{ "Event": { "published": true, "date": "2026-04-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-13", "timestamp": 1776124981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8edc8f09-a824-4c4d-b658-4f66bee75274", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d022e940-370c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776066359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066359, "uuid": "34781c15-24eb-452d-bed0-69a648946ead", "comment": "Malware payload (Formbook)", "value": "1ad4327222eebe7eddafbfab5030b795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066359, "uuid": "68c7f171-3eaa-4248-ae26-f7dc104ed01f", "comment": "Malware payload (Formbook)", "value": "0035d9424bdee5b512bd3441db4be0486f82a7beb8890713dada7d83e3b7b845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066359, "uuid": "ac2e28ad-40e9-440e-9e6a-bd1d924a13d7", "comment": "Malware payload (Formbook)", "value": "871ddfa22851384a731a04fcf34cec2afea8e50f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066359, "uuid": "cc704356-14d6-4aed-8e43-dc5ad6ebeb4f", "comment": "Malware payload (Formbook)", "value": "65aa2f93733f6d16aaf3a1a5875cde84796ba67fb240b8df9c37a607af978a8a1a5ec94cc8a76a07b2893ae376617c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066359, "uuid": "6676e178-0e53-46b1-acef-876dbc08d01e", "value": "T18965E01B6E56E836D375467F48A0E0780BB82C1995D2E1077ECEFA9B7C39F424A85343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066359, "uuid": "c6df5690-52c4-4115-bcc9-c1f1f191523e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066359, "uuid": "f6b3cc75-49b2-435c-8ed7-55724d766875", "value": "12288:Ts99qwhbgk/LCs8upCiFPlb3saUvrs2gGn0BIxS18f/tpraF32W6LSueA2fEMgSk:o99X7t88Ci1l7svrsEoOf/raklxV2CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066359, "uuid": "5a7c44ea-0b41-4526-b3b2-7329097faf12", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066359, "uuid": "07776706-49e8-4c63-964b-9ce04376f005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066359, "uuid": "def3186e-e6ce-48d8-9876-a05310077749", "value": "RFQ-010-PS(WhatsApp-IMGS).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e83e0-3743-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776089801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089801, "uuid": "1d5b1ccc-d8d4-4c48-8f81-6aeae77becba", "comment": "Malware payload", "value": "fce9436574f971fec5f40e95e9426bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089801, "uuid": "40333075-6c5b-424b-8460-66633f0c086a", "comment": "Malware payload", "value": "00782a03786fd26ed27899d2c8eab2e0b1960f9c5a2d9aaadbf0a995fd2ec7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089801, "uuid": "aa7927df-87cc-443c-9fdc-7b0a44a4b3c0", "comment": "Malware payload", "value": "c906efdd41c5e7000d5bedcb591aa603a7223e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089801, "uuid": "c8cde415-101a-447f-a3ba-04641fd1de9a", "comment": "Malware payload", "value": "100c82f474f88b70006c460685ff2f0342d6a50f62325be95e39134d456fa460b2f66df41b22e7a37a1b886d7775c446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089801, "uuid": "b4d936ee-9a0f-476f-92e7-bf4878bdea3f", "value": "T134547D2AB79510FDE977813CC9824941EB72BC4747E1EACF07904AA62F276D05E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089801, "uuid": "3060968e-d61a-452c-836c-7d6aa8e02f5a", "value": "e3725a7c273b9bedc0f0d3f0f0a5ffa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089801, "uuid": "df7e8652-ded5-4591-a224-8908400e3a9c", "value": "3072:5J7WNpBmbUnHhKIlKrpJ7S4g2pyM8MfDX/40aenGk5Upoig0cs4nLU4oDn59tYS7:n7WN8GluDX/Rahk5tH1G5HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776089801, "uuid": "ad730b67-2942-488f-8470-db6d92bb62dc", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776089801, "uuid": "82c2aced-5298-42bc-849c-5563d99a6133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089801, "uuid": "318cdb2b-d06a-47e1-bec3-22f7f6b7ead5", "value": "msdtce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3e14dc-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046891, "uuid": "33365fcd-a4a3-4c80-bd60-1d638d9c318e", "comment": "Malware payload (Mirai)", "value": "fc708c8761ef3e877fd91917da3cdea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046891, "uuid": "10c6c2b1-3b4f-4bc2-a6e0-899ceda416cc", "comment": "Malware payload (Mirai)", "value": "01fea16edaeddf2ae0b2a9bd6f66485e1a869a74b3e94067a1200d066616e098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046891, "uuid": "3da5004f-b847-4dd2-8cf6-3c3e5d7c9d0f", "comment": "Malware payload (Mirai)", "value": "d6963e6af77d7d76eb757e21303817c45ffd634b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046891, "uuid": "392f06ce-bfa0-4cc7-8e99-abbd6ffa4be2", "comment": "Malware payload (Mirai)", "value": "d6edf15241d335ba58c3db852a52e931789d7213960dc73b23714f67c8a053d67c9df9ee4e61c5635b1ea4d54315b174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046891, "uuid": "01168a77-d48b-4a52-9e89-e368bf246d22", "value": "T1E7836B03BE665F0AD44365F160F18A715B22FCEA49571EF5B9A2EEE94103DDCB2023B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046891, "uuid": "b5ad1721-55f0-425d-9df8-7dfd9eba217c", "value": "1536:AfWP1Hwwe9Ki878U+j96K7uXY7YleZyC5vM3vKebL5V:AfWP1Qwe9KF8/9d7VMeZyqxKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046891, "uuid": "4516c71e-e738-48d5-90da-d891eee02382", "value": 86488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046891, "uuid": "4b68c7f8-3820-44e2-a60f-21dafaefcc6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046891, "uuid": "c5526521-4cd6-4c14-9204-421686d2ad4a", "value": "SecuriteInfo.com.Linux.Mirai.10456.30996.7478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2eedc7-3735-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083937, "uuid": "866a6be6-85dc-4f99-90b6-2d335eed5375", "comment": "Malware payload", "value": "17b5597b3a810b53b4fefdce4b4f4423", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083937, "uuid": "41ed957a-0f89-42ac-b025-468dd83d913d", "comment": "Malware payload", "value": "02fcfa3661eba24f97aee81c24987acee11512c68416772e1406761ede1f7be1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083937, "uuid": "83bfed91-943e-47ce-b983-a972f1d960e2", "comment": "Malware payload", "value": "5ea0e7127b57b4097d7b7c106555ffe9d17834fc", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083937, "uuid": "2fc09708-57e2-4497-a104-1dabd2793ec8", "comment": "Malware payload", "value": "7d5cdca9c71a7f99e88940587b6a0f26fd4ba255bab56c3cd0a11f7f9862d9257e71b351677cdc250aa494939949fd74", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083937, "uuid": "d7520c91-9179-4b15-a715-6882c02c5e93", "value": "T148251265F2D8D657C361E1758DCAF1960F48FE15AE40864733A8B38F743AEE8A24740E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083937, "uuid": "739cdf83-8a5a-4039-a9ae-f9ebd986a716", "value": "24576:5cAvHLuetj7Lj+E1XPbUtjbcM2vw5IyH9DBJ99QbTvg:1vySGEivAQIyHbJ99Ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083937, "uuid": "5bbfed1f-d722-426c-afbd-730c14c3f462", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083937, "uuid": "e4526f80-a5a3-4f67-950f-416b3a8ee569", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083937, "uuid": "69941f73-2da0-42cf-9f30-93ef88c56fdb", "value": "PARINAM STD_4A.XLS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8849e4ce-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043475, "uuid": "9224b9e8-eda4-4aca-b80f-7787e7fe8b37", "comment": "Malware payload (Mirai)", "value": "532e598d277599c52968c47ba767b856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043475, "uuid": "a27e0026-39fc-4fae-82ad-12449637cf0f", "comment": "Malware payload (Mirai)", "value": "035dad3e291583af551a40722b55cc9756022c3329a9cc80a85bbdc01c4808f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043475, "uuid": "1a244a73-0075-47c8-866b-e2d48735802b", "comment": "Malware payload (Mirai)", "value": "e27d945981f679f31d95661e073508973121bc88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043475, "uuid": "3308af6f-cd26-4393-91ff-39ca96825758", "comment": "Malware payload (Mirai)", "value": "8c15f13996ea2061d266bfc81bb184d1ae360057a6d45316101298bd1c72a5ce37aa437e019186cef96377c5e6cb01b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043475, "uuid": "3279a575-573b-408f-a4b1-1ed2eff19f97", "value": "T12FB30806EF611FABD82FDD7346E90B15348D6C5B22B52B757934EC18B31A18B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043475, "uuid": "a0a9dd7b-e2e4-47b9-8272-0fa2d43ee0e6", "value": "1536:phAbP5o31lgJjD9fLkjP0xhf77PmnU9BCtKwtKhtJVgwHn+cRxHXif+5aUu5RMqw:HAbRo3Gl8WB7PmUdNVdnJ8VMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043475, "uuid": "22cdd5a8-86c2-48e8-bccc-19ea28c1e2b0", "value": 117516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043475, "uuid": "40b5c078-a827-486c-9e0a-9d8a0a3bfe12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043475, "uuid": "761333fa-ff96-448f-ba90-2bbda096e08e", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60de1b44-3774-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776110840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110840, "uuid": "1f4a59c8-77b2-4b54-b3f7-8239d7a3fc3d", "comment": "Malware payload", "value": "c7c0782d16934c3840e8211b0b3e6c3e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110840, "uuid": "f5c45332-ada0-48dc-a84c-8f7809136400", "comment": "Malware payload", "value": "03be82b4584df81b03a384048ad2110d6997055b6f7d96a70818c1708ad499a0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110840, "uuid": "a0b56d2a-5ded-495b-9233-c1b517c1c1da", "comment": "Malware payload", "value": "1628fe8595fb44f264147d484cc623c68f97e1eb", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110840, "uuid": "01f08ba1-4f06-4791-9a33-1437126c1808", "comment": "Malware payload", "value": "f8841160f5c2183a651b9b7d4b8481d73844513099873051f151b90ad3b814fca8f0fc2d6340c11c2bc09e31e3de2046", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110840, "uuid": "ed51b45b-6f38-47ee-9145-41a32336c948", "value": "T163C266D8FA05D4E0ED9F6A6BA5F63B5E80704A1BD3C33610316C60846FB6794EACCC65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110840, "uuid": "893078d9-321b-463e-bfa5-ed028e2024d2", "value": "384:6vkKOHLN03WkHoI8WQIZq8Zu4pjMHgMlUCCGV+vWhq:5za56IZq8Z/WyGZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776110840, "uuid": "3c68d3ad-8f3f-4884-8d45-eb504172d4cf", "value": 26305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776110840, "uuid": "c301e6ec-1b05-4038-a85b-5e2f870f3fec", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110840, "uuid": "5a7b8d9a-7ed8-4328-b420-00d776ae6c51", "value": "claude.