-1d5c-4b05-bb9f-d76d0b8776c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613404, "uuid": "f9f902eb-fc59-4d34-8e28-3ff1948414f0", "value": "768:LuGRXHMMVEo8Yg/cIRGqo+/Rb7fB/dTi/+:6GRXxVEo8B1iwRbN/k/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770613404, "uuid": "2caaf64e-022b-4887-9b75-5504ba1acd80", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770613404, "uuid": "97baa938-01db-4ba2-b8bb-8b73cfe7a242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770613404, "uuid": "4b076208-3661-446d-8432-a65528093530", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c024ca9f-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770658109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658109, "uuid": "48dbee93-c4c0-4832-861e-eb5d3e268d47", "comment": "Malware payload", "value": "ddacb5ca2cd18bd816f3f3fc5249c2de", "object_relation": "md5", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658109, "uuid": "ce08a588-6b98-494f-83fe-e9e0feee6d0d", "comment": "Malware payload", "value": "d15ad24353955ad790403083fef17ec5c7e92e6e13aa4d6737f69d4a52b5b9f0", "object_relation": "sha256", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658109, "uuid": "910d4be9-93ce-49d9-8c25-865090ef16d3", "comment": "Malware payload", "value": "4fb4cdacade3e35023e7a7bd7d65b7f6f3586c22", "object_relation": "sha1", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770658109, "uuid": "97df4c82-3e63-4eeb-98d7-ce5fca370112", "comment": "Malware payload", "value": "2496c12ef8243492124e3733665ca3bd717d96a3a52ca4e69641d7b9ef9c2d1f47b4cf6268afcaf709e99080c614d0b6", "object_relation": "sha3-384", "Tag": [ { "name": "45-74-8-75", "colour": "#EA6780", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658109, "uuid": "6d8632c8-e901-453a-895c-6bcdcfdfbd5c", "value": "T110E23963A5928430C7108DB8873CC504E4BB3DE19429A89677AFFCEFFA97791249D316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658109, "uuid": "f7df2dc8-045d-471b-b884-afea82e6cb4e", "value": "768:1nGzvOgd/ija+1IV6Wf2rwB0xcFKnvpo83TOT9CWuOp:1nGzvOm6Wf2mMnG83TOT9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770658109, "uuid": "703a2243-7080-476d-8420-7b418404b94e", "value": 32767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770658109, "uuid": "daeb6b7e-fca1-4d41-8ea3-ae9d6a4948a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770658109, "uuid": "ccbd6374-9774-46ed-8296-109dad3dcf7b", "value": "x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75c6523-0566-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770607468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607468, "uuid": "d94adcf3-b058-46cd-b166-9263d7d20afd", "comment": "Malware payload", "value": "6f1da8480a6b50e4dc9f8bc046464b24", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607468, "uuid": "904854a7-1f2c-4fc4-9fb9-3d2d03cf9b4d", "comment": "Malware payload", "value": "d1a6a07eee57f4896d083640b2e14e45bfb93cfaccc9f56fa93f2e0e0571a727", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607468, "uuid": "a32cb779-4edd-432c-816e-5cafe9c1e580", "comment": "Malware payload", "value": "62417234675f2ab5c8305fa6a187699b62e5becf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770607468, "uuid": "87e89692-0907-4deb-8a43-1415ad52191c", "comment": "Malware payload", "value": "01f0222f550de95a8e0e4882fe9f3128d459a2a8c1f5ab049c3e47c9f46d4e20347f002e167cb4e4109dbfa4d2c389ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607468, "uuid": "2761f649-2e90-4977-b3f8-f7c8e86d3710", "value": "T1CBF0E20FA04BF03AD08419E8AB61FB5AAC30B86B6367CD5C78407650FED642479A2240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607468, "uuid": "76d27a19-34f7-4f09-8b1b-8c378df33ae2", "value": "6:hLgjJ5Ja/+YcLN7+Y3JMF/+Ye0IdyJ44LIXLoO4eGLw+v+YdF/vNnQz2JMIykwFv:lSjkOLZpqjW3bo/8pqF82Q/NiT+XAB0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770607468, "uuid": "116d4c62-6494-4449-af28-329d8e5c67a2", "value": 514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770607468, "uuid": "9e649c0c-d681-40e4-947a-42294354e2cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770607468, "uuid": "9319575f-5e37-432e-9a5e-d555fa0aed4e", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8566c479-05fb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770671325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671325, "uuid": "9140b7ef-f3ed-4b6c-aae1-d17815eb7192", "comment": "Malware payload (Mirai)", "value": "e69dc91ec3f01c98afa557e2c131cec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671325, "uuid": "8aebbb1e-15bc-4b69-8429-9a2a6ced83a9", "comment": "Malware payload (Mirai)", "value": "d25f9b94462c327c549ad5cc2b481958cbf3faea066e8d84b35f26b4be3f7d43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671325, "uuid": "ead54cf3-4b57-4280-ab18-ee985581c7d6", "comment": "Malware payload (Mirai)", "value": "a59c17cee32bee561ebe5ec4b43d2fde8ee70b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770671325, "uuid": "3c80d72f-eaf5-44cb-87ab-02fac236efd0", "comment": "Malware payload (Mirai)", "value": "287c0c6c400e0beee6d610e050d67d1cf113be29eff3bcd376d3a6c5fe5768f2b1b195cd51d8dbfc77776d00efc27cb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671325, "uuid": "8539462d-10e6-4d6f-b53a-ffdf8bfd849c", "value": "T1C9D33B92FC82D612C6C76177FB1E428D772713B8D3EA32039E256F61368A56A0F7B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671325, "uuid": "98e6cffb-a4c1-4156-bb19-be6677a28339", "value": "1536:T8V9zwzGMeyyx5PUH0RVLY1jAsJhNpxJo1HPY41RlppGDjwg9Rl7Do59gOXkPjZR:T8V9zdc0o1phPxEY41lpw3JDus0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770671325, "uuid": "9e3283d2-3cf4-4927-8c86-9fa718fb6d8c", "value": 132308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770671325, "uuid": "9b273aba-98c0-4f2f-a183-2883b52a3d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770671325, "uuid": "dff293c0-4376-48af-982b-45b6af7947a6", "value": "arm.go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af4c468-05ee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770665697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770665697, "uuid": "278f7810-0518-4e4b-8b20-591fb27253fb", "comment": "Malware payload", "value": "0a00c5066aca62d8677ba64f6f729846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770665697, "uuid": "312373a8-2f91-48dd-80f5-98d361af5ec5", "comment": "Malware payload", "value": "d55339f46068b34976fa7f6655ff1a23b1b62f22a30070a682d7caec28b9929f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770665697, "uuid": "e7612d93-5367-440e-8e07-d20c37b83de0", "comment": "Malware payload", "value": "ce025ee4ff4ff8732d7944ef5cc4ee03701e42f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770665697, "uuid": "31b9890c-8f40-451f-b5f9-de59e0816083", "comment": "Malware payload", "value": "e06e72b95705169715e7ae2be06c514116e13cfc264576f7945b441efe24b02b1daa06d80a7691ff0faa4d6bcefab85d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770665697, "uuid": "8d854d79-b6e7-43db-9a5c-ba98fcba0fe7", "value": "T1A43533712B07C7729EB0B735A8C4D8485EBD4239307535C2D5702DE0F7ABAB9E7186A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770665697, "uuid": "c00ab789-723d-49f8-998e-192b130ffcfa", "value": "24576:eWN5Ba1c/XeF1CLTyGbR+iFkVvE9PyGN93yer3sZ/3S7dYNBgdDJ9:FNfel2wifAGbiHGdCeDJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770665697, "uuid": "10d9074a-ac38-4988-af14-8c87c138f38b", "value": 1092827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770665697, "uuid": "00e1d145-1bbd-4b87-aaef-742a74c85424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770665697, "uuid": "edd56747-9ab8-4c96-8f6d-a76895df4b94", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e682de1-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646725, "uuid": "400cfc60-7d80-45fa-8e24-0aae4d062846", "comment": "Malware payload", "value": "fdd833900b9a3c30a0ea69beb3afccd1", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646725, "uuid": "be43a7bb-ae0a-4136-ad93-40df1d5bb625", "comment": "Malware payload", "value": "d5d2ccd4e63e2f367124a83ad8e0a8b824d0d5469adcd2ea82f15753ab2d9645", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646725, "uuid": "8f3bf672-fd62-4fb0-add9-e61b2f7c6105", "comment": "Malware payload", "value": "ce5f73613d237fd74da52a17573a93a91ce3b33f", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646725, "uuid": "353f183b-53c1-445e-bacd-557b4aab7fc1", "comment": "Malware payload", "value": "cad06b02c2c3ee7f5ffe453dc5d7876fcd895fa9bd581f846f3d5ab3c886bf578efc306dca2358d621983cee322fbd7b", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646725, "uuid": "27609b64-7fd6-4ac8-9b1f-e380bcd9f5cb", "value": "T1E0C137005AFA9608B6B36B06ADBFA551497B796D9D36DA4C0048C54E03F3E00CCA7F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646725, "uuid": "f81a925b-f7fa-4db4-9eaa-75f80d708a70", "value": "96:CyEBs5sZ5MfOOtdyFwFiODBhsZ5/HAO7mAMxdm5rRVRHNHAtBB0jVwvUiey3FZRN:Cyeuf0qFicy7mAMxdm7V8BiBK9TSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646725, "uuid": "9c9b858f-18f9-4dca-ae8c-9c778894567c", "value": 5884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646725, "uuid": "4fe96291-978a-41ae-a07e-f8b42f37ffe4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646725, "uuid": "78e9410e-3d6a-49f6-bbbc-72f5ca052013", "value": "d5d2ccd4e63e2f367124a83ad8e0a8b824d0d5469adcd2ea82f15753ab2d9645.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247e9351-054f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597289, "uuid": "07a590ed-abf3-408f-8d68-943a2e525984", "comment": "Malware payload (Mirai)", "value": "f82404f738d661677576c67a4ae2813a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597289, "uuid": "cbb5ecd3-1333-493a-835b-71acac8bb92a", "comment": "Malware payload (Mirai)", "value": "d81e15784f2df8841d4394e3c53653669d43fbceedc3419046643560e8313e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597289, "uuid": "5d140874-93c0-4899-b3b1-ae6a351ceafb", "comment": "Malware payload (Mirai)", "value": "062d5f88ab2dab5255cf292990c975d26582b4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597289, "uuid": "e57045ed-f26f-40c2-b7ac-6297b7e3bbdb", "comment": "Malware payload (Mirai)", "value": "895df56e714d541903ab052d81ac6288f151a756e330f80f4edd3efcfa1ad4c3d4401024866478c3222dcbc2cbb0e7c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597289, "uuid": "5c65e652-0138-4e45-99dd-fcd9b16e438d", "value": "T1D4D3B021E4005DD1EC2129F578BA97B80350EEB00BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597289, "uuid": "e382ad8d-0267-48b9-ab45-69bb772617b7", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xl:PiySSGp+PMmT7zMpln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597289, "uuid": "b03a1577-1a7d-4bdb-ae92-1d3c2743cfdc", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597289, "uuid": "a282d562-d964-4ebd-845e-880c3fbf2b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597289, "uuid": "5e7730f4-e1fa-46f3-b5ff-c3c2ddb1715d", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4b953b-0588-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1770621916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621916, "uuid": "a2cdc80f-f952-4dbb-94ce-a8e7d1ac404b", "comment": "Malware payload (VIPKeylogger)", "value": "3c1408052d854449ec6dade9dc5b3596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621916, "uuid": "dea84d91-7b35-422f-b557-ea7c6169e8b7", "comment": "Malware payload (VIPKeylogger)", "value": "d8f15132511e76a9fd806b12108f633c1d8f493527c6961c092e0499a9014048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621916, "uuid": "92214424-9ee0-4207-a90c-01d0e6eb27d0", "comment": "Malware payload (VIPKeylogger)", "value": "301c4172580b0d03b6b202582edbe0f44fe7edd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770621916, "uuid": "86a7c59c-2e88-45fd-87e8-93a13ebd4ea8", "comment": "Malware payload (VIPKeylogger)", "value": "bef0f05a4746f92b59326b270785fcfd0ac0792264656fe0e1319bc90281d568d35ef4a49f518cdc2e360711aff44a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621916, "uuid": "032a0196-8c2c-4890-bfad-fa4c64cb545c", "value": "T179A4F1597714E197D816A8B549B3D3CBA7F4BC20AD824B13322ABF6F9C327114E0A35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621916, "uuid": "82c690f9-b384-43b8-95d7-eac371491699", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621916, "uuid": "9e061614-e0e4-49aa-a8bc-f07f87fdddbf", "value": "6144:TIw3idCURpOvh/lCMMjGetZEcvJK+27AarXn+kFvBVmrbhw+tKrVKVDs+:oRUtsMMTUAUAarX+kZcbhlKYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770621916, "uuid": "8fa4a5ee-0e0f-4b80-8ea3-2210dc12cd9f", "value": 