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749a3e4f-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043442, "uuid": "2f2c0767-1336-48cb-8930-2209b645a9eb", "comment": "Malware payload (Mirai)", "value": "0edd58e521181877531a18c2391ce9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043442, "uuid": "8aa5534f-c002-49f9-9b2b-ad55085bdb38", "comment": "Malware payload (Mirai)", "value": "044cfe10a79c7f8da3433a3859e5aa5735d83d032e8931d33b486e177a72efb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043442, "uuid": "279bd6b7-f35c-4248-acc5-2e572f3e2988", "comment": "Malware payload (Mirai)", "value": "99084a1e40b7dbbb0cf3e98eabef0cc6dcc7ef02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043442, "uuid": "0d9e4cd1-ffad-4ac0-9722-210b52daf25a", "comment": "Malware payload (Mirai)", "value": "6550c824fe50609bde7cefd8037db1c5feb0c59d87f0c5063d69e0f42c1e7abc83c81372febc2bff04382c3cb4572dc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043442, "uuid": "fa2012cb-1d81-42ac-bd77-3c08d78ba799", "value": "T133930886BD428B13C5D221F7BB5E0298371657B9D2E73143ED29AFA0278B5D70E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043442, "uuid": "f6c55abc-3a83-40a8-bb59-eaf773690002", "value": "1536:XvaMAaNdR9p1o0MhNRe79HDhMvFuKAOnPloOuztA2QvHsUMZYvK92aD0PN4bbzRT:XSpa338fryQF4/9I/qMwpsHSy7UgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043442, "uuid": "027dd8bf-ee27-405b-86a2-bfcb0bd08c8b", "value": 95948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043442, "uuid": "dbe2cfd6-af4d-4cab-83f2-5e8c452c7667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043442, "uuid": "bdbe7889-132e-4371-b27f-2b8d9fea171d", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8af6a79-370b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776065890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065890, "uuid": "555a810b-8b68-4f3d-ab8c-e8ecd7541c2a", "comment": "Malware payload (Formbook)", "value": "2ee789ffe61ccde0f16f018459d905f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065890, "uuid": "521658df-6a59-4ce8-a5cf-feab16d6fea3", "comment": "Malware payload (Formbook)", "value": "06319316c7d3da0881bcf83a4509a9dd15fa4765228240b0d4c7684df40aa99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065890, "uuid": "1cf13428-5dec-4d21-ad4e-2a4b7887484c", "comment": "Malware payload (Formbook)", "value": "3f72922d6992d8f0b98a7cd11d91251733197c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065890, "uuid": "52e8471f-424a-4bf8-aabd-31a1b2879ed2", "comment": "Malware payload (Formbook)", "value": "c319fad2fda69b45b0c7e8a1095ed3ed86bf63266a542099dc658379274a001113568c932f80e39eb8ef7564cddf9b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065890, "uuid": "4c05ebdd-5740-4087-8763-90d1c1510365", "value": "T1A6252219626DC846C5A32BF00D76E57133B95EDEC521D6078FCABEEFB43E28A0424712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065890, "uuid": "67c99335-8032-4f5b-8525-ff81ce9c7126", "value": "24576:enJjkSsfwpVWt9mnu7meEpxYRn6bKLaK7Z9SQ+VvAokGgXF:eJISaXt9i8mtYRn+9Q+FAokGgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065890, "uuid": "f8442d20-a837-4241-bc22-9e6652341f60", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065890, "uuid": "2b8b60b4-76e2-4379-b704-5adce68ee2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065890, "uuid": "a0850e6f-62de-4d8b-9af7-face87cec3f6", "value": "SecuriteInfo.com.W64.MSIL_Kryptik.MUC3.ge.Eldorado.17225.5673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf185428-3735-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776083940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083940, "uuid": "ed896705-3777-444d-b9e4-409987112906", "comment": "Malware payload (RemcosRAT)", "value": "ae3c5206ff1262372052de2408e77d5e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083940, "uuid": "88633d3b-f24a-4712-8b8e-893ebb402830", "comment": "Malware payload (RemcosRAT)", "value": "06908382bc3ed4c8eb132355220413b5db3d9e61fa25d89e3de96c5d0fd9c410", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083940, "uuid": "ec7fbabb-3a2c-4026-afce-7a0d0db4b29e", "comment": "Malware payload (RemcosRAT)", "value": "a652e82a08eb581be62b9de4a2d1771d6c94e504", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083940, "uuid": "70c4136b-3f3b-409a-82d1-95faf2765bac", "comment": "Malware payload (RemcosRAT)", "value": "9a01a415c0c285810d125c2484c1ee7a1a89f089a7f3b79048d3eafb35657b9e45fcec3d9360eb72592dd55b443c76be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083940, "uuid": "795a5324-cab3-4403-b5fb-0e7f9e33b38e", "value": "T12BE40175F68C88CCC607C8B596578982530EBC456F6A9B1230AFB71FB473BAD92C3512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083940, "uuid": "642eec7c-d2e0-4e3f-a8cf-4312d0c8d374", "value": "12288:kzpu7eH2AIj3rpu7eH2AIj3iwbuh3x+hqYelBz/ytpcIwz:iuKHv6uKHvHwuhkhqYelBzaTcIwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083940, "uuid": "d4e6d971-f0b4-4e70-90b3-05e34a7e8e62", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083940, "uuid": "0440e4b3-efeb-4553-be55-d6ed62e68cdd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083940, "uuid": "75f0cfe7-aeff-413f-9f4d-a03b70fc5299", "value": "Quotation Required for IG_ANTONAKIS-3647.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49e4a67-3754-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776097290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097290, "uuid": "4590adbd-4005-4654-8951-beddde151c69", "comment": "Malware payload (Mirai)", "value": "345de96674369599693b970d10d0c18b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097290, "uuid": "6aee92bf-19cd-4fea-9540-1243e744d1e4", "comment": "Malware payload (Mirai)", "value": "06a78211f928ea083284effbff4ed629e840dd5bcd14d61965a58cd6175a2ea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097290, "uuid": "22ff17c4-bf6b-4894-9628-ed01c1d946ec", "comment": "Malware payload (Mirai)", "value": "b29f39280505dc1d0d269a08aef93ccd98b7c735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097290, "uuid": "9fbe3158-afee-44cb-9a5a-06abc8984006", "comment": "Malware payload (Mirai)", "value": "8fb9c8c0c34ee9e58494566f98e57cd3cfeab5c727cb2673033995ad42ef705d3bde25f8de99dc3682d32a9f0507480e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097290, "uuid": "98c06bd8-55a7-49d5-9e3c-fda5c3d9c6a0", "value": "T1A1D31941F8504F23CAD522BBFB5E428D772A17A8D2EF72039D256F20378695B0E7B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097290, "uuid": "b10bbd78-75c0-45fd-aef9-d433080215ac", "value": "1536:5/wMY28Ly4z0vTRcca8bA5ur4V4Z/1TQzubc2sVnOo8IK7BKwouA4l0ewywsYlIZ:5/1r7LOn8bj4MdQubcpyvIE7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776097290, "uuid": "7e8d3aba-f397-4254-8686-2e7529aaee70", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776097290, "uuid": "59cfc034-1fca-45a9-a570-221a49ab934b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097290, "uuid": "2e115ed0-2a51-4dc7-87ad-3d376c93ddc3", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e72317-36ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776051526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051526, "uuid": "d44ec94b-3ee4-4f79-8533-83841cfcd034", "comment": "Malware payload (Joker)", "value": "ad6ebfeee7c11d997658aab4f4ff554c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051526, "uuid": "f32f3d81-1915-4695-871c-606bd97c2aa2", "comment": "Malware payload (Joker)", "value": "0ac5785ada232e714b24b86154f8e587a1103a1fdb4ea4498d09003025de4421", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051526, "uuid": "d3d75a61-94ab-465f-bf96-2d0e22a32510", "comment": "Malware payload (Joker)", "value": "1a23c910a4dbb6047164cb551c6bd2e23338518e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051526, "uuid": "3b0d1638-4cc6-4460-a1aa-b77a0afa6139", "comment": "Malware payload (Joker)", "value": "f61c5157843707c56e75489968f6ee9d0e88a6d7551bc8e79ef1ca4d55f93f6f7e556f50a6f5c608a88dc409e09510a5", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051526, "uuid": "c59f1a44-9f96-4685-8f2e-4c3381a4047c", "value": "T17287C05DE74CEC3BDDC6F4FC8D4509E2622B79946720C3962913850DEE837E40A69BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051526, "uuid": "9e9a5634-261f-42f2-90a2-109bffe0eb29", "value": "786432:4ufCcUa2+LdatODKPFfUBy6TLlqYHl4JRUe37ijkti7Te4oIyi:4ufCW2+LdatODKP9jRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776051526, "uuid": "f5965aea-2010-4d21-b48c-5affe012a20c", "value": 36260463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776051526, "uuid": "99d3e7a3-a653-4146-921e-cbf33e3e2845", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051526, "uuid": "1960bd4b-603c-4f94-bdd6-b8acde115cb9", "value": "com.considers.mateo.cleanup_1.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39918849-3768-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105620, "uuid": "a34a5031-a051-4ec3-8a06-b8cb0cb06730", "comment": "Malware payload", "value": "8a065468345d232d3e444826781a3fed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105620, "uuid": "8fa48c34-66df-4d8d-81ed-d16c6557870c", "comment": "Malware payload", "value": "0b73403a776892ab2266e3c0037d17bdde40b1a07938ea9d8e1696517dc70bea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105620, "uuid": "5e56fa58-5b4c-42ae-a97a-5aed775f8842", "comment": "Malware payload", "value": "941dbb84e5fa2342539319679b9b267f34162f1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105620, "uuid": "5fddec05-05c9-4446-8363-9c5af19a0d26", "comment": "Malware payload", "value": "d48f12662d40a34597cd2e7a15ac739c3b7e56a17052001f87bd69418ad77f2680c491182fc633317ca9704332668dfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105620, "uuid": "51cc9df1-13ca-49f4-bfa5-797568937dd9", "value": "T1A20201A7A2E311D37072D69927678755B6A29103F101C62877EFA27CCFCCC94BD53628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105620, "uuid": "9756cf29-348e-4c88-a845-a5838b2d95da", "value": "192:1IjCTwhmRP7JJT+4oZMMx1IsPYV0q81ZN9mI4uLQun6HKBGfFZaM/gq:1IiwOlJT+hhe3FSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105620, "uuid": "d635fc08-9a71-4264-9f8c-52f1b2a21ee7", "value": 8904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105620, "uuid": "26f3e14e-9fde-43f6-9443-5555eb932057", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105620, "uuid": "899a521d-df3d-4752-a3fb-e46630d53306", "value": "pdf-ioc-balloon-mockup.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7e7aff-378e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776121946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121946, "uuid": "9c948032-6b13-42b5-92f5-e873d917e478", "comment": "Malware payload", "value": "90383fc2786689bd8f81f99ac68fd29e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121946, "uuid": "08debe6b-6564-4544-90a2-e25310ffb3c8", "comment": "Malware payload", "value": "0cacede7d5990b1b6e80e61bf380a37f2acc9ae603b9f2cf30d7c8997f2c5635", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121946, "uuid": "673eae0e-64a2-4d8a-970f-fad234eb35dc", "comment": "Malware payload", "value": "e9cb87b86d54c86359eac148ddbe3fde5e6bd20b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121946, "uuid": "98f6dd5b-afec-4fa8-8374-5f1eb34f0568", "comment": "Malware payload", "value": "17340be8aeffc4b21be5d6825186a52104b9db9a37a1d4a263fbcf3c2a5b4abe1aacaac10081215759a3d638db6a830f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121946, "uuid": "8dfd7f7e-3587-4d25-b38e-0e411886417b", "value": "T1BCE312D63BEFF8170D03DFDE644777B24E286A7C2A4C2D4919640386DCA92E6D1C8D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121946, "uuid": "b1cd2339-4362-493c-9d4d-3d11f7253e43", "value": "3072:GjPS3OESE6T+aRCuyDTOWCuy0UUTlxe9MVpomKHfqCf30AcJ99Ibjzb:xGCuqDrLmM0vfkD99Sj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776121946, "uuid": "af0db5ba-a891-49f1-b3fa-0c4041cf7ef6", "value": 147573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776121946, "uuid": "75fa0756-945e-4e51-a452-d98fae7612cc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121946, "uuid": "344d2656-a5cf-43b1-86d5-c9b9c5777ec6", "value": "szd53x7t.