454936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770621916, "uuid": "012cb55a-376e-4a48-8228-edddeb5a3495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770621916, "uuid": "647b758f-5dc8-4186-b4aa-e89a1905ffe3", "value": "2025 Pago de la devoluci\u00f3n de Renta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7241a77c-05a0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770632209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632209, "uuid": "4fbdef68-508b-48e9-8967-79369a891b07", "comment": "Malware payload", "value": "51241da8fdd6e60a96547e8249e72722", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632209, "uuid": "a320044e-ea2c-4369-b979-8c34b5403d49", "comment": "Malware payload", "value": "d95d3c8b1f7055405c66ea62fc943ae4e7b110aaf3f382b23c3c9aa1a81227e1", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632209, "uuid": "912dfc36-097c-4b0b-a54a-d316ef530803", "comment": "Malware payload", "value": "8d501379caf687c55dfdff744e6a7142f3c5a0f0", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770632209, "uuid": "b9196989-a0b9-4a00-ae25-b1b11201b9b4", "comment": "Malware payload", "value": "55c58c915112299aa3fedfdfdefcbdf2e34d53940ae47b2aea469faa67ba5cd0f8379cbfcb3e7a43e8da6b606c1e6a04", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632209, "uuid": "41383c58-736a-41e6-94a3-f5f2742477ea", "value": "T1C1818C2C466BE897C386510A84B4CD0C57940B80C86AC6043B816B0E2C5C7D4C99803E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632209, "uuid": "8306516c-5257-48ea-b542-8a8279f78147", "value": "3:HRAbABGQYm55czWW7A5XcAmMJoRovZeMLwppBHKs/BCBuXVvt3Gc7CvH:HRYFVm55aWWycDOoM6pQsJZFvt3G/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770632209, "uuid": "12b72f45-87c2-44c5-80d7-a93f5dcb04d5", "value": 4147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770632209, "uuid": "a2b86014-df0d-495c-ab8a-b28d404bb488", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770632209, "uuid": "6fa0d8fd-9c27-48e9-adf3-fe732e3d4f6e", "value": "run_updater_wsh_url.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081b7c65-05dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770657801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657801, "uuid": "bf1b324c-e148-4112-802e-6bfff8e33303", "comment": "Malware payload (Vidar)", "value": "6071ca046be6e15c8d768f0f6a9b5064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657801, "uuid": "765d259e-0348-4e33-898d-13096afc12f0", "comment": "Malware payload (Vidar)", "value": "d9d9982c969e918c1f386177c9230b1b3ec2561c157dc4af76367de9f373023c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657801, "uuid": "83ba350a-c9f2-43e1-bfbf-c4d06ed963a3", "comment": "Malware payload (Vidar)", "value": "0fda53782fca41da5c5ee0a012db9ab513a230c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770657801, "uuid": "b41f0b93-1d11-4c89-98d9-5734b63bcbd3", "comment": "Malware payload (Vidar)", "value": "b674866340567fc33d8d7eb3fa0540ad08d334e3a63de85540eb3a93ddb67a67a8ce1994e8e077b1b49b619b53adfbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657801, "uuid": "c946c7ad-40ff-4d7a-905f-f37caf992a5c", "value": "T163F53902B8A954A5C6BFF234A4E1A2557B71386843313BFB1E4966771E767C42F3E308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657801, "uuid": "96906668-c0b3-4160-b055-accaa8d6fc92", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657801, "uuid": "883d990d-4e27-48b6-9017-660877c394f2", "value": "24576:hc8QFTkPMUU3UUJkBWCdIY8hsKotC6+SV3HjPAe3+96ungUK1eU9D/:OoPM73vJHCdf3DR4CUK1t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770657801, "uuid": "3a983e6f-961e-44e2-a499-0d6d3aec51c1", "value": 3611648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770657801, "uuid": "f20fb9c4-2fb1-4e90-8e7d-476c050c448d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770657801, "uuid": "b6a596dc-abef-4e2f-8a32-224bd964fdb5", "value": "d9d9982c969e918c1f386177c9230b1b3ec2561c157dc4af76367de9f373023c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ddc44-056c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770609924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609924, "uuid": "3fab824e-b1a7-4d3f-a4cc-8b87ca70000b", "comment": "Malware payload (Mirai)", "value": "446fab98c1ff4469bb6cf3b5f3ab3dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609924, "uuid": "031986d2-49b2-4d63-96ef-cc8d52ea7c70", "comment": "Malware payload (Mirai)", "value": "db0b6ffcd4dd4972cc001702e202f8889f53e5397534017c1d8f882c10d6508f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609924, "uuid": "ea4d5c67-29a6-436e-baac-adb37b924327", "comment": "Malware payload (Mirai)", "value": "a8a181e0c533b521f30d71ae351205187dcd91ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770609924, "uuid": "c3823c7a-b9f1-4130-a005-da2c91e07c3d", "comment": "Malware payload (Mirai)", "value": "0f75a4c875a065798c0edfbf595e9ace138511e02402bab419411be9b7dcc528d695c376f227ffadb60d2d20af4bbcf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609924, "uuid": "6f7c757f-28f9-477e-8be9-b5711d8276aa", "value": "T1F1F45B02EF950FDBC8AFCD30496E934716EC99D706C5973469BC8D88BA8D26A4BD344C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609924, "uuid": "f8120be6-205e-405e-b050-634439537103", "value": "12288:inVLDSeVWEV9Rvt3CadwDKNrVXimXLZsv7EXlIj+RsbDU53rj/U5BkxfNHdnlhmj:QktI1kDKh3QqBlLX5ahoKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770609924, "uuid": "a82dc6e8-d8ce-49a5-b9da-8bd566bd6f20", "value": 731140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770609924, "uuid": "e1686658-20a5-457f-8ff5-f05bdabb9769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770609924, "uuid": "fa63532f-bbb8-41f2-aa1f-a01bdcbfab2d", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779bc7a9-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598717, "uuid": "7dc9bd4d-74f4-4895-8984-6a54351b60dc", "comment": "Malware payload (Mirai)", "value": "19ef211938b129ca8acc32d8a221addb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598717, "uuid": "387f118f-310a-4760-824f-aab63ace53da", "comment": "Malware payload (Mirai)", "value": "dbe649f84d6044330304f9138b5adde9a47fc378486f26f38c82dc7064d93fba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598717, "uuid": "36bdcd7b-29d1-42b0-9564-5672d9bb49cb", "comment": "Malware payload (Mirai)", "value": "bbf3a5ca70bb38c899e551330b7c76e47928997a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598717, "uuid": "64683f38-7a76-4bf3-b791-ca60d966e280", "comment": "Malware payload (Mirai)", "value": "f9f530480ab0be94f39d6ef33e8949548bdae6a1b04a73f3a0dd24ddfcdc0046180cace522276b10ac24cc70653c4c1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598717, "uuid": "61eb0e3d-0848-49d2-bc30-32f30c5e8545", "value": "T11A631247FFDC1FACECDA2AF807AA65CF2292902190B341F81DE55985815F9B161DB8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598717, "uuid": "047ff5f9-83b8-4825-9eb5-ee897963beb0", "value": "1536:27MbwKNGjjH+Xq34n/q8Zu41zmX3sDgz1crPi:27Mbp2L+Xqdfoz2sc6rPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598717, "uuid": "966d0ec1-2b07-4049-916b-9c15a4dc3087", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598717, "uuid": "583ab23b-82d6-4928-91a6-18ed10454d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598717, "uuid": "032f541e-796b-4603-95e2-56ce604e833b", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46be0210-05e7-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770662630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662630, "uuid": "3a26cf58-97ba-41ac-9a25-2a73ec617c78", "comment": "Malware payload (AsyncRAT)", "value": "b50433d42b97243f74f18fc4947e1865", "object_relation": "md5", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662630, "uuid": "26cba581-5abf-4367-9071-63880cf89b8a", "comment": "Malware payload (AsyncRAT)", "value": "dcb2e4afc536fa90a4ae9ce81ff31ee38ad501f59a89f1b6d18674778ab2f31f", "object_relation": "sha256", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662630, "uuid": "ab80cedd-5850-4939-bd8d-fa4237d4e66c", "comment": "Malware payload (AsyncRAT)", "value": "ce22c7f638fc578dd7d4d058a9028d6516dd9597", "object_relation": "sha1", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662630, "uuid": "f2ab80bd-8905-46d4-aa8f-eb2f87a4df6f", "comment": "Malware payload (AsyncRAT)", "value": "b786abd16ae212ff44260d2a099ea39f71943006297f78465a0019d50a5ee161dc3a77689d153f221b8faee93427f28a", "object_relation": "sha3-384", "Tag": [ { "name": "anarchyrat", "colour": "#992565", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662630, "uuid": "6c6a9711-003b-45b0-99fb-0a05014458a2", "value": "T1BD93AE002798C965E2AD4AB4BCF3910106B5D5772002CB5EBCC815DBAB9FFC54A266FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662630, "uuid": "afd8949f-5b5a-4ee7-903a-79fc1c2aadf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662630, "uuid": "496cffbf-f577-4263-baae-2198afe763a1", "value": "1536:nFH80e6wkApSgvA3GbbS/a1SHSGGuQpPCCAf3cHVclN:n+0e6wXaGbbSC1SH09CCo3c1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770662630, "uuid": "b5a2bd78-466d-4d99-b965-d18733f7d8df", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770662630, "uuid": "3d5d5674-296b-40fe-8a19-322dcea61abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662630, "uuid": "1a89feb0-2c40-4974-9af5-ba824fa68a5a", "value": "dcb2e4afc536fa90a4ae9ce81ff31ee38ad501f59a89f1b6d18674778ab2f31f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6d3231-054c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596017, "uuid": "6003029b-cd2c-4304-a6b6-f647d8c61d1c", "comment": "Malware payload (Mirai)", "value": "1187b591817273b4b9f945738b7c37ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596017, "uuid": "e6ba0d62-b436-4236-a820-1c9030fd9fda", "comment": "Malware payload (Mirai)", "value": "de49cf3582fdfa921736e0638f7b34d75ef94f9c56455cac8bc78bae0285288e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596017, "uuid": "bdb06437-7192-4e6f-b0d9-3fec4bba9705", "comment": "Malware payload (Mirai)", "value": "9befa70d0027e436c663a73f436f2974c8959af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596017, "uuid": "52a3a649-9b64-4bb1-bcf6-eb4ec51b9c0c", "comment": "Malware payload (Mirai)", "value": "f909a5e304383316d85dd0110394ffc91d4b450005fec39c5e1abe68fb61d410312b82fe2af00107f2b37ed97445c432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596017, "uuid": "246e911c-ec22-478f-8713-aa4dd979e35e", "value": "T1D45302412AACE93FCFA2D1390F6841F9459C59E894D2501F43CD7CE88906C64EB9C5D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596017, "uuid": "2eaa7f6b-1b96-49b0-8afb-7ee361a71aaa", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/u+hAQZ:MaHJgMo8FwOA4zUFGUO3UhA+iQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596017, "uuid": "ce60dd12-9f4c-444d-bb23-6403625f6948", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596017, "uuid": "b4df7093-8ed5-4d22-bbcb-608ea86b44b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596017, "uuid": "7eff1a9f-614e-4777-939d-bc06f0d4f3c1", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3a8670-05b6-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1770641725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641725, "uuid": "d71c83d3-66cf-408b-9370-bcb0fb33d886", "comment": "Malware payload (NetSupport)", "value": "9cc2e38095a6c0ef0fd8dcee02c641f0", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641725, "uuid": "0ee3d3c9-e274-484e-8c1a-8038dde62668", "comment": "Malware payload (NetSupport)", "value": "dee221213a26ae87d2d240e8ac06ff339fa744cf9a53ee4c92330a31c294756c", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641725, "uuid": "ae854eed-2e7b-4f89-928b-d1c92bd9be43", "comment": "Malware payload (NetSupport)", "value": "5996bad599bae912b78f41e682ed04953244b8cc", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641725, "uuid": "c0765e8d-e097-4c13-aff7-3062873407ac", "comment": "Malware payload (NetSupport)", "value": "97a081c060b51dd6592ca962dc51206837b639a1f1d2f889c52d50b3fcb9b6d00bce87f7774ab4df5d76fe27f03c4e80", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "jakkakaskakasj-com", "colour": "#CD2821", "exportable": true, "hide_tag": false }, { "name": "jasjdpoekkqwda-com", "colour": "#F78A49", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641725, "uuid": "95874ea3-7933-4650-b68b-fca4ec7bece1", "value": "T16311B7B8C7DD0C80DC7F59BC04910354A1D16DAD03009257FC4FF9941D976D153D11E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641725, "uuid": "de46eefe-5a88-4cbf-8054-011c2e6a33ed", "value": "24:9jl464ithonWoXuVdD1c1UDaDYXfnlskt:9j6ChonWoeVbiYXfnuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770641725, "uuid": "5f0177b0-42c4-48b8-9709-7f166c1a84a1", "value": 964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770641725, "uuid": "f72e9757-38a4-4a1c-a784-8fc8a05d562f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641725, "uuid": "5b1ccc03-e8e9-47a7-92a0-9af63e57485a", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5317a790-0563-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1770605957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605957, "uuid": "50ee1de1-c507-4294-a396-01a34b3dbb59", "comment": "Malware payload (Joker)", "value": "be0269d96b57050e89faeb2da27b8294", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605957, "uuid": "0c5fca38-261e-4428-8909-ceff9e610a4f", "comment": "Malware payload (Joker)", "value": "dfbb279301aaf3a86520fe72e6625b2d8bb2128166fe64fe8d56fae017960b8e", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605957, "uuid": "28807bd6-4c37-4fd2-86c6-ff3a48aa8ba5", "comment": "Malware payload (Joker)", "value": "9ebbf8c284083ac00563ef2a220f703b800855e1", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770605957, "uuid": "cc58b6f4-b6e2-4b4c-8b6c-296adcf9b9f6", "comment": "Malware payload (Joker)", "value": "0f579298621fac35eaf2e08c3f8685709613b6fc331192dd1e36d19654e1acc98a6622f07f001fa544d93594b907ff51", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605957, "uuid": "de653071-3be6-4a34-9228-813b15f138e7", "value": "T1F647220AEF0DA82FDDD2F17C8D790262716760A89302E3DBA911913CAF876D49F55BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605957, "uuid": "a690e1b7-0ed2-4c1f-b0c5-ea559a9ad1c9", "value": "786432:gWNvK4p7NlUPetJ4FuHCrQrQZi1bCXoOA3tg35:gWpK49yo4FutrQZi1bsoOA3tq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770605957, "uuid": "e1da2989-12f6-4be0-8dc1-1b640f6eaa45", "value": 26201472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770605957, "uuid": "c0cd6761-096e-4eb7-9339-999f5fc45c41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770605957, "uuid": "c692216a-4cce-4c7f-b293-f8f3ac7e0218", "value": "Clean+File_1.1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853f8484-05cc-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1770651139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651139, "uuid": "8fc289a9-2b8c-4759-8ffa-8c451d2fcb6e", "comment": "Malware payload (QuasarRAT)", "value": "fa8fdc6064f86f29fe4f8e4c1352f4ed", "object_relation": "md5", "Tag": [ { "name": "193-161-193-99", "colour": "#3868A9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651139, "uuid": "a1f10bb2-fc6e-4b57-adf7-454cac7a8233", "comment": "Malware payload (QuasarRAT)", "value": "dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204", "object_relation": "sha256", "Tag": [ { "name": "193-161-193-99", "colour": "#3868A9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651139, "uuid": "2253c89f-95b9-4128-a6d2-07d9901d87ba", "comment": "Malware payload (QuasarRAT)", "value": "8090b1762283891671a2a549f4f54edb23e53a8f", "object_relation": "sha1", "Tag": [ { "name": "193-161-193-99", "colour": "#3868A9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651139, "uuid": "5c94a396-a29c-44df-8006-ebfa9d37748d", "comment": "Malware payload (QuasarRAT)", "value": "4f097875adb5bde8bca8a37cbf27171eab980b41338769b1c0a1f6262027c36a8d8df39a5874fb49d6d7e41f1a51a1b7", "object_relation": "sha3-384", "Tag": [ { "name": "193-161-193-99", "colour": "#3868A9", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651139, "uuid": "b29bd14c-b76b-4951-908d-0047950c5c06", "value": "T1F05533A07DFC6429FDD8194FE6BD234F97840E810F61FAAA899561F497072B32981F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651139, "uuid": "c68ead63-0649-43f4-be0a-7fb1132ed3cf", "value": "24576:sXWFw9XDEp4atwWQnkylLjp887E3PEta5qpkS1Ige9D+ri:sX2qTEpwyyhTwfEKjS1Te9D+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651139, "uuid": "48c1f096-7ba8-409f-94ef-e019ffc4c5fc", "value": 1295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651139, "uuid": "2a9f1e2f-331f-4e7d-8036-2c3dd4f23911", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651139, "uuid": "7e4f8dd5-63dc-4571-9789-ca8a8b0e2214", "value": "decoded_injected_shellcode.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442d605a-05e9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770663485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663485, "uuid": "f5aeb525-9d0d-4e70-b2bc-d14c83f38c60", "comment": "Malware payload", "value": "6bb1ee96e5496a9b4440a40821335222", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663485, "uuid": "b1f9c285-5c17-4ce7-8b39-6f2243383078", "comment": "Malware payload", "value": "e05bf246d46f0002553a2b940ac726358c90748a66f35efafe77cf91b22701c9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663485, "uuid": "7585839b-0fff-4dba-abdc-d00ef259411b", "comment": "Malware payload", "value": "55d6a07dd52801cca8c5b6699f6d168d3ab5c5b6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663485, "uuid": "f175048a-72c1-48eb-bb98-466f7ca4d11d", "comment": "Malware payload", "value": "9143a1f4fabf291136c890c32da3cdbfc1c8ec8d927fb514e70c79952ba63604424a4e9c962f7fae068945682fb073ac", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663485, "uuid": "363663ff-7c28-4ab9-bf5d-04fbc7c49844", "value": "T17FD633305E177CBE0E6C4A14606B6E2D1EF81FC7815CE1DA5B8831E762EDB908D2B875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663485, "uuid": "6c14bf4d-00d2-4eff-a027-79e23e32a896", "value": "49152:2qHjWOtnQdkU1wbQNBHcArlCpionZia/ZH+KZd9+vvMxRjy5b6zsAVVEzuv37h5r:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770663485, "uuid": "323eb44d-3af1-4c40-9354-142b90802291", "value": 12926071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770663485, "uuid": "029aa12f-6df1-4f9a-9beb-27a19e0b1a8f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663485, "uuid": "a120ec8b-24f2-460b-86e7-dceea9fa35e8", "value": "update_8000_fiyh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08138b4f-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645345, "uuid": "1deab038-4f28-4e7e-b19b-7e808248a0bc", "comment": "Malware payload", "value": "c0a29aacb13bcd6da711a25074d48a3b", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645345, "uuid": "4b5566fa-6b07-4d3f-b782-2e3424672ede", "comment": "Malware payload", "value": "e544e00b87971c28d6689caf5e572476b0d73f910885a657df51925adaaba2cc", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645345, "uuid": "8b3e392a-24ad-4879-b87c-5972b1034261", "comment": "Malware payload", "value": "9f0ee6a8945a568ac0957eb1cc1a7601528858de", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645345, "uuid": "5d31d653-0e4b-4cd5-8d35-f497341af361", "comment": "Malware payload", "value": "76c8d3c82ddaa6b2f9f1a47c63b13fc0c34f85595e056168a1e4e6c6d5a1de95381e30eba77f36387aeac74939ab86db", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645345, "uuid": "39895c7d-d001-4f0e-aa37-ff9a40aa4535", "value": "T128F2AF11769F960870B346494BAF02780BAFBA9F0E3E414945CDE68A8FE35159D873F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645345, "uuid": "f19554a7-95ad-42d4-88f0-12b173ab9737", "value": "384:j71n5d+ah4Y4PYqYWFEfH3F7/381fh89ZBUm9ZS6Y/DCzT:j71n5dDh4fYqYnjMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645345, "uuid": "0e5d752d-c824-41da-9bc2-4bee52da261d", "value": 37016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645345, "uuid": "c96858e8-9b9b-4ca1-ba71-c7f4e689c3d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645345, "uuid": "0f142b34-6fb1-4967-a271-33bcc4bc7809", "value": "e544e00b87971c28d6689caf5e572476b0d73f910885a657df51925adaaba2cc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4a164b-05c6-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770648656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648656, "uuid": "5ca4fe32-18c6-4113-856a-060c906ff521", "comment": "Malware payload (ConnectWise)", "value": "13be14f7ab6dae00446042a16d475e39", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648656, "uuid": "77a0b502-9dc1-4655-bb4e-af4bf21d3106", "comment": "Malware payload (ConnectWise)", "value": "e56fcb3aeccc1ba0eabec34f6d4602e2a3e45de8f50ae07a97fc85511f03b43e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648656, "uuid": "edeacf97-653d-4e34-8d57-b479ce739b8e", "comment": "Malware payload (ConnectWise)", "value": "e0b2db54a70208a4538e0961b2f32986827898bc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648656, "uuid": "8c55ce7a-bbc2-4e1a-83f6-f460785d67ce", "comment": "Malware payload (ConnectWise)", "value": "4740ec6d2ccb5c79ab015b051934a7ae544a23a0213d67a79765682d4d35ba4b32d180c94a7e74d8aa56caf905047703", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648656, "uuid": "1ea5e165-37c0-4d8c-b465-ff74a481a972", "value": "T1B146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648656, "uuid": "10c77c15-ac2b-4778-812b-f75283fcc0e2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648656, "uuid": "f64b24bf-7fae-44c5-bc39-6c261fcdc714", "value": "49152:TfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:nqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648656, "uuid": "43bba069-371a-4f1f-a68f-3b878c170ce7", "value": 5649080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648656, "uuid": "f120fe0d-73f0-4dc4-9b5d-a962d53eb3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648656, "uuid": "15afc882-30a4-42da-885d-1a0d55af3a9b", "value": "Social_Security_eStatement_Viewer_ID191052105558_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb90b9-0595-11f1-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1770627618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627618, "uuid": "994c35e8-348c-43bc-8e05-64bfcd5ab2ec", "comment": "Malware payload (Phorpiex)", "value": "34e2d71b38f9a8e331980d8ce205c47b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627618, "uuid": "a2326f1b-cc9c-4bb1-97df-f6e403f6d668", "comment": "Malware payload (Phorpiex)", "value": "e59a409261efe2d5cacd0a58ca1f92cae85bbf45d6c7b63c123e6c2c069a139c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627618, "uuid": "2b3b50cf-6c43-459a-af2d-8bbbc2b7ebd0", "comment": "Malware payload (Phorpiex)", "value": "93ffa02685f6b7922cc96bec90f63771174ee1f2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627618, "uuid": "2f5522f7-4dd9-4969-a901-299c6eef332b", "comment": "Malware payload (Phorpiex)", "value": "212d323ca485b88500c690fbe8259374ee7330d874d7782d0a217691c01e1247e4c5f82bef2447a84f6e084c03342565", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627618, "uuid": "6247fe24-be41-4e03-ae4e-4c86d2cd4f9f", "value": "T1E5A21906AA56934AF875287063732E3664797D77230E84CFEF80093A1270DE4FA3335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627618, "uuid": "cf6ad9ca-a6bc-4d19-9cfc-9a3fb312041b", "value": "bc7429c21973649e822dbec2b14ff39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627618, "uuid": "77741d99-00bc-4055-939d-b64c324c14a6", "value": "384:Tk07SPPMHliW1uUYzQFYhJ4JVB0TEtSknR:CPPMH+UyqY+IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770627618, "uuid": "a6d72979-593d-4402-9b0e-7500da893f25", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770627618, "uuid": "25e85bce-9874-4239-8fed-2fc407234192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627618, "uuid": "a0192165-eea9-4317-83c9-7ac5639a6820", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642630be-05ce-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1770651942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651942, "uuid": "ed06a4c7-623a-4299-b809-f0be8f979eb0", "comment": "Malware payload (Vidar)", "value": "3f452d6f44cff0dbe0a8848eef9d92d8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651942, "uuid": "35c0d379-7532-43c9-adc8-80c4360f9fd4", "comment": "Malware payload (Vidar)", "value": "e5bd8a8c204f0a5caceaf4d7037694d7afebe206ed867895b9d4497abfc35726", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651942, "uuid": "ef23e306-4a43-4313-b3fe-413d077c0d4a", "comment": "Malware payload (Vidar)", "value": "23ced21bd93d7d380da677f5a4092409891cef11", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770651942, "uuid": "8bcc1216-69a6-4f9d-9d52-0163402552ec", "comment": "Malware payload (Vidar)", "value": "09d84778700daa7d3511663fd94de3c11df5405209c072ce9cb29da7761bba68565ea272e4264646f15bdc8f8f7d7673", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651942, "uuid": "336e41ce-91f0-46c3-91c0-fb6cf23222d5", "value": "T1AED5F10FBD09CCA694B363BEC9979418EF214207107DACA87A8CE8D51FB048AD7D5E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651942, "uuid": "08d150ce-56d0-4390-851f-b08e99cbabc1", "value": "49152:wpsQB2hgZwj5u7WUc2g9O1Og/Pg+xdUXUSpgCPsfo:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770651942, "uuid": "84dd7c7d-d639-450f-9fdb-289aae726bbe", "value": 