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ef4bfc-36f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776056034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056034, "uuid": "8dc7a928-431a-404d-8f69-2adb2389e6dd", "comment": "Malware payload", "value": "68092543e0152ae063a8e1ffec61354f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056034, "uuid": "38bfa4a7-e4fc-4994-bd1b-d57399d0c595", "comment": "Malware payload", "value": "0cb250f059b18d6b869f9ddc7ac78200332e8ee261a2f64d6e177f967b1a53dd", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056034, "uuid": "3b731e53-e442-496c-adc3-cef860a19cc3", "comment": "Malware payload", "value": "867b748cd6c8635022c82d1e187fe4cb73f1848b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056034, "uuid": "dcea865d-156d-4ec4-affc-60e7ce86a53d", "comment": "Malware payload", "value": "fc3f70ec613efda07e4d452898b4d85f5325061464d6b7118da9f23104cfc35aad04c0d0de386eed3550367167d41711", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056034, "uuid": "5a771dd7-c7cf-49e2-9f7c-252594505b28", "value": "T1E134C733E6A288F9C49FC2789B96E2636670BC585174F21D5FD00B027E07F609F6D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056034, "uuid": "ef6c7ec9-8310-4dbd-a4dc-aadac9821235", "value": "8efe324510e255a8e6aac62a3bf47974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056034, "uuid": "43d1a5af-34ea-483a-bc07-7bf33918b8a0", "value": "3072:JNUDJOMiWYGujgrMPOLQ2VQiMmYpo1T8actklv+4fSZHQISLsJP5L5mXFV:JP3tUadact6vXKZHQRAJP5L5mXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776056034, "uuid": "282afe3b-e46a-4a37-9039-5c59fad7a5e7", "value": 239400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776056034, "uuid": "7e92dde0-87c0-4a48-b4fd-c51250863ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056034, "uuid": "86f8c40e-e066-44ba-8604-7cf53fd53a1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06b09a7-375a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776099807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099807, "uuid": "32297536-7eac-47d9-a506-c57d07fab97b", "comment": "Malware payload", "value": "9bb4341ec0190c5d471a5e3594a4aa62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099807, "uuid": "a5f923c6-f2ba-4888-9a9f-c88df7244acf", "comment": "Malware payload", "value": "0cc33d1b83774b84f8ee710e2697624f9b380c4f0be19fbfab8544af6f0ae753", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099807, "uuid": "b50008d6-af46-47a3-b5dd-d03165018521", "comment": "Malware payload", "value": "e71e68259d0e109dc37768e7bc7837ad406afc44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099807, "uuid": "5c1383d2-0003-4376-9432-dfb70d21334a", "comment": "Malware payload", "value": "3efe9ef9ce168beba871417494b133f8d33d0db98941040ec788033e85142f97d6d330a148d20f519ce1681700e0c0ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099807, "uuid": "f56b8da8-b69c-4f25-9eab-fa4e43cdb725", "value": "T1F6137D6956817C24AE9988371C7E2F0CB9A983E1310851EDBFCB3CF58C19B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099807, "uuid": "6e0d1672-28a5-4e04-a3c9-dc20040b5fcc", "value": "768:bJ+R9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bJ+acy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099807, "uuid": "e5e37bf2-a104-4658-8fe8-bc61aa1d91f8", "value": 45507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099807, "uuid": "fdb8521a-f1e2-47bb-9a31-a9617915587f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099807, "uuid": "c69e85cf-6df2-48ba-b3a9-e03ea968faae", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185fa6a2-370a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776065192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065192, "uuid": "e3a7d04e-0732-4739-8faf-efe180d7601d", "comment": "Malware payload (NetSupport)", "value": "10433c6332c5529ab5fd278aee1389c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065192, "uuid": "5edd2916-c996-495c-a5d9-ab63773b77c4", "comment": "Malware payload (NetSupport)", "value": "0d0c6f0af37026c7f59b163982a09a9df3ea936a45366ebc439c6602264aa349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065192, "uuid": "d5419b10-1ba8-4b34-b79c-d3f7c134b530", "comment": "Malware payload (NetSupport)", "value": "dd0f21d6ffd58f68bf83d4144b3d6197f9f3a126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065192, "uuid": "3fcb8137-130b-4470-b77b-a25c8013803c", "comment": "Malware payload (NetSupport)", "value": "a7e9d2796fa2ae3b269a272c4eb246acaff21c831b0dfaa828744dde013b86a48b7d3aaf809c7ff752eb0104c2e9fa7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065192, "uuid": "b32cda67-1c69-4acd-80e5-182e0a17dbe9", "value": "T10946AF12FD6405A9D592A37A883355837A3CF8005B1223E76AD9636C2F733E4D37AB5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065192, "uuid": "ccc82d57-acb5-474e-abd4-fe8ae687fbfe", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065192, "uuid": "c47f3b3e-a2f8-422f-9530-89827164f4e5", "value": "49152:7yjlQOBH2Qv2YiHx+Wfhr32jd2pO+b5nkNN7YopYJjsMyQc74vK0N+HlQXFyUIxW:7y8p+8xO+b3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065192, "uuid": "b50afe3c-6818-4294-9a3b-f9420931adba", "value": 5568435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065192, "uuid": "508b00c6-f63c-47fc-b239-05278a78d046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065192, "uuid": "bff7ead2-ca03-49c9-92ff-e029268928b7", "value": "kiwuq.out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6605b9-3746-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776091161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091161, "uuid": "057d7cdb-ee06-46a4-ba40-b98c506a1157", "comment": "Malware payload", "value": "98b0f53217aaa446cc47798950f39325", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091161, "uuid": "1c6e5a14-c1c3-463e-86bb-59e20ebd4df4", "comment": "Malware payload", "value": "0dbff535a85bc70a9d55ae20f736acea0d646273a377d1994df7b7a0ce78948b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091161, "uuid": "cab4e4f9-2c13-4a4a-8133-3f8cc1bce91f", "comment": "Malware payload", "value": "668c5e3aa3ec4bf0df62a3e702d9513fe8b74bbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091161, "uuid": "0e848991-3cf9-4aa8-946e-835b566be2d2", "comment": "Malware payload", "value": "5f5874d18f9d721d02cd13456044f4b6033d07c753bf003b1e41dc8d087027720b81f9980f2a5ca3fec5f2cccbace041", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091161, "uuid": "6e76140e-1c04-4549-814d-cd9851b23c57", "value": "T105B58E03AD550A36DEE75F307AADA4449BF25A60CF13E7974E29E4742BD230ED62D380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091161, "uuid": "20c9f4bc-ffd2-4941-9514-2c5d9ecfe1a8", "value": "24576:pyUNO1DEjloGmfiwrlEPt79OkJrLe9ogdtbbaq9Uv3UrGbzLY41mF8SwEj2KhnsK:po4+iwR89x0omYmy/Y4Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776091161, "uuid": "40bda2b5-1310-42c4-8ee2-2f16a4690789", "value": 2367884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776091161, "uuid": "9ece550e-dc21-4e5f-ad08-3dfde9f27db7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091161, "uuid": "119ca669-a87c-4368-8444-3a4c5a8841e0", "value": "libearnify_sdk_arm7.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e416412-374b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776093307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093307, "uuid": "dd0c3bb9-53b3-4b7b-86f9-7a9b7bab3daf", "comment": "Malware payload (Gh0stRAT)", "value": "8195800eb77d7eea45440983c3ba3820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093307, "uuid": "3fa8ce22-8d35-426b-a5f5-24c868a69bf8", "comment": "Malware payload (Gh0stRAT)", "value": "0e2f9ad8b25420aeee57a0f244730a94102695f43b292dd445ac6fc926d8aeb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093307, "uuid": "09aa96cc-aac7-4aea-9d25-34ca3ee52d00", "comment": "Malware payload (Gh0stRAT)", "value": "22a75a4dfe69953c9937edea375adf4ab26d6aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093307, "uuid": "ad0812ab-51ca-4066-ab24-63e22984c2bf", "comment": "Malware payload (Gh0stRAT)", "value": "f234091b1fc43c1262dd8a1b0e901d53dd8ad0d2a96eccbe015b7379e1e1b51960600fed4ca6e897f26635d041b29b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093307, "uuid": "7ebf1bf3-1450-4280-98ab-e704eabf79ac", "value": "T15817337FF268663DC86F02324933861015BB7E65656A4C1E07F0A59CCF7A4B11E3B78A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093307, "uuid": "04cc332d-8189-4723-b56d-3c756a19e6ab", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093307, "uuid": "f3f4dd7b-d879-4e59-bc35-6903541af300", "value": "393216:r8KhB0YpzTUKiH7l0tu2qbHJjRFpu5bzFl+Gvxleg9e:r8KhB0PKiyuXNjRDut7dJwWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776093307, "uuid": "e5e42017-3275-4dca-a3d8-11131fcaa94f", "value": 19557507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776093307, "uuid": "165f2ab7-62d2-4f0d-b32d-a631fa548463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093307, "uuid": "34072555-c781-4881-bf5c-b5d837928f9d", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305zzl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8bd9f5-374b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776093229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093229, "uuid": "4d8c0da7-a8cd-40db-98a4-ec5c10ddda68", "comment": "Malware payload", "value": "41407ea5b20efc4741ce0dd6275ad435", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093229, "uuid": "b80e96a2-f365-4a90-865a-f341e0ac303c", "comment": "Malware payload", "value": "10c95cf82a71093697bee0973bc782c95f8259b53906fc21ed5977b697e3b4de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093229, "uuid": "8d102c56-3320-480e-8d42-db3bc5429137", "comment": "Malware payload", "value": "173c73dc333ac9728b85a53163c7adba61086679", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093229, "uuid": "5452e650-3123-4285-b1e0-05609bd47fcc", "comment": "Malware payload", "value": "b7f3be58afb2856c5d350ffbff0217ff43a1a9583ed36d2f6095decdc6a46b5485fc2f80d461b87bbbcb3e51a6a8d959", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093229, "uuid": "a380663c-80ad-4d9c-bf7e-f3eb30f5addd", "value": "T186D56B076CE048F9C4A9933188B66296BB71FC494B3227D72E50BB792F727D09E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093229, "uuid": "bee5cc6f-e37b-4baf-b96a-9597bd2d7ee5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093229, "uuid": "28e49e90-1c4b-48e5-9809-690fe6417573", "value": "49152:o9BdFppt/uvcG2jkpTxZDMqBOGqwaQf/BNta49+Yce7l:ovkLDhEGMQHBNta/Yp7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776093229, "uuid": "381a1984-4bc5-4062-9a38-c5c49e089f90", "value": 