2892833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770651942, "uuid": "7a152051-6f5f-4958-9d81-8a0913a46c63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770651942, "uuid": "09e1b177-0d8d-4651-8736-d2ba308d318c", "value": "energieadviesx.onlinemod2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3385eb8-05c3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770647431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647431, "uuid": "b06a4708-2af3-4147-8c4f-af5388132c5e", "comment": "Malware payload", "value": "e4cab14b112b88a613b55da9bad9f08f", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647431, "uuid": "20afb972-94e7-4064-b55d-3d739df3f78c", "comment": "Malware payload", "value": "e5ea80bff7806252bd1be1e8f434b6058f2ccb8556961eaf19e16e3311202c3e", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647431, "uuid": "c1bedcc6-cad5-4cd7-b6de-b18b1b7ebdc5", "comment": "Malware payload", "value": "c7cf55c49cadc440a3594f5bf33013d71c2cbef9", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770647431, "uuid": "ef6d5527-84c1-4776-86b7-ea9baeda7677", "comment": "Malware payload", "value": "2f3a8b0ac6e3b9a6622b80afc97af1ce41f91ff35ee0033f614930cc94587b145ba053f5694f85cc20eb4b206a47057a", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upcrypter", "colour": "#B7B6AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647431, "uuid": "586edf61-52c1-496d-9f40-3ef2ea6f14d5", "value": "T1E0C5BE291669EF00D07A0B3450A049D0C7F7661D8E9ADB1EAFE23C935AED796633710F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647431, "uuid": "454778eb-2b13-4f96-a01d-d4b4631d97ec", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647431, "uuid": "daa3b8cd-1033-49b8-b1ff-80de9d70c613", "value": "49152:C4STVBu/L736bm9PzGfjrOOzf68Qtqs9puQGbj:CtT6/L736bm47rOOzS8Qtqs9puxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770647431, "uuid": "8ea0c15d-655a-4690-b2cc-c35492c13755", "value": 2629120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770647431, "uuid": "b2f50438-81b7-489c-abfc-e482a81f10c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770647431, "uuid": "1eb32249-0b85-4066-975b-094c0b72cfe8", "value": "ClassLibrary1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49165282-05f9-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770670365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670365, "uuid": "7b0077c3-a800-489e-9805-3e75cc60bcc6", "comment": "Malware payload (RemcosRAT)", "value": "863a6969fa5cf734d70723e12b4995b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670365, "uuid": "becb83ff-6a94-4499-b122-40cc0d053f7f", "comment": "Malware payload (RemcosRAT)", "value": "e97671faab18edfdedb74e4623d55207d912ab1efef5423b8a6b999a43f199da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670365, "uuid": "c7e0bf77-1e42-4562-8fc6-a585a39a49ae", "comment": "Malware payload (RemcosRAT)", "value": "427cdb669c93e72c1bd3ef816d9e44bb85f2d566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670365, "uuid": "e55ddbfe-93bf-4660-82f6-7a284022ecb4", "comment": "Malware payload (RemcosRAT)", "value": "164b6e5dcb13df5d9e83e7eb1bc21543c959071b2d9a5796da32f5ad93a1c36ab8d2622dcbd942c8688e81839eb447e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670365, "uuid": "36039840-6e89-4fa6-9a27-ac556027fd9c", "value": "T1DA83F707FE07C1F3E81102B21B553762AFBDEC231619A927C745C581EEB8C4AE4B567A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670365, "uuid": "e6582902-271f-4119-90ef-f49ff5b82a01", "value": "f79bdf7005a27b505da0a17f8329bd86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670365, "uuid": "00e3c525-b77a-45d3-948d-ffed9ddb233d", "value": "1536:KpNEsaeiQl8TIqytzRJl+uiNuI7FFCPBsZcOzq1T35T/OLeILtVo8V:KpNEaiQl2qouiNdFFCiZcOz+TJ/seAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670365, "uuid": "7f6bf0dd-7fba-463e-bf3c-091b0ea9f797", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670365, "uuid": "eb538e52-b6b1-4bf5-a37b-055e68e803a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670365, "uuid": "27e4de5b-2daa-4630-8e66-44067d68541c", "value": "e97671faab18edfdedb74e4623d55207d912ab1efef5423b8a6b999a43f199da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d443ea-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770670893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670893, "uuid": "3faada71-7e4e-4064-933f-cca6895b2665", "comment": "Malware payload (RemcosRAT)", "value": "2c6608cae9864a617f7126eabb2d734f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670893, "uuid": "006a5a6b-1540-4ca3-a84b-e00fa9ed752e", "comment": "Malware payload (RemcosRAT)", "value": "eaab2fd25ccde3b7b149a07e74e69ff9cd3886c852e562b2e5c576233c4466d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670893, "uuid": "61ad4d98-3bab-4ffd-bcbf-be12b949ae14", "comment": "Malware payload (RemcosRAT)", "value": "5a421ae6cb9241b06ebf4a82a67b27eda7476c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670893, "uuid": "bd4e126f-a062-46cf-bb1d-255be55d3140", "comment": "Malware payload (RemcosRAT)", "value": "283f1f0949e66e5a08e20f148becafd7a89a03eb197fdf08b011b9025d5576827c82a36662804ca90e2e7d15e840ee55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670893, "uuid": "e9d94250-3625-4c40-9eac-9b957945b5fc", "value": "T1C2B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30150AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670893, "uuid": "c8820917-6c74-40e8-b26d-5f08ef7c9492", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670893, "uuid": "e99deeeb-92b3-415e-b8f1-e5b98eec914e", "value": "6144:OXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcez:kENlHV9FGeDWv3jADnyYiCNrsPZlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670893, "uuid": "4f08181f-7d7c-4823-aee0-110ec98c2cf1", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670893, "uuid": "f1e3f63f-d520-4556-9938-c079f6db794d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670893, "uuid": "53c8a824-ac3e-4195-9231-189be2dfe474", "value": "eaab2fd25ccde3b7b149a07e74e69ff9cd3886c852e562b2e5c576233c4466d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e78dd4-05b8-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770642338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642338, "uuid": "f61d0f74-91b3-4f52-bdb5-277e3e296194", "comment": "Malware payload (PureLogsStealer)", "value": "b5655c571dfc9e9436c3eb3b378a4b58", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642338, "uuid": "521084a6-3250-4efa-9042-5514ed9e9323", "comment": "Malware payload (PureLogsStealer)", "value": "eafa0ebe69af75a617a9abb5bc72f05ab05cac2823441059aca1b57da3ca4dc6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642338, "uuid": "a2f0ddd8-80d6-4f33-8deb-ff04c69a8db4", "comment": "Malware payload (PureLogsStealer)", "value": "9d7b7ad17f46436167f1cc4f599bd4c35baae416", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642338, "uuid": "f29958bd-2a64-4a19-b79e-e6659caff833", "comment": "Malware payload (PureLogsStealer)", "value": "f0fcdf36eeed5bdb17d97a6f437537a61a1cdcadee0e84a63c9452fd29a487f336994d265bbea9b7c862e8a43eed8ab3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642338, "uuid": "39655df5-21c7-4436-bcd6-fceca955584a", "value": "T1E6C51100D925CDA20A1C8014649A2E8759800E6B9C187B797F8F9F9E1F0F64FD57A7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642338, "uuid": "24024dba-1d89-48c5-8e5e-15c8636b0796", "value": "24576:7yFTQtucpbE5yIjEMwzIjpZ6n3pSekN6VUM+ep+bvktcnt/yRvrcytGLCkz8sLru:aBZw5VcA2EYr+ryNly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770642338, "uuid": "7c94efe2-ab4b-4992-9df1-1022de5ab475", "value": 2632293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770642338, "uuid": "64a12a22-2bdb-4a69-ab0d-50c8f6208c36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642338, "uuid": "15f20ce0-9c34-4336-9aec-60293d4a1faf", "value": "gabi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04096498-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596376, "uuid": "2516514e-0876-4e46-a825-e3bcab7d4e9c", "comment": "Malware payload (Mirai)", "value": "fae5683360e5acfa73e7f415a8e2062c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596376, "uuid": "e3d26f0d-5362-491a-ad98-cd4940dacf75", "comment": "Malware payload (Mirai)", "value": "eb06dc306ed5c725a0bcb6af27d9caba75d1250175f3b97ab49b6f2b1108a61c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596376, "uuid": "5b6dc25b-2025-414e-ba4a-17f930d613e6", "comment": "Malware payload (Mirai)", "value": "b6dfd5b92916310eb4101ef431b73eed0aa80fda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596376, "uuid": "c95b8859-8219-41c3-93c1-2a8a3cc9df87", "comment": "Malware payload (Mirai)", "value": "2f8fd05b16c66ebd6513fd4915313c68da95ab451524c591e412ea4512f5e7442effad3ea413e364e64c132b4851e28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596376, "uuid": "337e49e8-b3bd-47cd-9a36-212b971587e8", "value": "T189B31989BC819B10D5D535BAFF0E618D33139BB8E3FA7113DE185B2A538A85B0B7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596376, "uuid": "90d8c343-c57c-40b6-ba26-ed07d981297b", "value": "3072:5CLxKBAAzWnqiE7qf09srAg9XyieGEn7bb9cglV8kP1kwdo5X:aSun4x9srAg9XWb9cglVxP1kOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596376, "uuid": "bf1cee57-aef5-48f5-bb12-fe886df66108", "value": 117688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596376, "uuid": "59c54dd7-1cc2-4a87-b621-35c59eb0b9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596376, "uuid": "cc49c681-bca5-4b95-b4a3-d10d4e46e60e", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069aba6d-05ec-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770664670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664670, "uuid": "859c3f10-03b1-4280-9dfc-bb5c8b2b5c49", "comment": "Malware payload (Mirai)", "value": "056717c3247a49e405a39fb5485cec5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664670, "uuid": "501a65b2-5e09-43f6-b783-48b8c2861278", "comment": "Malware payload (Mirai)", "value": "ebcd1afb7c4450857f504077537efa5d5864b3649a35fc15146e25a80419e981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664670, "uuid": "182735fd-c771-4b2c-8746-74fe18569dae", "comment": "Malware payload (Mirai)", "value": "4eb94b5bb483a6189ad7b2218a408baa4abd575b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770664670, "uuid": "65571244-3464-4526-be9b-4c49d344bb00", "comment": "Malware payload (Mirai)", "value": "adb818c8b1fa3a3cd013be587e7fcf333189f930b054477c9cc3c671dffd2a650cdee20f70adc6db04762636c4056c38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664670, "uuid": "1a048d7f-da10-4ce8-8688-17713323c523", "value": "T18EB3AF73D42A7EC4D1514134B8B5FEB51B61A1C041935DBB2AE9C87A00CBEA4F60AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664670, "uuid": "62c29f45-541d-4508-a4ec-73a8b9203b04", "value": "3072:hfpZykqkt436I+9eIH4mNOkSMPXeC4GnHN0:hRZ0F3BczNOkvZhnHN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770664670, "uuid": "d25bb7e4-27c9-491e-9ecb-cdb87f9001e3", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770664670, "uuid": "af97b7d6-6ff5-4d08-8351-9f9dab9fded9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770664670, "uuid": "30e767a3-aff2-4d73-8ff6-8a1c9739648d", "value": "frost.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905ec0fc-05fa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770670914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670914, "uuid": "227f7841-483b-409c-b37f-fdbca72a2570", "comment": "Malware payload", "value": "0ac56655e1a13b1131f5103dbfe3a0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670914, "uuid": "80800f4b-974d-4c87-a58a-2ec0f2864f2c", "comment": "Malware payload", "value": "ec5f050c53d2c6c4b76d17948a8e6b7f167ba491ff4035e560b36723d3165090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670914, "uuid": "f31ebb22-1b49-4ec7-851a-fd59c54d7423", "comment": "Malware payload", "value": "76cd891492d929eae5ebd8ad30280476450302ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670914, "uuid": "9d0cf466-f077-4ff1-b53c-394fc332942c", "comment": "Malware payload", "value": "b82bf32814ecfa8e4488f256431018dd21f1d440bc2460621483bc613d3c1292c75f6055468cc5ceff9002ccd3ddacac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670914, "uuid": "d45bd656-19a2-49de-b4e0-6cb3703844dc", "value": "T16574E60CFE91F845CD9A3D7BCBE610108B7125C22E21925232596FFD8B9937758E62BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670914, "uuid": "6f826895-0bed-4170-8166-6b4548ed9364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670914, "uuid": "2af3906e-b070-4a5e-ac3c-21cdba7adc93", "value": "6144:9XPHJ02Rn+Fnyjl6ke6VlWT8cBHRLZ1/c/fCOdbM8/m1:9fHxRn+Ajl9PVle8cpREfCL8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670914, "uuid": "de0c8f5e-e360-40cc-8b9b-66e6ff7d7ed4", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670914, "uuid": "281fbfc2-daf9-43a1-bf25-59d976e87a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670914, "uuid": "96667474-8981-448f-978f-390bd785a4e3", "value": "ec5f050c53d2c6c4b76d17948a8e6b7f167ba491ff4035e560b36723d3165090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e920aa-058c-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1770623681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623681, "uuid": "f9a18ece-5e71-4b45-82f8-6a2fe0961f4a", "comment": "Malware payload (Stealc)", "value": "d3930b65f6bf355294322aec6b939046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623681, "uuid": "6863747d-1527-4753-bbb1-a6825b51aa1a", "comment": "Malware payload (Stealc)", "value": "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623681, "uuid": "bbc92ca3-86ef-4a94-8704-cfbb9a4a1363", "comment": "Malware payload (Stealc)", "value": "1d2a565008a18fae4b259847f924fcf2a176713d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623681, "uuid": "1bc650d7-0a0d-4d6c-8862-7eccf4b7a6e4", "comment": "Malware payload (Stealc)", "value": "a7fdcd759fa75da6c02346a01ae9dc31d27011580fb853c8562bfa2a3bcdc9a4f9497e7d28786f6d0cabd17e41743ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623681, "uuid": "221a6ef6-2c56-428d-8243-cb3ed9c90dfd", "value": "T1532639D3B89519A1C67FF2F49CA163523231786903313BD71B98696708EABC827BF714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623681, "uuid": "3e5bebcf-df9b-4d48-8866-1f19bff456c6", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623681, "uuid": "98f368c6-d4b0-413a-a369-74f9bfa48944", "value": "49152:jqcYa3OVcSadm4vqFv069Mg8RVWt2KCSXjhy4NK1/IG:2a3L7SMDZgclz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623681, "uuid": "4f15182e-7a31-4a9d-9ccf-adae981648e9", "value": 4547200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623681, "uuid": "7dc3e14c-7891-421d-9290-6c780ae699e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623681, "uuid": "3a515e16-4653-4bf8-9af0-ac32993b4dce", "value": "BoolstrappperFIXM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f17d5c5-0582-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770619238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619238, "uuid": "ff821dbb-65f9-4c77-9598-e6602739b709", "comment": "Malware payload (RemcosRAT)", "value": "a4d1f533a114a360e79d26a781636cc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619238, "uuid": "2ac024b7-475b-4701-b42b-b64fb1ffce4a", "comment": "Malware payload (RemcosRAT)", "value": "ec9f57d5efb7103142b0713e7ff0ab6fbf217f50dd69c2640928c557a4a36cbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619238, "uuid": "6f33a809-4566-4e96-8ae1-fbcb240c5315", "comment": "Malware payload (RemcosRAT)", "value": "091cca27bd1cbde81453fad7c4bf711ed87ab6f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770619238, "uuid": "cf30d34b-73df-40b3-8402-d9090b36a59d", "comment": "Malware payload (RemcosRAT)", "value": "ea5fc3d34aa0ae0516746a801421553c870bf0fbfbc3fa9da35c95bb260f8394509dcdb834f46fdfb31bf28d385b36b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619238, "uuid": "70ca580d-885e-48ad-ad38-8518ca678438", "value": "T1CA861211429347C73DBC685DC58C3DECB86B80D8AB7DD53A5D158EFDAA0A08CBC1B16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619238, "uuid": "ad80bb7c-24f8-4b5a-8fcc-f239ac894fdb", "value": "192:cyjxJDygxwZs4pSxR9OnTOjB1WT2Qcx1FAj4AKNrmoR75d9aGsGjFMRjtQhpvbIo:JnbRbTME9TMRBe5patYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770619238, "uuid": "be20e009-44cb-43f9-ab15-ca1640008a62", "value": 7883012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770619238, "uuid": "c4426146-3714-4df2-bd24-8a3a29407fc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770619238, "uuid": "2de4e3dc-dcd0-40c8-8fa8-13b09c0c4f39", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a61fb39-060e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770679306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770679306, "uuid": "436e42e0-d6a8-4d8d-bff1-beaf35a909cc", "comment": "Malware payload", "value": "e3c475c1c8d1cb43815537ad907933af", "object_relation": "md5", "Tag": [ { "name": "cronicasdelcentro-com", "colour": "#DAE453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gibelohc-cyou", "colour": "#F5BA34", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770679306, "uuid": "3a8da8d6-ef21-4c4d-8b77-0604515a958e", "comment": "Malware payload", "value": "ece645ddb7d6f50baf4df5443ea124aa3484f41617c6192b0a75d94f65f0aa9c", "object_relation": "sha256", "Tag": [ { "name": "cronicasdelcentro-com", "colour": "#DAE453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gibelohc-cyou", "colour": "#F5BA34", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770679306, "uuid": "3bd2fea4-fcae-4f4c-a6c7-8c76801f73ad", "comment": "Malware payload", "value": "410d63a67e46bf9b698087a77a44ce564f7884f9", "object_relation": "sha1", "Tag": [ { "name": "cronicasdelcentro-com", "colour": "#DAE453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gibelohc-cyou", "colour": "#F5BA34", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770679306, "uuid": "f5426e10-6537-4e66-9906-47a6422cedbb", "comment": "Malware payload", "value": "82e4752c5c511e05056014186bd1838d178c45ba1a6c2ded2c64eabdee0c5c73ef7da851b9e657630d13f2634dc22a11", "object_relation": "sha3-384", "Tag": [ { "name": "cronicasdelcentro-com", "colour": "#DAE453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gibelohc-cyou", "colour": "#F5BA34", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770679306, "uuid": "3ee51bf2-99f2-4a48-8f60-dcbc93184e6d", "value": "T12A95CF3F6BAD45D3E1E6117B8EE9321F1874FE540770C2B63681696B0F118822DAA73D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770679306, "uuid": "623f2d23-646c-4785-8b5e-2dbe0304c54c", "value": "6988f16b4e789cf2d707efe5eae0ca02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770679306, "uuid": "cf9d1d97-6837-4288-af22-c743e71dc1f4", "value": "24576:EQs0MgiXiGMM8qXjyoxMat/woWMT0mprPUcwy5jc80cbA7IeObC9HWnTvuu:uhXiFNqtxryktgdoc78n6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770679306, "uuid": "d16f4625-56b5-45e5-817b-9686faf46058", "value": 1932376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770679306, "uuid": "17a5a643-8f4e-498c-b3bb-a8de508184d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770679306, "uuid": "24822f79-feba-4502-9635-e4ddfafb72fc", "value": "Ethos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6126a44f-0550-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770597821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597821, "uuid": "1cd017ce-d6f6-480d-8942-ed6f7f46b25d", "comment": "Malware payload (Mirai)", "value": "c5ee7e8b871191f48a2646d6c6b18d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597821, "uuid": "82848f73-07a2-4084-82f3-86e333841a80", "comment": "Malware payload (Mirai)", "value": "edce810c0535582f41ec0d731c60f12d30230ad498fa96354c85f3a7f4bd60c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597821, "uuid": "7e7d340f-7e0f-4617-a453-0446ce93ab0c", "comment": "Malware payload (Mirai)", "value": "7c65e1a8a9ec10b25ec9b13e8a388f86267cd78b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770597821, "uuid": "7a0d0688-c15a-48b9-8a28-247db2bdf4fd", "comment": "Malware payload (Mirai)", "value": "309868ce861e3659cb81291c27548332f99865b1ace6c5141ddd5d7f73a88d2856d4cde91d743ec1a46064c7e0b31088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597821, "uuid": "7a3b6cde-4dee-403c-a0fd-413514354d9d", "value": "T118147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597821, "uuid": "e49505dd-25d8-436b-9153-4d148bbb0472", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR0UKG:IcY5JpMByVs9jSHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770597821, "uuid": "c8b32090-a2d1-46f7-8a9e-ef0e546704c3", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770597821, "uuid": "8659d544-bde9-40d5-8149-ded0a10fe33b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770597821, "uuid": "8f35aa7e-515a-47db-b7c8-3db1608cf565", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a9ceb6-0556-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770600346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600346, "uuid": "6fdd2fcb-ae64-4d0b-a646-91db1c5b57a3", "comment": "Malware payload (Mirai)", "value": "b32ebe71d96456a77447ff1241f49b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600346, "uuid": "b0c5afcd-6c0f-4c1c-860d-4a30dce996b9", "comment": "Malware payload (Mirai)", "value": "ee0dd1fc46f34c3c8e957418af6556ebd43f0903b072784e8e737441fd430e12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600346, "uuid": "026087fd-19c5-4ce6-8bc7-af98c9786aa9", "comment": "Malware payload (Mirai)", "value": "cbe0e62fd8c35fbc82d5f1917200b7ada82e5a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770600346, "uuid": "8face79d-44af-4b5c-8c20-fd62c7c309f4", "comment": "Malware payload (Mirai)", "value": "589efe7a88d803610efa70ad0e97f32361a31a98066c595cc9db9e723c5859208ae7cfe583e0bc52bbf6db3b05108d22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600346, "uuid": "d3e4a684-f9c8-4f43-918a-578a6d9a8301", "value": "T1D06316857880AA26CBC0167BFA5F008E331467D8E1DB73479C145FA176CAD1F0DABB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600346, "uuid": "43a3fb5c-6aad-4ca9-804f-9f2bc0fce414", "value": "1536:BgNL4Rs24f0rf3zcGEd83+k0D9yJHjMhW25WeiA7s:BgN8BEmOk0RyJHGv5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770600346, "uuid": "6568f75c-aceb-41d3-9849-aec9f37ec1e9", "value": 72304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770600346, "uuid": "ad2b0f40-55f7-4d0e-bdb4-d495b6005674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770600346, "uuid": "e37cc659-69d8-48fd-b5d8-6f2aa8ffba9b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aaff7f-0584-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770620115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620115, "uuid": "b065b137-df13-4299-a0ab-f73d0c34b325", "comment": "Malware payload (PureLogsStealer)", "value": "78707f2dcf8722f2eaac262ab1c38916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620115, "uuid": "086a6f85-b773-4cb2-85c1-220ca961172f", "comment": "Malware payload (PureLogsStealer)", "value": "ee20da5d0de398e97b3d9401324d79f38edd7314ea9fb05ae6901ed48d62b351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620115, "uuid": "314752eb-00f4-42de-964a-399d40436076", "comment": "Malware payload (PureLogsStealer)", "value": "915aad1b1d6dd3af70300468e6b23781e8b10fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620115, "uuid": "00e341df-8a8c-48b5-942c-4028466587ab", "comment": "Malware payload (PureLogsStealer)", "value": "33d0243dc809f2a8c023182e7c974c734acfe4e9d0940badb8a131c4a82f1a24f8243f15714e50adcb5a4d6f94c02047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620115, "uuid": "3ca6b655-de61-4669-a908-83267743779d", "value": "T1E566071973E3C15BD45236B0C94686EF09A5EF24AFF1D487368A3F4D7B70A826E1D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620115, "uuid": "117d44d3-d0bc-40d1-92d7-2146e408fb58", "value": "54b94c55ca0500a1a89fd7d736b44969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620115, "uuid": "b3c068e2-8fd5-40c3-a427-122a59000b7b", "value": "196608:u32vT3roNzBeyhlBBBr2Eyw3zgrWkMsZkSKl5f8PuW3h:u3cTboNz4yLBBBr2EFkrtMsZkSKlt8Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620115, "uuid": "a0dda5b4-93f4-44ee-9f59-b3c2f0da1445", "value": 7113216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620115, "uuid": "44933c2a-07d5-4136-92bd-df92c9ad1a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620115, "uuid": "dfcd66fb-a18a-4f46-9a00-149cf48eb22b", "value": "78707f2dcf8722f2eaac262ab1c38916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae96147-05ff-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770673106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673106, "uuid": "c8ebf80c-84ca-4bb5-89b5-38035d306d5c", "comment": "Malware