2887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776093229, "uuid": "a67bcfd8-ed2c-437d-9ac4-882682544acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093229, "uuid": "7f59e4c7-710f-4665-a9c6-c012e1dee669", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1c03a8-373c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776086891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086891, "uuid": "8e0c317c-ff39-4ce4-ba64-705708b9363d", "comment": "Malware payload", "value": "4795668408d85da1d38e752df360a305", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086891, "uuid": "37123b3a-1402-4002-9e1a-9c939332cc89", "comment": "Malware payload", "value": "11d2a4104351b8441a9db4217773368a242bb4a00307cc2fe602a767a0dd6d2f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086891, "uuid": "996680ed-c9ee-4c18-8df7-9e51a68773ce", "comment": "Malware payload", "value": "84e12cd7c9984a0c07c33ab9923b1a1e0749a584", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086891, "uuid": "4c3a8ec3-08b7-4d4d-bfbb-6ed904fa9b47", "comment": "Malware payload", "value": "9a6353da74d4d30c7b646534c6fa6caf187c2d6ee96602c1dd81c8fadcf92f557f3156e4aab93971fa4651b12af54bbb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086891, "uuid": "e42c6041-267e-4f1e-8cce-c9681da0fc6d", "value": "T1A23408D76E9001F7D21EE13484A3732DD73BB83D2BE24F9F825A2E655F331984929611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086891, "uuid": "13d1a302-9844-4e69-b5cd-43e6883c54f3", "value": "0a1ec188b20e2a1aff7d3fb73454f2e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086891, "uuid": "0703670d-a92f-427b-b734-f98b989d8ca9", "value": "3072:ZJmcNZM3ZBLzlX0yOWVw8uJZ8BYzQP71fGHX1tzHu/7qM:ZJmcfYZBLRXeowQI8G31tK/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086891, "uuid": "5ac3ca39-7480-48b3-8ca7-7c52d48d9a80", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086891, "uuid": "b707ca1d-9102-4f67-802e-7fb99fbe26b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086891, "uuid": "6ccb50ed-6a1f-4f1a-a94b-4eaaa2c87d63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d88bc6-3774-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776110843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110843, "uuid": "3f55279f-ed84-4ebe-8819-0848cfe527fb", "comment": "Malware payload", "value": "6216d6db92a3fa659d89ae331f38f9a4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110843, "uuid": "3d2a6780-c20a-40bc-829b-8b14a57f2295", "comment": "Malware payload", "value": "11e749078065aa2c7c9ebbf35b8c59c9ad4e804bb1240f432c8e6f4c628894b7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110843, "uuid": "e1645353-3f0d-4391-a510-38ca9430393a", "comment": "Malware payload", "value": "6e6d5bb50362388bf3091a8ed27700c999405702", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110843, "uuid": "59fc9dcb-04d6-4222-8cfd-5c1fddfa8bf4", "comment": "Malware payload", "value": "cca23f2db4e0e9de82a96bc539989e64b79d061feecf555795c435bfc2f2c35b67912590f834cdd8f611827a9bb0e353", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110843, "uuid": "485c9f41-aff3-4072-9484-f16ab4f1a51d", "value": "T1DEB258E8F601D9D0DD9F5E6BB1FA7B1D8030570BDAC63A10246CA4942FB6B90FA9CC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110843, "uuid": "169f5d3a-a61c-4853-b461-a574585b52b2", "value": "384:4b4NobtWDEoZYxqiZ6GsgkNMcgCMvYCGD+JaWYp:4b4ahCRiZ6GN1dG0aWYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776110843, "uuid": "0fd56147-e392-48bd-86fc-765b4d816044", "value": 24637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776110843, "uuid": "284e4117-16ab-4947-80e6-d8e3cf138d74", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110843, "uuid": "1fda2ae3-9468-4649-b55c-ca9f8d6bff49", "value": "claude-msix.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4f05e5-377d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776114587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114587, "uuid": "1ac4f32a-969a-4ee2-aa69-407eaaae99e0", "comment": "Malware payload", "value": "5d645064f8b3414fbfc399fb99baacc8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114587, "uuid": "7ba8e42a-4f5a-4053-8ae9-df0856be61e7", "comment": "Malware payload", "value": "12f52e5e3114009059a63ff2771ee7ed007cb62dd1f382e8056962a409f3c9b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114587, "uuid": "5b6476a2-f803-4771-8293-41be0863dd56", "comment": "Malware payload", "value": "d1ebc227b245be523069e3ebe4e51aa65da39d02", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114587, "uuid": "d6cf89cf-3e86-4468-8d93-08c34ec14e65", "comment": "Malware payload", "value": "5dfe61c26372387775d583c9ef9f4d3f5df745692f50d1506d86130a7ffa293cc550351b59ff9ab10966765db343f028", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114587, "uuid": "0338bf1a-3e91-4c50-b8f7-c769e065091e", "value": "T1EB36332FAAFC070FF98FEA3E524D4AB6539458510E57A1356CE9171177B62CB2A0013F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114587, "uuid": "64b7b2a3-23bf-43bb-a17b-e5a5589087bf", "value": "98304:o86tQy+5jDwHHC8uNONfqQnLjgQzOdL3pl3KFghumLwc2:zV2uNOscjx43pB2ghum/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114587, "uuid": "dc49969c-0285-47d9-8f40-8959d4ad7fa0", "value": 4973956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114587, "uuid": "5e102e29-1cff-42ad-9d63-37ccf6846365", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114587, "uuid": "cdfd8b6b-f736-45a4-b61a-25536c3b0bb9", "value": "fortnitecheat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be5dd86-36f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1776055024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055024, "uuid": "19e37c27-d982-4935-8fca-29b01aeee569", "comment": "Malware payload (Hajime)", "value": "1c6b54ec36151af2d2a1d85a6fb442ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055024, "uuid": "5fe50d5f-984e-499a-9f03-ab837d078df9", "comment": "Malware payload (Hajime)", "value": "130558bf6046130b0a48d0e9df6f2f9e3648afede53a86c03ffb61b34013c802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055024, "uuid": "d0debfe3-9ea5-4d8f-af7c-e08650e0f284", "comment": "Malware payload (Hajime)", "value": "fa4f638262e0467a13cd1dab5a303657560d03ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055024, "uuid": "59878fde-c2cc-46eb-a891-48ffb734388c", "comment": "Malware payload (Hajime)", "value": "dbef71204079ba6f3210cc6d21d812aa4617baba847a29b93fc78e696f57e0a27880f4165ee0bdbdf3f90e63dc9dbb48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055024, "uuid": "b6981e1c-5459-470a-b72f-cd4e0d24cd98", "value": "T18633014623972FB6D5719DE1E3FCEF4AA04A7DA49FE61C0A7C213559A47236C28C4C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055024, "uuid": "beba3f92-7885-4796-86e6-d3f7c83b5cc6", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnDl:yYI0ARqw1qAEv7UIFM8oJorFqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055024, "uuid": "b01346ef-ad01-48fc-b1e7-a06264ccb02a", "value": 52096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055024, "uuid": "91c4a144-b7f4-4494-9fa1-2b28b84ec0ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055024, "uuid": "8fbf51e0-a6a2-4a68-8819-ed5b00fe6d09", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018d3857-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066442, "uuid": "d36687cd-5d43-4fe2-bf66-b61adf9da311", "comment": "Malware payload", "value": "a41f998ef397c3cd5d3ec247efc7c35c", "object_relation": "md5", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066442, "uuid": "8b1d705e-4984-4a4e-9771-4c534ac6b790", "comment": "Malware payload", "value": "1448603aebdb26b8fb9f5772360a47dde5310373d7804f7e711c3305aad24081", "object_relation": "sha256", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066442, "uuid": "fa234b36-999d-41c6-af09-71eba4e5347e", "comment": "Malware payload", "value": "035150397c69014acff06f49e4f8a8c0f63ad451", "object_relation": "sha1", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066442, "uuid": "f25b11a7-08d1-4d75-b462-5ff4216dfbab", "comment": "Malware payload", "value": "5d8ef249a68b6d9b0055319c70461673c084f838a353da7bbc0e3c540e4e08f94c9cf396cdf3b52484655f4a514dedf4", "object_relation": "sha3-384", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066442, "uuid": "9795f2eb-f577-4e09-8ef6-ed9cc6bb38ef", "value": "T114D095554E44C2D5E3E3F9B27214FE40A40D745798F6C85C12BCDB8764C4455C235FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066442, "uuid": "df62e6d5-68bd-4bc5-9904-96cb916cda41", "value": "6:6wReFF86F3BYjBXw5Tvf5oeTckUr54vVG/4izv:/S86FeoRziuVW40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066442, "uuid": "a44306b2-282b-4ccd-85e2-068963703659", "value": 275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066442, "uuid": "e5e9f473-c017-4f08-9aab-828b2d347105", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066442, "uuid": "76e011b3-e1ce-4ee7-99e9-7db6e3d74c65", "value": "1448603aebdb26b8fb9f5772360a47dde5310373d7804f7e711c3305aad24081.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adc2bfb-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776086000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086000, "uuid": "a5dc393f-d634-4363-b274-1e6e09f57f06", "comment": "Malware payload (XWorm)", "value": "ff93986f7ecef69007131b3e09b92b6b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086000, "uuid": "b00ae17f-1ccb-4d4f-b529-afdc551f48e8", "comment": "Malware payload (XWorm)", "value": "148eb036e5a9823ad15cd824fd0ae7866b4185bb3e91589cd6dd90000bbbdef7", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086000, "uuid": "10a47031-683e-4957-8cd0-deb23d84da1c", "comment": "Malware payload (XWorm)", "value": "f3772d6512ff32004d958307c04f476173183910", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086000, "uuid": "49287859-5d12-412a-a954-91f5ab3e1da1", "comment": "Malware payload (XWorm)", "value": "d0512f81912379373761654ca01659544ef0c00442138d477082e15a8eace791dd761de9b596825fb4b1764658ab9c8e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086000, "uuid": "5dcb6375-420d-4b68-aa50-bfdb791d8b73", "value": "T147E53EA6BB4504725A055EE747063FA0ADFB651EA3323E01D08DCBF089A35CF5BD64AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086000, "uuid": "28b2f6b7-8f50-4066-922a-1f50a1baf1b4", "value": "768:mppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppB:va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086000, "uuid": "71dbdea7-d466-44a1-8e2e-a7196fdd6093", "value": 3051393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086000, "uuid": "a7c0af95-0c4a-4484-9f65-29945ae72ebe", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086000, "uuid": "27ea39c6-f04d-49ee-8b82-74a73638b341", "value": "dekont.