payload", "value": "a18cd7ec30217f33ab56412d9a9c1bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673106, "uuid": "dded5a3d-8b36-4db7-83ab-23f6f3024019", "comment": "Malware payload", "value": "efd34ae988e1203ea015b84d2ce234156aa4ac6555cdb90dc9b9ce356208bcf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673106, "uuid": "0d30b0ae-a597-4429-ba71-449b38d18eef", "comment": "Malware payload", "value": "051df94f04b453d8a8c3dd1209a62a42cdf3456b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770673106, "uuid": "0816f655-88ef-4a43-b482-d2de00e0580c", "comment": "Malware payload", "value": "85ee381cf58cfa527d2114e61ba0ebad6d1883087c7b9376331c67e91fb9d58fdc386863e0c952184b170d1e762187ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673106, "uuid": "688fea81-82a8-4b9d-a6e7-a5bf0ae5714a", "value": "T15C183344D49CD431F3B1A0BBB22C5D3A649E87C017A75BFD972EE6A87324249EB0C65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673106, "uuid": "55ca09b2-41e7-4892-9fcb-5a021f363335", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673106, "uuid": "c3741041-3647-4ad6-8b93-e914fe9acddf", "value": "1572864:AejOYfhsHGleg4ybmMwcjavkIBFfQcTvk0rRYA+m9yZUL8V1UybGoaorPe7:A4JiGlPKNkavkI3jfrR2768VCybG1gm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770673106, "uuid": "bb1a3be2-beea-4618-bba9-25b26f70a830", "value": 85515382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770673106, "uuid": "afe1bc65-5e29-47a0-9137-b8d25560153d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770673106, "uuid": "99104a19-1bce-4816-9070-ef9224d6506a", "value": "KittiesMC Launcher 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2cdbbc-055d-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770603615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770603615, "uuid": "4e4a9e53-7fab-461f-b9c4-7a296024d85e", "comment": "Malware payload (PureLogsStealer)", "value": "eaa2f3dbb22de6a207d82460c9fca1bb", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770603615, "uuid": "bf0df4ff-81df-43dc-818e-4c4007b20256", "comment": "Malware payload (PureLogsStealer)", "value": "f109515f663d0577a8e86255e79ee66469af29015f861c0b293839beacc9322f", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770603615, "uuid": "bf43f4a2-0678-4b51-9deb-0ff1ba414f5e", "comment": "Malware payload (PureLogsStealer)", "value": "dd4b1482baba09b589434ac44dedfa5e7b6ad609", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770603615, "uuid": "8377d2ca-4aba-45f4-ad54-424860e43ca4", "comment": "Malware payload (PureLogsStealer)", "value": "4f3a322aea85f6b639194997e4225f60ab1d1c72b0e6193e4191c99879172850a0b2c0ceb81527dee02c35a4a99c357f", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770603615, "uuid": "ac65e2e3-78be-4a95-aebf-bdf3c035a22e", "value": "T1E3F5E1004EA62F748FA9061954FD2ACE97AD0BDD10592DCDA727BFC5EFDB88841CA0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770603615, "uuid": "be106996-1091-44cf-af30-a1603ab51fa7", "value": "24576:nSGPas4pKKupJuFW8qwpbWifCwU1spX2wACpsU9QpCULSk+B06GELsKWFBfaAxN+:nSBhcYdppbHQAeDwsHlx4eQS0ZWvW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770603615, "uuid": "606ff786-57c0-498e-87ef-25f5689c1664", "value": 3452981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770603615, "uuid": "2d7c6a1e-145d-4be6-af37-6c742f3385cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770603615, "uuid": "3bf4d354-c94a-4799-bfab-0e6779f52afc", "value": "RFQ 1462 dated Feb 9 2026.VBE.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e9402-059d-11f1-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1770630909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770630909, "uuid": "adf9a2d1-9db8-4dd8-8212-48dfb42d4d51", "comment": "Malware payload (DCRat)", "value": "aa12c0a45d7fde9e5d986ceb702e7efc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770630909, "uuid": "14fa2f1e-1dba-4936-a93c-bfb36984e1d9", "comment": "Malware payload (DCRat)", "value": "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770630909, "uuid": "ed598ec5-91bf-49a9-a0ca-cdf9e974c9e9", "comment": "Malware payload (DCRat)", "value": "ef7c299b902a9dc306ebe833e8389bb68a74c03a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770630909, "uuid": "49593124-620c-4339-9e5d-b07341f9d5e7", "comment": "Malware payload (DCRat)", "value": "383e242a0cd9a100f18dd865e0e379af6e1deedac5aee25c80bb302d98b39205c6ac9f389b49ef31ce6daa14752dcef1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770630909, "uuid": "3374f4f4-e3ae-41d7-a463-ef5a34746052", "value": "T11107330A551D9593C460CA2C6304230BD0EE6EEB6CF4EB13950EC3B57C6E762CD799EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770630909, "uuid": "a544a233-b3c0-4c04-83a8-5c4fc52d0053", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770630909, "uuid": "64ad9fb9-3a93-4b9b-b500-fca17429c623", "value": "393216:CxyucsuFe4J4XA5bO86V3K0ry1Yd8ob4meNHiuAJkVI:22WX6hE6YO7m0hAJ+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770630909, "uuid": "5adce33d-db25-45be-90bc-d2f6f72052a2", "value": 17932288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770630909, "uuid": "6f7db5fb-bd14-42ca-8804-c10dbb4a8021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770630909, "uuid": "48b569bc-947b-48dc-85e2-333b44b688a9", "value": "AA12C0A45D7FDE9E5D986CEB702E7EFC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1c84ed-054d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770596737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596737, "uuid": "1afd9972-d27c-4f50-ab8c-d4b0be0111f3", "comment": "Malware payload (Mirai)", "value": "472f74155d775642488b473a1a3b4b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596737, "uuid": "605c3e67-cf8f-47d1-9158-434efd624289", "comment": "Malware payload (Mirai)", "value": "f4298ed9056a2adda44b427aadf093a85fca4d91dad767ef23829717b46e27e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596737, "uuid": "a379ed3b-d6e1-46e3-a6a3-cddb144f06c1", "comment": "Malware payload (Mirai)", "value": "7848094848d2789e23696778f9ea6ccb4073d2a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770596737, "uuid": "dad87eec-6590-4308-8929-2286d461b5a3", "comment": "Malware payload (Mirai)", "value": "e99d6ff97b7af8d5446fb646bbf115e4ac5686720dfaa3a1b592dab423b65392e29a005355076a50442ecbbf8c48dbe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596737, "uuid": "89b4f3ae-11d0-4323-8d94-69d8ff43dc87", "value": "T120C3E185BB6369D1C1A242BDA4C00AC387916E318FA317080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596737, "uuid": "08e19d16-b5f4-4d82-a1ad-f048911df24b", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnX:0OCDjXG9qTWywxlxTnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770596737, "uuid": "e2854b64-5f51-4b2a-b766-fd914b786dc1", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770596737, "uuid": "3b352880-47af-498b-93e3-54c423676877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770596737, "uuid": "dbe2f1e5-1678-4cc5-b5e5-634ba2414a26", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd44e196-0552-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770598941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598941, "uuid": "d67d7860-9161-472d-9039-25091b4dcbb5", "comment": "Malware payload (Mirai)", "value": "68fa95ca8e785269f2e3df96f657f046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598941, "uuid": "1b33c90f-f532-4aac-989c-132a85e458db", "comment": "Malware payload (Mirai)", "value": "f49992628f1f04f6eb7e8c3dfc00f4f878e444be767fb57750536705b67b1b26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598941, "uuid": "4a62c524-cadc-4187-a981-9a63b5a3e25e", "comment": "Malware payload (Mirai)", "value": "26fdcbc9e159dd4ecc06819372e1d71d2a54c9fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770598941, "uuid": "211935cb-1ede-4092-8487-bc5e8fb65bba", "comment": "Malware payload (Mirai)", "value": "45f370b77225e47970bdd441c118ee95eeb563c50dda1eef0a73d3eb0902c5d69f3f9fbb82598d01e48cfd9c8f411701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598941, "uuid": "18011a81-ddf7-4e15-89cb-c1e64ad51aff", "value": "T160C35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598941, "uuid": "2f628422-10af-4a13-90be-956d5476cf2b", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy9w:VoRNjmj1VGFVrRiyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770598941, "uuid": "5d89aac4-699b-4877-be47-9d0e80fbdf34", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770598941, "uuid": "eae7d56f-716c-4629-8696-469d13f75b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770598941, "uuid": "16d23858-8a2e-4055-a287-24d84935aba8", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5ab665-05c7-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770648919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648919, "uuid": "914b87c2-d8a7-4910-a26f-07e54087e5f4", "comment": "Malware payload (PureLogsStealer)", "value": "1e448a0f22b85f6379c4f6a954e920dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648919, "uuid": "77f3c441-bb2e-4338-8039-3388b12ffc59", "comment": "Malware payload (PureLogsStealer)", "value": "f4d8330b3914066db4524fe9b72f613974277edd4e90c43aa994d6457ad3a66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648919, "uuid": "464123c5-ca2b-4b4a-b574-340a5086b9ac", "comment": "Malware payload (PureLogsStealer)", "value": "ed77542afb37261297cda4e42dee2e1bf9b7c129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770648919, "uuid": "c85972aa-5bf5-4d91-bbc1-01e9866c3fae", "comment": "Malware payload (PureLogsStealer)", "value": "35ab16c42351ad03e75d164ac55d48b47f09bb57b4fa8cf97a9c6d93f9da4e81df408609cb4daef62144026090537d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648919, "uuid": "32c9f334-8874-4dd3-a8d6-b82172b1bc72", "value": "T1EF45236A39ADDD51C0D91BB51061D57043F8AEAAF812D3A1CFDEBEEF7A1A381044C247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648919, "uuid": "27a2b629-f83d-4fb7-8267-db20b04b6523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648919, "uuid": "29cb62d4-03cd-4561-abbc-9e91f8e5f9ae", "value": "24576:Vad+guQ9O3/frumiDnIFXa2YyfoMFO106JYT8qAEtNF283ZALD:i3ud3nrumicFXa25fomci8HEtC4AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770648919, "uuid": "865a7b14-b8d9-44b9-9443-07d0c9083ee8", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770648919, "uuid": "db8ab082-43ea-4486-8923-366760cda661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770648919, "uuid": "066e3171-da72-46f7-93ad-7ee1f300466f", "value": "usm7PLW3ukc5Y1r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d6e1e1-05c8-11f1-a129-42010a9c0007", "comment": "Malware payload (Metamorfo)", "timestamp": 1770649395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649395, "uuid": "fa2073ec-6ce1-41bb-985f-9bbc2034e462", "comment": "Malware payload (Metamorfo)", "value": "8b18b1bb132496f243db022023bfc726", "object_relation": "md5", "Tag": [ { "name": "191-252-214-115", "colour": "#2CD15D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649395, "uuid": "d6b07f03-036b-46c9-a89d-90cac6fd9330", "comment": "Malware payload (Metamorfo)", "value": "f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2", "object_relation": "sha256", "Tag": [ { "name": "191-252-214-115", "colour": "#2CD15D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649395, "uuid": "a11d4dff-c93a-472f-b986-0adf5479739b", "comment": "Malware payload (Metamorfo)", "value": "7fc260f7ea6b532774ef0ba1607c61a4689629d2", "object_relation": "sha1", "Tag": [ { "name": "191-252-214-115", "colour": "#2CD15D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770649395, "uuid": "40ab0a00-da88-4636-a517-b60e31967b2b", "comment": "Malware payload (Metamorfo)", "value": "316a5fce09d2a9a63dcae697b8b59433d959a2d55017ff8c257ae6d620bdf734b62c203b5c69c037372a3b0a9b961749", "object_relation": "sha3-384", "Tag": [ { "name": "191-252-214-115", "colour": "#2CD15D", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649395, "uuid": "cc4b432d-38e5-49a5-8a36-e03f236b47a2", "value": "T195862316B38BC226E65C02B7F82DEE1E14397E63077001E776E97D4D5D748C263BAA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649395, "uuid": "64a30ce5-3547-4ddf-b3dd-ae0dc94136fa", "value": "196608:FxFAGe1plwCyRlu+XoIB8xD1XvkuJ5kx8WYKcp/ipq:9AB1kRRXoIB8J1su/kMKcpKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770649395, "uuid": "140b4363-632b-4e8a-8a47-841e8610648e", "value": 8503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770649395, "uuid": "2f30a651-ed04-4fe5-b7d7-caa6ab04d951", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770649395, "uuid": "4726e347-8bd9-412c-a072-7df965d96743", "value": "f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d48723-05be-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770644959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644959, "uuid": "cae112dd-6e64-4923-afae-f18135b3521b", "comment": "Malware