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be9c12d-3779-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776113006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113006, "uuid": "3a288696-83bb-479f-9881-107a793998ee", "comment": "Malware payload", "value": "c76e0e516b8aabf81ad1aa35fcc0a5bc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113006, "uuid": "67ccbea3-1e97-41c4-b517-e5c5a1d43353", "comment": "Malware payload", "value": "16cb7952ab3ce88ec30b57e1c5f16a8871457e9985d43675aae47d8ddb5044c8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113006, "uuid": "77ffd9dc-211d-4828-b4ae-9d7812d5c11a", "comment": "Malware payload", "value": "68ffa35e517a01f57c0f240298fc95fbbf0bd140", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113006, "uuid": "0de774ab-061f-4ed1-90b3-e374e0473ae8", "comment": "Malware payload", "value": "319c658203696922f4396891e23fac2c69a8812e23edce0a1170aa9fbe7293a5c34256c037402906b75f111d665a1ba5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113006, "uuid": "357d12a1-d1a0-40c3-b2bc-23fe738d0dfc", "value": "T1C5A302698F18541EEEBFF274118E67537AB2EEEAA4845097081188504CF3FB379472AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113006, "uuid": "cbcaa180-1ff5-4f2a-aea1-0368b8e59fa7", "value": "3072:RE33ATF1ncX/2XWJK647IgmSoaJC00Ypm286V:Re3ucX+G/43mhy0YpXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776113006, "uuid": "a8338f5c-c554-4df5-aa03-7e26123fa68e", "value": 107257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776113006, "uuid": "bc83e178-45e9-4503-91d3-ef65279efc2e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113006, "uuid": "c7025ff9-f6e8-48a2-9d8e-771e1aab5eac", "value": "base (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3148de5-3733-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083061, "uuid": "b4727fb1-5fe6-49f7-bd56-c35fe76ccaf8", "comment": "Malware payload", "value": "22f71d6e2e5bd18fd9d5d2b8eb59521d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083061, "uuid": "73311ec5-9b13-408a-90b8-5f790f795adb", "comment": "Malware payload", "value": "174763be7bd0d1dd7c232e4320b9916edd78cf3e741d442f950780e2378bebda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083061, "uuid": "5f60ddc6-5bb7-44be-b854-e4ef892c7477", "comment": "Malware payload", "value": "d99a445f16d7fd1f46f0b2e3a0caee326a64c636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083061, "uuid": "493fdce1-96a0-4652-8eca-aad70e7b364e", "comment": "Malware payload", "value": "54c9ea93ee5690c7e9b33fd33e0ba8537f1797e42bbcf023af2e1624e88e80adb51369df695cb389b2944320826e5056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083061, "uuid": "d8cfa953-44f9-42b0-b23d-025a3bab56d1", "value": "T131C49D43E3A2832BE5677E384FA2C3905633BC623E12D14E779925C9C46B7B84D572D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083061, "uuid": "81bc2b15-c017-47f5-9ae3-a7ded3a6718b", "value": "6144:5Lam4/0FtDrAbPlDwOLTnJ2CW9BpW2RW1JaZWRRnQzSAShqfg7GsICYBb:5L3m0FBa3Tnq9BpxPZW3nQzSASo8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083061, "uuid": "bb0fdd8d-067a-4314-a1e7-42a340e1edec", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083061, "uuid": "fe85f754-34c4-40be-8b96-4f0e055c3c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083061, "uuid": "2c8f49fa-4ce2-472f-a445-6568c2aabfb2", "value": "22f71d6e2e5bd18fd9d5d2b8eb59521d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7f5bad-372f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776081444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081444, "uuid": "1f4e4ef3-7bdf-47ea-b4fd-8eb1f228222b", "comment": "Malware payload", "value": "367b6ce08743b45f400b80a0e0a2775d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081444, "uuid": "3db59a1e-8977-4b2f-9ae5-7444ed3a1663", "comment": "Malware payload", "value": "175e407df44129ff0a112f22c0a79987bac3f0dce8a3359be9896ad009fb8e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081444, "uuid": "93d300d9-4df9-4446-b0da-1bf4a5ce3250", "comment": "Malware payload", "value": "824d5dd2b6402ca65fd9ce6fe5ced1b66e7574c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081444, "uuid": "dc4b1a2e-6d41-4296-8427-cb8bd70dd801", "comment": "Malware payload", "value": "cfaa5724fd773855180c62a8df85248791740b573048868fb89b069ef5416fd76c1a8ca801f9b5042d929061522ff4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081444, "uuid": "e3ca34d9-9520-4c31-af9b-a971ca183d5b", "value": "T1BFA41B203AFE501DB2B3AF695FE474A6D96FBA732B07945D1050038B4B23E41DDE163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081444, "uuid": "33068683-cd86-409f-b3bc-9c71957c820c", "value": "12288:MkzRUjJ9apui1vRPlwEr74AD6UqQ/6bYCmbb:n6JyVRdH7wpmbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776081444, "uuid": "0bd2f6d0-53c4-488f-91e6-c069eeb37041", "value": 450132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776081444, "uuid": "9034f9ae-99dd-4bad-a19c-b60973b07b16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081444, "uuid": "f658c941-a255-43b9-ab39-6e908b3430ee", "value": "INQUIRY 2024-SP005643.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae28cdc1-3706-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776063725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063725, "uuid": "029a9ba7-bdfb-4781-b832-7755b4dfb4e4", "comment": "Malware payload", "value": "03eb4e574f495ccc54bf67aecacb9f6b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063725, "uuid": "45b350d3-3dd9-44ae-b024-e4e74fade501", "comment": "Malware payload", "value": "17b56c18e9771fb488fba10df1e0389a7988325e0309b700f8e22e48bf2de65c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063725, "uuid": "4895077d-fdca-45db-a15c-0cfd634f124b", "comment": "Malware payload", "value": "4646b109a651743d529c9e6c7935137da1f976f8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063725, "uuid": "e8c1a389-d84a-4739-834a-a9cb6b737388", "comment": "Malware payload", "value": "d76cd01f57a7ff9baabc05e6bbfaace37f4f9b6fa0277a8e2818dc5cf917214840d27a001de94b21fd7c7fc345254495", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063725, "uuid": "f16a5fc3-bcbf-425d-8029-877417b2bef2", "value": "T16A62CF6D03CF8AFCD367E8C484D69D93EB668917062CE685DF35BDB534228ADE0E5804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063725, "uuid": "54ba8611-e116-443b-973e-4be679e3f007", "value": "384:hmMfJf+giPANOdcLh1gJV9wsicwtxi5oM:F5h2KAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776063725, "uuid": "81591896-8335-4895-9af1-593122419a55", "value": 14651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776063725, "uuid": "ed9ef73d-e5b0-4926-bee2-197eba4a4525", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063725, "uuid": "5803f8c5-2c2b-470d-8658-c5cbaf8aca73", "value": "n5xvb5sgkv2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c88f639-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085466, "uuid": "26925839-104a-4c2e-a57f-92a7e976d8c9", "comment": "Malware payload", "value": "71879ba2f254384c5f20e09ae0771800", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085466, "uuid": "1a05378a-3203-4de2-8569-51b0ac4f49dd", "comment": "Malware payload", "value": "17df39fcd90999cb399fab45472f33d1cfcc3ac64439c49317aa5ad5f3187e4d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085466, "uuid": "a7fa0b5f-f83c-40a7-831a-892d37ea8609", "comment": "Malware payload", "value": "caa22fc9f10c6b7dba66b06394d7a471d28fa5b9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085466, "uuid": "dff0d1c4-7a30-4899-8987-549418030f0e", "comment": "Malware payload", "value": "3fe4b3ff55c31a403cc2be375e01f449ad1fd60a38f9ca06aac52315db31d88044835c6580ce8ff967e4f9b99721eadf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085466, "uuid": "a202e7b9-ca14-4799-93f6-734738f8d120", "value": "T17EB42D38ADEA002A7173EF64AED47497E92FB773370E589C1091038A4723945EDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085466, "uuid": "2c974a9b-2882-464b-ad64-0fc9fc44a512", "value": "12288:3p3Mtd+VbmwbmjnrhN7KVQbBaG1WhiInWzGL9HfHJTpq/hoh3nGkUUCdnxx:sYZ9PioK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085466, "uuid": "a21810b0-1f09-42e6-ae35-6762e340f7df", "value": 504458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085466, "uuid": "036cd62f-e112-4c76-8d61-469e55ba6ab5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085466, "uuid": "65f8a207-e080-403a-b457-89f005184458", "value": "PO 68107530.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec50f78e-371f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776074567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074567, "uuid": "ee0b377b-7430-4f1a-aab5-d27b94e505a2", "comment": "Malware payload", "value": "b28cef0d9b29da8ad7884273fd94f1b5", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Xrio-js", "colour": "#F97ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074567, "uuid": "8db560d5-8eba-4b4b-8e51-84692c1e8c9a", "comment": "Malware payload", "value": "17e0981a1f33b36f51eec78d164e0b4b4b0f548e80e7d5b8f99f75394f9f897c", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Xrio-js", "colour": "#F97ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074567, "uuid": "cec40941-8cec-4292-98f1-4bf6375276a7", "comment": "Malware payload", "value": "151a40a52d0ee936c9faad85a0a268b06ba7f8cd", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Xrio-js", "colour": "#F97ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074567, "uuid": "a18f5d38-def8-4055-a769-bd9018b5ef65", "comment": "Malware payload", "value": "62bb5dc1db5aee08ece0216df8f8d2fbab38e26f20b7ec7bddd3ce74998540b5dd4f822e00c0a494d8ecea4ddf46f76d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Xrio-js", "colour": "#F97ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074567, "uuid": "b9f189c7-808f-4d03-8fac-2956a2d9815b", "value": "T1D6C3124517B6515DA6ACF18A033E3AC6EBE4C33325346DAFA5EB000B07A1357916E3DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074567, "uuid": "8e7f4d9c-82eb-45ab-a4af-6447f6d7b6ca", "value": "3072:2qWa361qOGr/xuD3sy3m6FjLxAr6y6Rjgj9evNbmjIHxFMLcnjjK0gB:5z3CMa3b3m6dLxA+y6a9ibyI4VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776074567, "uuid": "5670bc06-f654-4a5d-b119-0f30c1074bb8", "value": 125912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776074567, "uuid": "845de7bf-65dd-40c6-abc9-419093995fa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074567, "uuid": "a74b9fab-927f-4622-873c-2f8fc0c0218f", "value": "Xrio.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167d580c-3790-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776122741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122741, "uuid": "a07efefc-e9cb-44c1-a4c3-2a5db012203c", "comment": "Malware payload", "value": "e6a7ef2053d04b3fefa006c0140a383e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122741, "uuid": "71311e16-2d09-4318-adf0-b4e0f2917e88", "comment": "Malware payload", "value": "17ffdfe0203913bfc890f14c4479c6d53ef9e29004d9844d9904a6af71782b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122741, "uuid": "d89c9df0-4f08-49f0-adbe-91bb56e9d324", "comment": "Malware payload", "value": "246cc299f523d3f7cde1c31a4db234e2557662a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122741, "uuid": "4b704bc5-71d6-45b6-a255-c84a1fa79843", "comment": "Malware payload", "value": "9720fd0ebfab0a585d0f9ab619fb321f67c9193e2de2e4594254d2a2c19a86196c7cc7091c93eea3b9f310dce1821865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122741, "uuid": "5649e10c-e22e-4af4-8a94-beb983dc5540", "value": "T1DF55AE59F3C866ACD117C939C751A232D2B2B4574B62F5CB0B9AC7092FB3E905B3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122741, "uuid": "73b604d3-dbb9-4a11-a6aa-01bdad9fea77", "value": "36c27d9cce32634a5dfaeecfb98c4e32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122741, "uuid": "00f3aba6-02f0-4d20-99e9-7d10ecd4f246", "value": "24576:X9R6e4LC0ibDFxiwGZ2m5sjTkwVm0Vyv5lG6FPJjlCh5uAlZjy4pJ5A+bYtR6yB/:X9R6miwG8m5EkCVyv5HFPJE5uAlZO4p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122741, "uuid": "3d091a66-2d58-485b-8d2d-8f66a4a1493c", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122741, "uuid": "fc12eadc-a68d-4786-8611-2036ed4c2b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122741, "uuid": "2817da8d-1565-40b0-a871-9f6c6b195393", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3181ca4b-376f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776108613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108613, "uuid": "251b7589-7024-4c5b-be88-fda704646854", "comment": "Malware payload (LummaStealer)", "value": "a091286406fbd36484a3428e02bc3521", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108613, "uuid": "26809206-aa29-4314-8193-39c5e85de4f7", "comment": "Malware payload (LummaStealer)", "value": "1a164d10fe3ca9a603c70bcf83a667b92bab36dbb1705c6865fb83a48935649f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108613, "uuid": "c08ca12a-65a0-4f66-8bbe-bbd23979e21e", "comment": "Malware payload (LummaStealer)", "value": "8c7d8ccd23f978ea7b362598bfdb0145e7ead911", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108613, "uuid": "b2656ac8-b6cf-41be-843b-ca5d6b62bd6a", "comment": "Malware payload (LummaStealer)", "value": "4f28011292973ab10fe286a312dd6832058b6834e0159379e59e01b12c3c8f73efc4dd6ee5df6bba3fef1a0ca411a0f7", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108613, "uuid": "4ade094b-04a3-4e41-894b-5c3419b849e7", "value": "T14AA56D00FED764F6E802073555AB13AF2739A9040B329A9BEF843D79BE736D51932349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108613, "uuid": "4fd9f914-7fef-44f6-8c2b-627265c097c0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108613, "uuid": "9eaa7d78-5cb6-45da-a78f-f5d121f7a469", "value": "24576:a2E2oBo2A+dg/L+wgBZYBH/EyL5bKHMhz557NKFmiSXomQifMrLnnGnnnfnnnYu2:aHR7/YfnKFmiSr3BbQ0CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776108613, "uuid": "7db37bf1-7a94-45a7-8465-048162112f80", "value": 2137816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776108613, "uuid": "f9a4efc2-3a22-435b-b22d-2117e59340ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108613, "uuid": "8299dade-faae-4d35-9bab-9fa06019b08a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2a1a38-3700-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061249, "uuid": "6489c68d-0405-4e3c-a529-fc62ff42f763", "comment": "Malware payload", "value": "a8062ec625ec3cc24cb1be0b4b392406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061249, "uuid": "31cfca4f-1d56-4d35-a64c-c3d228dd664f", "comment": "Malware payload", "value": "1a7b23a1a1195333101db04ca0e84b901661347471732cbd75f4e0531be7c8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061249, "uuid": "89e294af-5c66-4b95-b5da-ce0c26a4269b", "comment": "Malware payload", "value": "e1d35cff2a929809e200846010d094e8130ae108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061249, "uuid": "b06b9633-8140-4ce7-9359-3c5244536a4e", "comment": "Malware payload", "value": "4c6ae49be7b32eb83bcd8ecc2531590f0122e0cc3df9034390313395ed7d8240195ff84ca11a9a97c4c0c73c5a01caaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061249, "uuid": "1cb77ebb-f57c-4fda-bb19-60746d5a4884", "value": "T154A68E49A35813E6C0F9D2B94F03C527E6B2B45B437251CF0AA5DA660FB7BE0563EE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061249, "uuid": "c5747cea-13ac-428e-be9a-637638b62cc4", "value": "a0e27f0ea457cbaaba6f1eaf319c719f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061249, "uuid": "38a85924-1e93-4bfe-8c2e-5a8aff44e78f", "value": "196608:YhZTn1mEm0c3x1itGajtKT6u9XB89vqeakst0G8M94Em:EZTn143PMGikV9xovq7N5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061249, "uuid": "13cd8459-c76a-4954-9883-9977b0bcb2ef", "value": 9815040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061249, "uuid": "19538c5c-b5f3-4815-8464-7f5171d2a525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061249, "uuid": "171dd113-a0d0-4dba-9855-e6167bac1abc", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c58f88-376e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776108161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108161, "uuid": "9a941d98-cc2b-4cde-85bf-cd8c5e81e5e8", "comment": "Malware payload", "value": "e32475dd552b2bf24d7da9537c4daa2c", "object_relation": "md5", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108161, "uuid": "ac018880-6adb-4219-aa4f-a58d738c4dc9", "comment": "Malware payload", "value": "1ac890ff8a824da863fbf28eb585438fd7654abd2653f8d49537fc27bce78704", "object_relation": "sha256", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108161, "uuid": "67a8bea9-7f12-49ab-883f-2ceaf86bcf52", "comment": "Malware payload", "value": "e0176280076ab6c1c7059301c8c6f55e6f77b0b1", "object_relation": "sha1", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108161, "uuid": "1104390d-b365-4d6e-a011-2040512f4a8f", "comment": "Malware payload", "value": "e95bc2c2aa7abbdd351a4daac303e1c6a262761ef41946ad4ae10616f0be7ebd89cf0e5d80910e79da8a63d9df4ffe4b", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108161, "uuid": "9aa3eaf7-33b2-4152-8b2e-1369d1a8952e", "value": "T1EC62C58CB3C94A38E8BECB7968B2E7244775FD0B1812EB5B0C82185D0DB33941E15E79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108161, "uuid": "de851866-8d7e-4a8f-9f9e-a1b00664eae4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108161, "uuid": "53d8dc5f-9056-4e05-9656-fa22b59e21a4", "value": "192:d3KJJ1/1sz3VnwxoN3H4FQdb8Yg8/LaRxpHutIoZwvqHsSm:0JJ9aFnwxG34FYbIs8xpOzSFSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776108161, "uuid": "acb6e07a-e75c-464c-82e5-b2a501c3c459", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776108161, "uuid": "bed345cc-822e-4ac8-883c-e2fd98f6ef55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108161, "uuid": "25b9b0a3-e84b-4517-b46c-ce5f4390e2f8", "value": "368fecd2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822719ae-3735-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083838, "uuid": "ecd4bd88-64ae-4f81-a381-50b5ca46bb38", "comment": "Malware payload", "value": "f89f84f772ba66a2d6bf173a2662b8fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083838, "uuid": "70d3788f-0ed8-463c-b476-040fce88c7e1", "comment": "Malware payload", "value": "1bdc0ff7f91fbb30bd0e7b2afab3149c5a1b07a67b30f50471b557a7a99a5ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083838, "uuid": "9084785c-4fc3-4f11-aa75-b1f69a6c3e93", "comment": "Malware payload", "value": "c27b3a35add6d8b3daaf1a41a7acff046c711c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083838, "uuid": "a2a7549b-51df-4092-8186-6572a92118dd", "comment": "Malware payload", "value": "dbce3c8bf4574c919a24b26fbac961c083a7bf5608c86ab1911a6df3f766c1536423debeb8f2fe9ef0bf55315d63ecd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083838, "uuid": "6c88a660-cecb-42f1-b85c-d3f82f8f24c6", "value": "T152942A3ECAE50116A0B7CA14BDA60423E5377B162B3D8C9C12C5124D47B390EB9BDB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083838, "uuid": "7f4f1e24-0a33-4bc8-bae6-23db338e04a7", "value": "12288:Ew55+Pk8dZpvgkrGznpWivOevWzpiMbDO:Ew55qksZpIkrxJYyby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083838, "uuid": "9ebeda94-cc47-4871-a416-ee09fd4901a3", "value": 420154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083838, "uuid": "ffec7d36-4316-4ab2-85d8-c37f6486bfab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083838, "uuid": "d4d45fba-5fc9-4195-8291-0ae641777b93", "value": "Amended Order -592418235.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d6e5e-3734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083491, "uuid": "d3404a06-e610-4706-a09c-3544582141b3", "comment": "Malware payload", "value": "27e9def766a2c37653d446141c302088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083491, "uuid": "6242e471-a42f-4393-b703-5dd5a53884ec", "comment": "Malware payload", "value": "1be5d7ecc54005badf1cc4bd6503bd8771e74fb2ad5cf6de3f690316224e2f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083491, "uuid": "f8b96676-45db-4133-8582-12257641c025", "comment": "Malware payload", "value": "cdcd9dfd68e047a0ed635297127a2476a400c56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083491, "uuid": "494c6fb9-ca48-418c-a4b5-e67ba92692ef", "comment": "Malware payload", "value": "185624b97e53ab4886b2eba0781acbfa477fdb2fb0de9d3b8359fa424fe9db7cc4605a9f0e71aa55c12a75465d214af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083491, "uuid": "35c7791e-226f-4166-bfdb-40279a6585c1", "value": "T11B746B55B6A408F9E967823CC9A34A06D7F2BC560770EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083491, "uuid": "7dc3789f-fdfb-4e6e-a7df-9434fef50d43", "value": "c59b379fe0b813ba434c2a225c8fce49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083491, "uuid": "ee0c2758-3593-457d-b96b-f0b8d9ebc2dc", "value": "6144:rdnTQIGOEzuYzN9NcvgY+MFbnHTfXDt12CKNNHQB/ay:rz/2cFHFbnHj72tFQha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083491, "uuid": "4f8b1db6-b7fc-42ba-a90b-aa4c03e6f785", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083491, "uuid": "e168be4f-a4d2-42e2-af84-be018c71cb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083491, "uuid": "0ba3196b-7b15-4396-8d9b-f1b97092bade", "value": "27e9def766a2c37653d446141c302088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0753eeca-36f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776055714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055714, "uuid": "b13cbec2-7d33-4b03-a02d-68ede1aa4e68", "comment": "Malware payload", "value": "c50c1bcab1cfa39ddfaf9b1eced5685f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055714, "uuid": "7cdd5b48-f96b-4d4a-baff-23324ac94744", "comment": "Malware payload", "value": "1c18f88ee26ec77de3844647f0d6adefff582f46f7b15658b281e7b1e1c67e65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055714, "uuid": "9809a6e5-c074-45a8-9edb-47a2ce3ca752", "comment": "Malware payload", "value": "c0c8b00fa01e0ae37a617b86287af1359f0e4093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055714, "uuid": "5c167f55-31ac-4c98-90d8-c57994a12519", "comment": "Malware payload", "value": "260b828cca421c3dff259eebf79bfe877c57a4f10ff67dcc81f9c7e2d2a7d632ed18f299ffbb2a8baaf7775f6f486235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055714, "uuid": "6d53f8a1-9518-4985-9bd1-a3454d13349e", "value": "T177A33863CC666F58C628D5B0B0B18F796BA7A96081875FBE1977C3748083D8DF5093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055714, "uuid": "c8d0d868-da81-4460-aebc-cec79ef18221", "value": "1536:7wOn+VXqG9tACAKPMkN7FwzFInCGmqYMyWZfyXxIZjwkG:wtACPrYFIAqJyWByXKekG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055714, "uuid": "9df36402-a5e6-4117-aa02-57e3d892b44e", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055714, "uuid": "c9d18140-2dae-48d4-afd5-636387be81ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055714, "uuid": "fd27a96b-b5b2-42ca-9ee4-039540b7d5ca", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20749820-377f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776115457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115457, "uuid": "92007fbf-1a9d-43c7-a039-f737eb28c5d7", "comment": "Malware