payload (Mirai)", "value": "38cce8556c0596e5105ebc18d39525c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644959, "uuid": "b67442e0-0e93-4eda-8a98-5721a1627c62", "comment": "Malware payload (Mirai)", "value": "f66cd21389c4ea7ae1f2dd63d69c715a0b26dfbdbea1c610183c1794fd61b675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644959, "uuid": "d83f6f93-3334-4353-9a8d-a1e5598d5657", "comment": "Malware payload (Mirai)", "value": "a711c3c783eefb4e26df3d0e003f6316ab7179ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770644959, "uuid": "a01704ff-dfa3-4f49-8ff4-9d6bca75cb8c", "comment": "Malware payload (Mirai)", "value": "c1969d8d6896947442f31c4243da9adddf7c8b95bb87b0f86fd2058fda9a73a7eb01fbfba6f8b7a1526348005ab7bf89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644959, "uuid": "50288f8a-9b21-4237-9f05-8cb608abd20d", "value": "T1ECB56D03B6D32C7DC4D6DF70974BC3BAAB30BC604615283F7AD8D6341A66A949D29F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644959, "uuid": "23aae88b-70c7-49b6-af99-4029d13f3888", "value": "24576:hn8LCAfF9+kz8Uu16OOKqoZAJUNs/ILFhB/XbOGmCJjkMVbb7OaCqfttc8mXiwKa:hnCCAfFl8pnqmAJUNsgBh74Hmth8hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770644959, "uuid": "d675d651-b53c-40f9-9972-4db0d361cf26", "value": 2368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770644959, "uuid": "4f868350-7c85-4c9a-af93-4a15298acfaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770644959, "uuid": "63432345-ddc8-4e5d-bde9-b8d8c69eb6e1", "value": "7233474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8608f5b-0584-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770620328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620328, "uuid": "d60d1b26-c62f-4604-ab71-51cee6ca0abf", "comment": "Malware payload (Mirai)", "value": "aec8f03629fbca22a2b352a84d0dfec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620328, "uuid": "1fff304a-b4aa-43d0-bf2f-d159f1bb9473", "comment": "Malware payload (Mirai)", "value": "f6ff541e0d57be871e1959e8499b62dcf84d823fd6a09a67ef709768d4658c71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620328, "uuid": "f49fcce6-2c2a-4a53-bfad-fb6f4a6752fa", "comment": "Malware payload (Mirai)", "value": "3192ba2c89da388bf09d322d886638c3d7d81b23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770620328, "uuid": "d43f4b59-2030-43cc-b389-220ec5538bfc", "comment": "Malware payload (Mirai)", "value": "88a1563a3a7a16ed430bd53e1c2997a0eb3c88683581cc444f08b21f39dc39f90ff9efba86a6c374010c4639f4eb9fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620328, "uuid": "31a76e69-b440-4184-8db0-1eca69c14c2a", "value": "T127C44B59F8809F61C6C5257AF75E829C33134779C3EB720699245B383B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620328, "uuid": "c0a55db0-70bf-4667-bdf5-5e9890310dc2", "value": "12288:udInlO1xnATUg0XMgOYFyMKWYUvIO+gpEorvvj:uN1xWMOYExWLION7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770620328, "uuid": "6e2e2094-95aa-4e88-ab39-c3c38ea1a3fd", "value": 575212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770620328, "uuid": "35374ff8-ed29-49f2-a227-3d2a0cab05e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770620328, "uuid": "5786531a-50cb-4ed4-a6e7-6bbc219e3e2b", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baf7d06-0589-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770622373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622373, "uuid": "a4e5a96b-fc8a-465e-92f3-418548a15bda", "comment": "Malware payload (Mirai)", "value": "b4ff17c3d4e677e426c0aee301718166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622373, "uuid": "8a714ed5-67e2-4395-b072-235421693962", "comment": "Malware payload (Mirai)", "value": "f88c9a3565ac1fa6a444415dbeda79fa48c525eb386d0fafc9a029c45990c316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622373, "uuid": "f01ed505-36d5-40f4-85fb-af6add040b25", "comment": "Malware payload (Mirai)", "value": "82c89f0554a24bea7b70b939c9716220d453f884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770622373, "uuid": "2e4cad77-d461-4748-a5ff-73839b1661a9", "comment": "Malware payload (Mirai)", "value": "324250053244ed1e882f7b7003b6992d5ea7de7a882a50bfa7131f7d95fa89f0ff1a895ab29a190580ab5f57fb0d0807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622373, "uuid": "611d790d-c18e-42a8-b5e9-dc891235f06d", "value": "T103C45D59F8409FA1CAD529BAF65D929C33130775C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622373, "uuid": "6c396ba6-412f-4e96-9b54-00a54c43ab88", "value": "6144:lAFp0VhOmS3SVGqXzc8Y8v/2WVunQzCf/M8vSXcAvBG37DKYsKCMgtgpEorkHhkY:aFp0VWaGqDRiMGgDWXKpKegpEorkHhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770622373, "uuid": "fe4a349f-347d-4857-b64f-84732e72db5b", "value": 575316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770622373, "uuid": "507ac1ad-3b10-4cc1-94c5-ac3291208c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770622373, "uuid": "6ca59f8d-3e7d-4530-a957-e323c8283b7a", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd19193-058b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770623422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623422, "uuid": "40c0b0c9-ed8b-4d0e-9251-3c0b242fb9e6", "comment": "Malware payload", "value": "066065a15a43b607aa2079502f66eb5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623422, "uuid": "8100a8ea-89e3-4bef-ad4d-713ac9b130cc", "comment": "Malware payload", "value": "f9fab0316b99cb5a4ed1fc601c9c5413e28dc42927134627d87f78e3bbf0a337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623422, "uuid": "b577f3db-bc7d-4cb3-b5a4-4f09b0e614ba", "comment": "Malware payload", "value": "c124035c7f1eb3f2c7f615beb2c797fefa281c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770623422, "uuid": "bfc94eb8-8bfd-43b5-ae13-da1aa72661e0", "comment": "Malware payload", "value": "58091d307d059e32ad4694e9048be65b2f16e377b58648e18b7a34045161e7711fe3bc9bc09bfd4f8402ca879ca2c8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623422, "uuid": "e33b2476-e3e5-4763-a7d6-a75d38454945", "value": "T14A752906BCE614BAC17BE1314952A3617A327C7447326BDB2E80766E1AB9BD43F3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623422, "uuid": "ca68de77-1125-44a0-a592-489446974f54", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623422, "uuid": "0b1e18a9-5e6c-4d6f-8b89-f1bb3c3dd341", "value": "24576:3Ali/soPvovrA+5tKmjh00yjtVWdoVE1:Z/soPvyA+5t9oWdoVE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770623422, "uuid": "c68d222e-ea05-46cb-8fbf-6e39ebcbc5b5", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770623422, "uuid": "81773b00-d465-4d81-922e-8cc74366bf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770623422, "uuid": "88f590d3-3e74-4637-94cf-4961f615ac81", "value": "066065a15a43b607aa2079502f66eb5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be96e0ed-0595-11f1-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1770627613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627613, "uuid": "2da2b223-7930-40ba-adde-f87830d92d37", "comment": "Malware payload (Phorpiex)", "value": "45205d4a5d83cee63d4d1a6e81d773b1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627613, "uuid": "81a31bf4-3d16-4b0a-936a-7861442691b4", "comment": "Malware payload (Phorpiex)", "value": "fa27981befc05c8ff74d9b796b30525c6cb048b0a91bcd134941c50db7c56ddb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627613, "uuid": "ca821dbd-e172-4146-b0b2-a88748421d99", "comment": "Malware payload (Phorpiex)", "value": "71aa513be9d7af641853e2a3b58bbfe400b27764", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770627613, "uuid": "673a568f-b4d3-4fc6-83c5-3c2dc4660498", "comment": "Malware payload (Phorpiex)", "value": "7b57ee63eab2464f35f72006f756f9e814a921b3a1fd0a8c0be2df2ab85edb31a2f7e84d0ae807352d1cf684e37973e7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627613, "uuid": "799aba6e-f807-4d2b-9b7f-ae7a0ee1b089", "value": "T1CF123A1B7ECA0071D3A14DF066B84B9D4B7D542327D662EFF7B3C28A1F64345A0472AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627613, "uuid": "057008a6-dcb4-4880-9e3f-e062f2c10b25", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627613, "uuid": "5aa44e2d-a8d0-467f-9a9c-97fe172b5321", "value": "96:DI4iMmZ2ffYt6B9wroBPyYdUDi8Z+Z8WrEVVknsnrKFJxGE9b+z2FFhRC7tCEZZg:DjgEffYwEoBPsZ+C0AKFJxTZ+zmFhyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770627613, "uuid": "763a4758-5483-432b-9693-c63e2b1553f3", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770627613, "uuid": "76d3a845-c99b-45dd-8457-f126bb5074e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770627613, "uuid": "d7109ed3-93b1-4135-bd40-bac408027fd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e90aea3-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646886, "uuid": "8b97d5e6-008b-4ff4-a3eb-dcd4cbb8e35f", "comment": "Malware payload", "value": "4b82b0109df050e318349fc4790dcd72", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646886, "uuid": "81da8bb0-6b19-4897-821e-c027675f3517", "comment": "Malware payload", "value": "fa9c3fe970fd0b7f9a69a6c9d02af2cf3562a9c2bdb0ab661f7c7c025d9e8e9d", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646886, "uuid": "7afa0f85-da4d-4cf3-85b2-c568f20f9813", "comment": "Malware payload", "value": "a90f97619301fd95250b8c9a9496d3b0f5eaf479", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646886, "uuid": "05318b54-419f-4bd1-aabe-576fe59a4921", "comment": "Malware payload", "value": "40b784a16b8517f9a3dadd8246ce52c6cf750bb7507979d92427fb90d6db6b127dd939548c8f985e149c2effc1b8cdac", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646886, "uuid": "bf2b5ca8-9a72-42b1-8396-371b7a28d374", "value": "T16EC1370056E99608B6F36B06A9BFA591493B7A6D5E36DB4C0048D54E13F2A04CC67F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646886, "uuid": "b6d35248-0a7e-4cf5-b7bd-6f90a7ad3942", "value": "96:CyEBs5sZ5MfOOtdyFwFiODBhsZ5/HAOKmAMxdmKWROyHuHAtpm0jNvziip2sMZmd:Cyeuf0qFicyKmAMxdm7OspDx2X1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646886, "uuid": "90fc53ac-f8c3-43e7-b73b-04e602cc465f", "value": 5894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646886, "uuid": "b9bd04ba-1950-4d89-a033-0a15cd4d41b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646886, "uuid": "81c19bf4-b184-4846-8e68-d9212cba5a34", "value": "fa9c3fe970fd0b7f9a69a6c9d02af2cf3562a9c2bdb0ab661f7c7c025d9e8e9d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6262f4-05c2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770646802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646802, "uuid": "59cb1eb8-f691-4f71-ba59-5aaf34d7365b", "comment": "Malware payload", "value": "0e2a1d0f3fc8df3b0afe810a87cf36f5", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646802, "uuid": "b7133c8a-1db4-4abc-aaae-724ab993a704", "comment": "Malware payload", "value": "fb341db156218df96f4a35875e366faf4defc5c3649f4b2d3d5a8e00b0f27f25", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646802, "uuid": "0eb590ce-ae28-4f98-a24b-658307dcf866", "comment": "Malware payload", "value": "51291e4415bedc9ea53a3832dc15de0a053038a2", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770646802, "uuid": "712c74a9-f44d-405b-bc8d-6295d43430f9", "comment": "Malware payload", "value": "393dcf6184fc133bf93aa0e1dd3ed45edd0706a6a627dfc84fbddd82ced434174a2d9f9d480a4d6acef7e94bad9cfd34", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646802, "uuid": "ea0d2e3d-795d-47ca-a140-95f641e0cfd3", "value": "T1AFF2AD11729F96087173568D0AAF06B50BAF7A9E0E3E418904CDF68A8FE3511DD973F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646802, "uuid": "4518704c-c305-474e-9144-6023eaa02c44", "value": "768:vMkjksrrYQWhhhhhhhhhhhhhhhhhcUxX5dDh4kGYRrm1n:UkjksrrYQWhhhhhhhhhhhhhhhhhcUxJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770646802, "uuid": "d8801324-c119-48c8-a2c6-9a125c38bd73", "value": 37104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770646802, "uuid": "f57d7c60-d305-48c5-828a-c910efec9bc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770646802, "uuid": "3c1f3f8c-e417-4c0d-bb03-b127eb8a8047", "value": "fb341db156218df96f4a35875e366faf4defc5c3649f4b2d3d5a8e00b0f27f25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf04f6b-05f9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770670588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670588, "uuid": "a5637e0e-dff1-4a53-91d0-da6a27653acb", "comment": "Malware