payload", "value": "b082efa5ca313f2ab0e4fd35f5cd8a1b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115457, "uuid": "d622a0c3-d8b4-4f71-ad9a-200510df73be", "comment": "Malware payload", "value": "1c79894c64f8466f43ee59db01788cca1c9cbc9d585819b1b48b0fb82812e999", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115457, "uuid": "943b6a87-d017-4f23-b6dc-888ad208a7af", "comment": "Malware payload", "value": "36eaccfda54d86ef46b7f8214210c145135e1c5f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115457, "uuid": "b1d0884f-cb56-4f15-9c95-db0690d03e90", "comment": "Malware payload", "value": "03ec55391209851f0b16c2cee19ccc848d57bc9a75014f22f082e4c53359cdc0b3db95d3db5a2b5f624222e18ba7c67a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115457, "uuid": "000bd7dc-256c-46db-a13d-6904e66346cd", "value": "T16F6723E8EEDECEDCBE9DF8707DEF43D0585499CAF222884412D9D578E203A1B06419D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115457, "uuid": "20996b48-aa03-4709-8582-30829346cc92", "value": "786432:IdXBq7ygqOB67FcQwEshwSNfOVHbzTL1niooNNu3j5MoT:IdRq7ylOBgrTkMAXNNufT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776115457, "uuid": "eade0bda-ed2e-4cfc-ac72-a6975e08c0aa", "value": 31482256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776115457, "uuid": "a68b7b8c-6b2c-4cac-ad87-972b9c3c9ebb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115457, "uuid": "271ccecb-d1d6-4fcd-ac84-29d314bab393", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee78b5e-3788-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776119695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119695, "uuid": "a1762e3d-c01a-4766-9456-9af77938eb4b", "comment": "Malware payload", "value": "33c97b25ee3876a4df0df7872ddd3d0f", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119695, "uuid": "dbde2c0f-a666-47c6-91ec-483139044e4e", "comment": "Malware payload", "value": "1c99507c21061f21ab8e7b6a28df09579859a97ded37c05f2ea219ac9c24fabf", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119695, "uuid": "078c0e9e-118a-419c-b127-1fcb50c588f6", "comment": "Malware payload", "value": "bbca42447444cb3d8af9d1fa1ee8c4aadae0384a", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119695, "uuid": "600e802f-7d1f-42a9-8915-5d8430bc5221", "comment": "Malware payload", "value": "d4f73d5ffb22bb55d6a12cf1d1084005ce1801dcd023f364c6fce582165a211fc60021d91153fd8b7d3739d5ded98d16", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119695, "uuid": "437bb63c-6c77-4456-bfe3-ac44f5c40ee4", "value": "T128746B55B6A408F9E967823CC9A34A06D7F2BC560770EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119695, "uuid": "40f0c3f6-4bb3-4d50-b39a-1519cd8c2fc3", "value": "c59b379fe0b813ba434c2a225c8fce49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119695, "uuid": "c44cf487-fe2b-41e3-b185-a1a44e091c5b", "value": "6144:qdnTQIGOEzuYzN9NcvgY+MFbnHTfXDt12CKNNHQB/ay:qz/2cFHFbnHj72tFQha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776119695, "uuid": "257e4ab6-bf91-4481-8bc2-f453bf498a5c", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776119695, "uuid": "3ae3b19a-e835-4c83-9cca-3277a5049020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119695, "uuid": "f9fe9639-6eb9-47dc-817c-e43b370cbae3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7518d63f-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046879, "uuid": "ddb31eca-efe6-4e46-a020-3f5ed7f9d6a0", "comment": "Malware payload (Mirai)", "value": "b8ceb22da3431a4ef5f725a8036ce213", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046879, "uuid": "b6fd53eb-acf7-4b34-be50-ff31ef2ec57e", "comment": "Malware payload (Mirai)", "value": "1d9e1d253b90695380bdda510070d0211a4b127adfb4c477ea224fedba207885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046879, "uuid": "9a39ce90-97e6-432c-adb8-0cef7b609fab", "comment": "Malware payload (Mirai)", "value": "290655d80d231ab10956fe747774920faf4414ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046879, "uuid": "f57c9e21-fe75-449c-84a2-0dcaa67fdb52", "comment": "Malware payload (Mirai)", "value": "5a9624ebfcac69b495e29abed8d6dfa91a4d23e3943da77a9cd7bb8bb2c5c82ec2a49341df4c2630de1b2bc00dacea6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046879, "uuid": "4216a5a7-d0ac-4941-874d-03ea56bfb729", "value": "T13AC3178ABD419B02D4D325FAFA9F414933139BB8D3FB3112CD259F64238A99B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046879, "uuid": "0f31f1fa-e7c0-428d-ba8b-ac86b403d2ef", "value": "3072:6fkuSxTJYpuuQ/a/hiW5hwuneqd+NYnSj/Xj6Kmii:DALUa/kW5hwunRd+3j/Xj6KNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046879, "uuid": "52c1ad5d-4ce2-43ce-97d4-50e1ef62b0a2", "value": 123700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046879, "uuid": "768b33b9-3010-4a65-8c76-5c17e30623aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046879, "uuid": "40fe227f-3c7a-4de0-91f6-75e0c18905c1", "value": "SecuriteInfo.com.Linux.Mirai.10456.20957.21847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fc6e90-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046872, "uuid": "0278dba9-734b-47d5-b50d-38e9b600a30a", "comment": "Malware payload (Mirai)", "value": "bb42dff45e2df75162b1e2aae6d5552b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046872, "uuid": "1732ef05-f975-4dea-ba5d-27c1f5def360", "comment": "Malware payload (Mirai)", "value": "1e8dff7f28f699aeaab0b298c00f7833f9861247066285c9631a38a4587fe4fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046872, "uuid": "ec9066d5-c11b-4cca-aee0-483bc69a990e", "comment": "Malware payload (Mirai)", "value": "54c13efb773021b02e5d62f493520bc59041788b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046872, "uuid": "eb0606d1-f6a1-4aec-abcb-b895364a7c5a", "comment": "Malware payload (Mirai)", "value": "28e5c596c61a1816a7ace4ee21ec3cd37e9fab01ef160d7ccc1d3def190ec18ac165c816c71660a99d9409462d524787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046872, "uuid": "2c588f82-3b2e-4bac-9a5a-10ac7976e30d", "value": "T1C3932986A353D5F0D84315B001EBFB3A9A30ED721530D96AEB64FFE299236D6600672D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046872, "uuid": "ec2a82de-0d03-40a9-a53c-367554e757d9", "value": "1536:3/gE+5j+22cmKP2VZN7plhrii5p/rfXAYoOUt31ZnYVDievr:P5++22DKPY3pDii5prANrnyDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046872, "uuid": "0e213193-2457-4ecd-9065-32e130fc2f57", "value": 93952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046872, "uuid": "64547a39-e070-4f18-b11b-1836f76acf6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046872, "uuid": "ed9fad63-4398-4b23-af0c-ad63addf24bb", "value": "SecuriteInfo.com.Linux.Mirai.10456.29161.8349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaaa8fa-3715-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776070028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070028, "uuid": "a3768491-c39a-46ea-b17a-42ab46d4e6d1", "comment": "Malware payload (Vidar)", "value": "ff32368114162fc6276936cdc3424a95", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070028, "uuid": "f20b8a27-a386-48ee-a044-1e36e9fe25ef", "comment": "Malware payload (Vidar)", "value": "1f20ff3e21706323c534834e89bbb41ad43df70d024e426ec3b530e626f3f832", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070028, "uuid": "cf994447-4b01-4d7e-9292-d75826d7b869", "comment": "Malware payload (Vidar)", "value": "9cd301485fb6d8606fd00c975f3fa74cd49b5cfa", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070028, "uuid": "b15305ae-852d-4668-a219-81ffd63448d0", "comment": "Malware payload (Vidar)", "value": "44f94c8b1cc101ec0440d9ecfc2e82ac0be8be83a447d15352582012592c4faa6796011420bfa38ef593348d944a32fe", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070028, "uuid": "c5e7b79b-6b7c-4922-ae94-65b12a726603", "value": "T11CC58C0B6C9449F6C0AAA73588B25691BB74BC090B3233E72F91B6783F727D05D79748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070028, "uuid": "bad6f7bd-6101-4776-ad99-55476a571e89", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070028, "uuid": "edaa4aa0-6f8d-4ac9-a6eb-b99c0136583f", "value": "49152:3QZ06mjZJD7Yi2jNynxwu+Y31El2Go9G2G2rjOx:3gsrgBUw5Y31ih+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776070028, "uuid": "b5cd8364-4826-4cd2-8ee3-b1707417d8a0", "value": 2555536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776070028, "uuid": "d876102c-028a-46d7-9f99-21bd6e340c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070028, "uuid": "66d6c67c-dbf3-49f3-990f-bdf6595913f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3fd71d-370c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066032, "uuid": "0a1c2321-cfa2-4f21-89a7-2d2a78860402", "comment": "Malware payload", "value": "e094a88bcb133fdcce0d945ba759a70d", "object_relation": "md5", "Tag": [ { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066032, "uuid": "5d5cc111-cb9c-41e1-895f-2be36ff8fdcc", "comment": "Malware payload", "value": "206bc809554c8877ae3ddff321ce2a637a122451a24482eac52d5606680f4488", "object_relation": "sha256", "Tag": [ { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066032, "uuid": "f85e5ed0-38c2-4670-8efc-12051bb27924", "comment": "Malware payload", "value": "c03bc04ce2e09b2afaf71d1cf40a16ae97b7c732", "object_relation": "sha1", "Tag": [ { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066032, "uuid": "ef085c80-af89-4f1c-aa35-db794e1023fb", "comment": "Malware payload", "value": "0babb5adef5b6b5284f0866449d28766e2d8d398272a87d37cf554ebb4b7e2dc5b4a161f6b37c9057a15f18c0bc1a1a3", "object_relation": "sha3-384", "Tag": [ { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066032, "uuid": "0db7e2cf-da13-4fe9-ab20-87d7ed8c9f67", "value": "T1C6747C3636F8DD01F5E67B90EAA949152F3ABDB939FBA05811400F3DC592C184C897BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066032, "uuid": "80abed05-7152-44a6-b91f-41ad337010d8", "value": "6144:T/VfdvXw4CDlGBKEx2Eit0vq7YaXX8Tqdq2RQvCqAgLPOeGTUChUkIwsV2zFg5Tp:T/VfdvJCDl0KEMEiKvkYaXM23njgLOza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066032, "uuid": "7a2d99db-54e7-4de3-9c72-29292a69d93a", "value": 359160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066032, "uuid": "20f317e5-ee00-439d-b1ce-447b0991554f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066032, "uuid": "2a7673ca-d548-4600-92ae-6949cc0c461e", "value": "PO#MAIN450000000227897_Sraco_Doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f00071-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043468, "uuid": "4def544e-cf53-4afe-baea-267b3d1fa6c6", "comment": "Malware payload (Mirai)", "value": "b087dde850d6b0a956ea559b63cfd0e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043468, "uuid": "4aee2904-8dbb-45b3-8e1f-dbd4aa01d6a7", "comment": "Malware payload (Mirai)", "value": "2070f833ca049b18d3526b0cb66e73c8224666c805ab6168e87fbc28da806c9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043468, "uuid": "661a7c14-8434-4814-93f5-c31d775f77c4", "comment": "Malware payload (Mirai)", "value": "32f9c4fe318596963daf339b75e7c70dd263d970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043468, "uuid": "e98c418d-8fbc-453c-9aa1-a67f6f62bc62", "comment": "Malware payload (Mirai)", "value": "c5cbf376965db2a9b855dee119e3ea8284b65bc3777272c80e4f850996b64d9cf49d6ddb4b871d01b3472ee89f020457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043468, "uuid": "116c25ce-81ab-4342-ae8f-1e919906f611", "value": "T11C835B83AE655F4AD14365F160F2CA715B22FDE609131EF5B8B6EAE94143EDCB1023B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043468, "uuid": "1e89761b-5f11-47a5-9ae2-f51641c7fe3b", "value": "1536:0f42ww7ptg82P6SojdKv74y7YXc+CMokwN3/69/1:0f4Fw7k82DojEvrCc+Yf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043468, "uuid": "fab4a1e1-b77b-4255-98fa-ae0b80543dea", "value": 86464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043468, "uuid": "88d2961d-817f-4cdd-9a12-fccbb4ee2517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043468, "uuid": "f5635bce-61d8-4fa1-aa22-4834ca9c4f73", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12412ccf-3790-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776122734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122734, "uuid": "27fb1c07-76b7-4f75-ac87-12e137fe9d08", "comment": "Malware payload", "value": "043e66949a310d0b71c67002223769f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122734, "uuid": "6a3178c8-e603-4511-a46f-a383b33f5660", "comment": "Malware payload", "value": "218f94564cd1173bc156e696d2118f15e60f883ef52ca5743bcdf1d9e4ce7071", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122734, "uuid": "45647c7c-75f3-4f25-b83a-301c7365ee37", "comment": "Malware payload", "value": "c9b7fac79d5ee3da0f82706bf2ef62a1f1005eee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122734, "uuid": "a86642d3-e23f-436d-8e4c-189946d93156", "comment": "Malware payload", "value": "08650f31f293ef5592574fd6a4b768550725cfbb468664e9eafda6f54247e775004e7f5a97d7e90af49a4990d8c3d96b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122734, "uuid": "a3f72ed4-32cb-4270-97de-8cb59092b55a", "value": "T134653322B68D605AF775B0F6D750CABA97EB1175205228CE0C63B7586D0313C19EFB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122734, "uuid": "b8d66bc3-fd83-47ed-928f-0066cf8d238d", "value": "24576:gdVKVhSTlMige0c5LDj7N01+R9Y/D9Dj+Dm8mcU/8zY32iposeaU0FgK7UaKj8QY:guhSpMJJ8HeA4diScWF3DpJet0FJj48l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122734, "uuid": "432583b7-0292-4b5f-bc8d-b9a57b0c691d", "value": 1444896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122734, "uuid": "7b0e19fe-0804-4c40-8782-70f12190be94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122734, "uuid": "18d6b9ab-9587-49ce-98e3-5f59b50c5a50", "value": "13042026_1047_11042026_RFQ_PURCHASE_ORDER0834576834.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c44ed9-371b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776072725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072725, "uuid": "3e40d5e8-a711-4bd5-9419-f5ba49e6d94e", "comment": "Malware payload (GuLoader)", "value": "0b97f644a90840049612c66d7cf96876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072725, "uuid": "6f301925-7e14-4cb7-8390-97fd753bb4e2", "comment": "Malware payload (GuLoader)", "value": "21d15372d1f59f75705655685eae6ed918c15c9a91110793ceed42f07d249113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072725, "uuid": "9ae98152-5b55-4a68-aa1a-2ccfb74e00cd", "comment": "Malware payload (GuLoader)", "value": "020c8360e06e52866bb303b207eb87cc58efa844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072725, "uuid": "5ec2d65e-098f-428c-a281-5bf572d894c5", "comment": "Malware payload (GuLoader)", "value": "53cb59baf9a50c2708ba294d278ead668e7c9548f47ab2306e85b59695ab7043951feede5d34e7fd4fb4fe6a486c371e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072725, "uuid": "2b7e4fba-26c9-443b-a7ca-cf2e9210b8e9", "value": "T141666D26EE5405E9CB8392BA882392D2BE28B400531123DB66DE135D1F536FC9377F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072725, "uuid": "9edb0b41-3f76-4cdd-a378-7e0a0f35e2a9", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072725, "uuid": "0dac9e58-e8ed-4d0e-b969-861a379b3547", "value": "49152:y/QigqABseuoLTerxM9WLKoihNrFKFNqjqQclcnFwnlT7GYag4IqWRCv3/M7lrA6:y/cPLthNMFNic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072725, "uuid": "fd572f83-58aa-492d-a253-ffed8386e374", "value": 6622236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072725, "uuid": "38d52459-f8f7-46d8-9bf7-22f6b1d41854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072725, "uuid": "dc18e38c-1ab0-4a5d-aba6-e86d92747936", "value": "SecuriteInfo.com.W64.Agent.ACA.tr.9772.16664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd722ac-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776085842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "d66997ae-c92a-4d93-b364-d47b4eebd7b1", "comment": "Malware payload (Mirai)", "value": "20e2ef94729a0585cfc4949d136d594a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "04e41788-d073-4257-90c0-dd4362170389", "comment": "Malware payload (Mirai)", "value": "2284556a1692fcd26b7e8f248304a6ce3c45c3fc4fd648ff3ab938704121c964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "d07a5a04-1d16-4a27-9237-4ad79a035b4c", "comment": "Malware payload (Mirai)", "value": "b214272bef8193fe6870671ba0dcc4269deaffff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "093f7ec1-36d7-4f40-b0af-83a824d12830", "comment": "Malware payload (Mirai)", "value": "d6fbc49900b4233fc16dbf84a52190a2e82913ad13ed848a8c1ee69982031d52f42003845f3a1d77c9980b54e731dc40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "56d775e2-fd8a-4053-8c90-7a19ea76b712", "value": "T1D0042A45AA404B13C0D627BAF6DF42463333EB5497EB73069528AFB43F867AE4F12605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "2f44be2f-a80e-4a69-964f-190ab9e5bc6d", "value": "3072:mcq5CdNijqyXgMcmavNZzG2mJUXeB6F+g3vR+oiM/RF+1guC:NqMdgqyQvmavNZzG2m0Z+g3JniM/RA1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085842, "uuid": "4966d872-e4d2-4e12-8864-cd11442bce72", "value": 183902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085842, "uuid": "926e963e-1c0d-42ea-bee8-304858a7ce30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "c4e1cbfe-e14f-4abc-9e56-8b20adbe8e15", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a461dda-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776060095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060095, "uuid": "108e2a64-dc62-401a-8591-f1634d910d88", "comment": "Malware payload (RatonRAT)", "value": "0dd19326cddd649b4552cfb73b664f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060095, "uuid": "a22dff89-2a66-427b-8655-3b7e67064dd7", "comment": "Malware payload (RatonRAT)", "value": "23cf64b51bbfc27a325ba9448d9f688f7ab0b382466d8c38e07e034768c24774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060095, "uuid": "b2308822-477b-4b44-8df0-b7a37e6b526e", "comment": "Malware payload (RatonRAT)", "value": "ec40c2cc9511d6cf72e46170d6f16743458de19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060095, "uuid": "d836a0e8-3260-4d30-8be2-47d644a9dee1", "comment": "Malware payload (RatonRAT)", "value": "5bd7e33d8d586d10241556d7b2c504656fe3a5f821ab48d92f73a27e8b14f450decef92ef1e7bf7664ef0a88506b7973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060095, "uuid": "20c1fcda-a4b3-49c7-99f6-8bef897a5f53", "value": "T17AA52343B7B84BA7DC842F3EACD6A1E50F70D2D205068B871684EA7F5DC7B840E592E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060095, "uuid": "36e265ed-3753-43c4-966c-7a239f04dc7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060095, "uuid": "ee96c712-0930-4c70-99ce-c03418154aaf", "value": "49152:25xZMopGNFm5D5rmAqZhX7BzuXi+9Xtc1LPVgKNqV4ZtHsoaWFOUg5G4f:+jkYrqt7BzwXtc1LPVgKNvGoLOUg5hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060095, "uuid": "d4412552-faf1-4115-bb6b-9b2ad0ce49b8", "value": 2249760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060095, "uuid": "62fcd574-ce13-4401-a311-8705cf41eaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060095, "uuid": "704691f4-fc14-4b91-aa22-1de33203cefc", "value": "AuroraLG2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e4d2e4-3767-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105186, "uuid": "21e488fe-6773-4a34-9ee7-8e29cb91b7e2", "comment": "Malware payload", "value": "98274e951c65422e1a1cf81c52dbc947", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105186, "uuid": "cd48449b-6074-4b20-a893-6d9f2dfa91de", "comment": "Malware payload", "value": "24355464d214951029a59d1dd8ffa48a6bc8a7a1e6873bf045402b1ffbff9cb9", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105186, "uuid": "9f10e18b-e9dd-4fbf-9636-4771c22e4fee", "comment": "Malware payload", "value": "a7ffabe6b2c611ce0d54d08724c9636f752b2770", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105186, "uuid": "eeb4573b-2443-46f9-b1a0-334d40011d77", "comment": "Malware payload", "value": "f8036e53da2a7c580624aa269a6b9791ca84b93de610ee0e434045437466b4566bfecb5a0b0c8796c1f9c9c19ac99a06", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105186, "uuid": "62a21a18-a332-4518-9adc-2e4a3cd81108", "value": "T1A3663377E43C1CCED53B947ED0A1199083F9230ED686E47AA5927ED4B2F278908CD16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105186, "uuid": "675fa7d5-8b0c-4b15-b253-332d144aee4f", "value": "196608:ebHXUZZftu1/14z1Ufdn0uU+HB/OGUElH6XU8YYs:ebEZBAh14z6fdnrU+h/PUEl0U8YYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105186, "uuid": "5ef40428-6d89-4f37-89e3-c71eeee80ef8", "value": 6830414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105186, "uuid": "9d04141d-7c25-4b68-8fbe-2e92462a6f05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105186, "uuid": "a0308f7b-dde9-4d01-b419-44aff9648ab6", "value": "24355464d214951029a59d1dd8ffa48a6bc8a7a1e6873bf045402b1ffbff9cb9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b015b2fa-371a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776072318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072318, "uuid": "f80f4f4a-2d7f-49cc-8efe-68da331d16c7", "comment": "Malware payload", "value": "489ae4cb0db1c1c08015ef10179f6464", "object_relation": "md5", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072318, "uuid": "91900041-4d93-4cb8-b134-a35238b6ae03", "comment": "Malware payload", "value": "24bc597cdc354ae9b40eb33463db3633e9011c070ef21953ff2e0cf500b77c3f", "object_relation": "sha256", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072318, "uuid": "192fa7b9-bd93-41b4-a6ba-7b3c48079799", "comment": "Malware payload", "value": "e8580b3e0e1026b2477b380e988fb1ef17db17ac", "object_relation": "sha1", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072318, "uuid": "f23ee22b-f5ae-4f9e-9307-9b72750480aa", "comment": "Malware payload", "value": "e2a3cebe698e21ff29f18ec69cdb616b779516c2219