payload", "value": "cd4e02c4c2a2163db7136317dd16bdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670588, "uuid": "8f44db08-8209-4d79-a46c-53b914a092a1", "comment": "Malware payload", "value": "fb3738e7287f446b6cde14755315150b84bbf12de3ea71d6a4849b4854ec6b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670588, "uuid": "fd481987-311e-4f03-895e-c74ecd70a141", "comment": "Malware payload", "value": "920b69f24a7c010c14b83a0838d6117683f580e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770670588, "uuid": "d1dcdce5-04bc-4dc3-85f1-afab1259294a", "comment": "Malware payload", "value": "93b1351519e5d74d8307b7744323d443bb1227bd2efc5bb4eb53bf40fe4e53afd0306dee0a72b3d70e85ef8f64e24cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670588, "uuid": "dd63c20a-7b0b-4bfd-af2e-77a4d1714bfd", "value": "T1A414F08433499960C6AF89FD2A82A2055B71D27B5887CB4F7DCE8CF025837E15F25CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670588, "uuid": "5024494e-0d9f-40a7-8795-2f96337d3221", "value": "6144:CXCj31YTkuuKDv5fStRerux7RWLzuczo8K7wbwzLX:CSt8KtZpRWTveZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770670588, "uuid": "b2a21ebb-d0c2-4af8-8f8c-f11d6f7710f0", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770670588, "uuid": "6f5f0b09-f766-498b-a68f-484abe54d4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770670588, "uuid": "da0276ab-b5de-49cf-9b10-1dfe1b812fdf", "value": "fb3738e7287f446b6cde14755315150b84bbf12de3ea71d6a4849b4854ec6b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527af53f-05e7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770662650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662650, "uuid": "0e923b91-1ffb-4ee8-a76c-e4e7455446c2", "comment": "Malware payload", "value": "a4be2ab7cc353744059cf1f007f953a9", "object_relation": "md5", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662650, "uuid": "72394d5d-4ea7-48c5-966b-6cd3af4310f2", "comment": "Malware payload", "value": "fbf00aa7b79036b1e937cfcebcf6f565ab4c79a05fc76df5c90a547bd51f610e", "object_relation": "sha256", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662650, "uuid": "ec3c3f20-ccc7-4105-9e55-9f4a1bd19f22", "comment": "Malware payload", "value": "343baae96a08420666d2df3659dc6eaf7a11e5c6", "object_relation": "sha1", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770662650, "uuid": "786b3bc6-6728-40b9-9bf1-66f096b7872c", "comment": "Malware payload", "value": "57ec4d468facd262823dc0b1ea52c4bb9ee08d4aeb85a2f3961c9737fe5342ab98491510ac7faf9f6b45c7ff52c07ce2", "object_relation": "sha3-384", "Tag": [ { "name": "byteguard", "colour": "#CED109", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662650, "uuid": "5cd851a3-678c-48b3-aa8d-442530532bdf", "value": "T10F55E02834C1F130F96E8D3F7AFADA33411B61653EF3561A29826708096CD94DDA1BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662650, "uuid": "eadc64ad-c481-44c0-ba61-7452b12cc955", "value": "24576:oA9kXv7RLpRvz2wYzUQtzGnW3EIzcPf/f9ES:wXT9riVrtKwE9vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770662650, "uuid": "76f2ed8c-3a6b-4f0c-9cda-24b236932f49", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770662650, "uuid": "5d5c5907-77c7-43dd-a197-9e88d84fbcba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770662650, "uuid": "5823a310-dcbd-4c4c-924e-09a7ec4d3af8", "value": "fbf00aa7b79036b1e937cfcebcf6f565ab4c79a05fc76df5c90a547bd51f610e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba3b313-05b5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770641083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641083, "uuid": "25e60c78-ecf9-48cc-8562-036a6653036e", "comment": "Malware payload", "value": "9c2eb1670d4884861df52663697194b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641083, "uuid": "d040b173-ff1c-413e-80bf-63d2ad346c65", "comment": "Malware payload", "value": "fd563356fe277d0592c8f11705dce4959a9b2d12ea186cd8a92e96c16cf1dae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641083, "uuid": "d6d18b11-8223-4c92-b789-291abb7c2a31", "comment": "Malware payload", "value": "d8f7f67c694b38658b4d6f027262a4c31df62ec0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770641083, "uuid": "d288b8c4-ecd9-4fe6-bc6b-bcc74b4ffcf1", "comment": "Malware payload", "value": "ef5ba29183269958bebaba8b9213da5e6dabb7ff5576044fb2d3cbbbed8fc730de6a862186fa46b85ef6f9314db03df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641083, "uuid": "d5522b08-456a-406c-aea0-f4984837f8f0", "value": "T148242275A17B87C5DFB7A57A10148F3A6C2245AA9C834B82FD2CA116D75C37B044B733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641083, "uuid": "0331d6e6-d584-4b8b-b6fc-4507d9e000ee", "value": "3072:imN/vPozEZaYyjGcTxIgJH18o3vkivp2yxeZVEmS9dtJ52zW1qSpBRU0ycxGpBFJ:ZnyquzduGcs7xSWmIdN2y1b+m6qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770641083, "uuid": "aae8516b-9145-4d9b-a949-97cc574583f6", "value": 211088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770641083, "uuid": "835fb80a-d10f-4111-af42-2c008521049a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770641083, "uuid": "91f0e45a-f13d-4f05-b8a9-32073f08e17d", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f60d00-0553-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770599277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599277, "uuid": "d5828963-a0bc-43c7-b27e-9ac46fa1b2c6", "comment": "Malware payload (Mirai)", "value": "57270a40a6455b5ae678518b4e4f8e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599277, "uuid": "48a8fbea-2541-4f0f-9143-949845616112", "comment": "Malware payload (Mirai)", "value": "fd6506529e858ac40d6e36dd929a8cb5befd48e505ef3f3f6d01da6d29ad5378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599277, "uuid": "230b2660-f96c-4ea4-b3ca-da3e1391cd27", "comment": "Malware payload (Mirai)", "value": "3c0ab49d923622fcf60fbf67f4f04eb2e256b286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770599277, "uuid": "6f1a39a8-7c43-4fe4-9f14-3f2eb03a06a5", "comment": "Malware payload (Mirai)", "value": "1b9afbf99df86aef3b43c0959c4b14dc65fff2ffd8a27f6f39f9f074d9474b659a1d0e928a8856d5bc9df9119c41d059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599277, "uuid": "9b35a9a2-b095-49ab-a849-0fc9f7aaf709", "value": "T1CE73D605BB510FB7DC6FCD370AE90B0635CC598622A87B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599277, "uuid": "bb7573ec-2f5f-416a-b675-d81a6be8e8f2", "value": "1536:PHX67jqw4DAO3AC+5hXp+ZnPPqeNs9ZkwBW0:PHX67eNH+5h5+VwfBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770599277, "uuid": "31c1b823-962e-4a18-bae0-92274632c6a9", "value": 80676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770599277, "uuid": "5d003151-a0ef-43ec-8e8f-26a77ea91d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770599277, "uuid": "ec6a1222-53aa-430a-8b16-d718222578fc", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31767d8f-05b9-11f1-a129-42010a9c0007", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1770642838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642838, "uuid": "62622a2d-820e-43fc-9868-7ecc14d34e7d", "comment": "Malware payload (CaminhoLoader)", "value": "cdaf4c508c0533c4a3bd94c9229cb1ec", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642838, "uuid": "c4aac830-1f7a-46e2-8758-805a558ad088", "comment": "Malware payload (CaminhoLoader)", "value": "fe7dd0edd4734a9c605c20d5963d95ebc33da9b3f908c9d62b0f68e125ee12d8", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642838, "uuid": "f64250be-1080-4036-ad86-c7c80e40bcbc", "comment": "Malware payload (CaminhoLoader)", "value": "ea2c10915357284552202b4331be34a7d4f1770b", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770642838, "uuid": "c63abbc5-225b-493d-9a86-cf3d8b03b486", "comment": "Malware payload (CaminhoLoader)", "value": "318295bb9e68e5fc9271282a2b4410fd9f00caa96d657b95c9ed68bdf581aa739549e8fd6fd951dca2749b001dda2b60", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642838, "uuid": "44001501-8a50-4960-bbb8-97fcd6f6f487", "value": "T10F2601E971AE889041632DE1D3F930C6FF8A16A913C1370C66DBF3D5A4C669DC936392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642838, "uuid": "30871e78-0726-4b64-805c-f887b9aca9fe", "value": "48:vttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttO:rJZbB7JGw5nwtiHWSLhKkDDEmls6Udz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770642838, "uuid": "aed83407-368c-4271-8454-9bf99d17c493", "value": 4607129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770642838, "uuid": "adcb730c-1e55-4cd6-b37f-4b7c140ab6f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770642838, "uuid": "e0b184cf-ec57-465b-b4cc-67c1ccb1b14e", "value": "documents_454857.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d1e16b-05ea-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770663914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663914, "uuid": "fe6ea5b8-1bec-4aa5-bceb-7d1b9f48b7a4", "comment": "Malware payload (njrat)", "value": "395ec571bcbd1ab1d401659f124effcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663914, "uuid": "0b68b96a-8b24-437f-ade1-48f03233195e", "comment": "Malware payload (njrat)", "value": "feb5f7a346f616dc78ee7eff52e3295ff56e377da26cc0a3dbcc28c9862c9b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663914, "uuid": "ff164fc8-bb58-426a-8ef0-e403d9ce906d", "comment": "Malware payload (njrat)", "value": "d1c7398d7e3d572bab6e258cce9897c4edec70a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770663914, "uuid": "d6d85124-27ea-49a1-b2e9-05ee2b2befab", "comment": "Malware payload (njrat)", "value": "e80079b58613b30ac2a84b4651f5e987955042357ec22ab2d0b0ad6ad5901686da439698dacb9e633c8073394045630c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663914, "uuid": "ba909abd-d85c-4411-a913-ab8c9abc1ea1", "value": "T12053F12B527AC7BBC8E452B92CD7DB21533BC04796522F4F29F4C3791F132887AA1594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663914, "uuid": "105448f8-b025-49f5-8c29-515ed2a1c8a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663914, "uuid": "4df655bc-9c8d-4b54-b69d-b73f050cb90b", "value": "768:4z3SKou/Y6Ce19avKYkX6eGem6Dv8fH9g9QS+nmwOLy22wULcyGYoPYg6+qGaIIg:WBNMOXee+H9g5+nmXL9vjAg6GaIIRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770663914, "uuid": "16a56804-98ff-42a5-894e-d7255e6531b2", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770663914, "uuid": "d61034b3-a24d-4f9e-97be-212de551dfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770663914, "uuid": "b1b0df26-169b-4d9a-ba2d-a1e769f478f3", "value": "395EC571BCBD1AB1D401659F124EFFCD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb02eb8-05bf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770645383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645383, "uuid": "a11c4a3d-5804-4212-92ec-5d3f0523b9fb", "comment": "Malware payload", "value": "0a2c5efc04f7f131f7c9b16b97a9faf9", "object_relation": "md5", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645383, "uuid": "85adcd39-9d77-4e14-913b-8a691e5692ea", "comment": "Malware payload", "value": "ff051dde71487ea459899920ef7014dad8eee4df308eb360555f3e22232c9367", "object_relation": "sha256", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645383, "uuid": "3e10cda0-3b5e-436d-9e62-fc2cc3083885", "comment": "Malware payload", "value": "3551a0a50e7481553e2d4b7226566643661a9d55", "object_relation": "sha1", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770645383, "uuid": "d007d09a-46b7-4dc3-b2ab-5cae6c0e52ef", "comment": "Malware payload", "value": "200841f92a54dd932073ee6cfb301f9da7df80a432695a6c32a01a42bdeb32eadbc7550fb0ed7c0dc0870e7a2fc3091d", "object_relation": "sha3-384", "Tag": [ { "name": "DesckVB-RAT", "colour": "#873076", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645383, "uuid": "b149bb65-cced-4ccc-8ae8-97267a8748d1", "value": "T1AF63D00563A8C22AC5BD1EF66CA3A2500771FB058E32EF9D8DECD0EA9DE35D11320B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645383, "uuid": "3e7f964f-1e7b-43f5-b91e-8c6383ba71ec", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645383, "uuid": "26243a5d-f6e2-475f-96d5-4c6879696ab2", "value": "1536:Z8sw/TRYO47g41/2EaioEdEZ0+z80Cje3ns+6P93lfGq8r4y:yVYOY1dZaioWEZHoj4sVfkrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770645383, "uuid": "98bc521a-31a6-46c5-a31e-424854220fa5", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770645383, "uuid": "789de5b7-2ce0-4872-9dad-94a515c4bca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770645383, "uuid": "ef428ee2-2f3e-4d82-a70c-0b2e4049dda8", "value": "Webcam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }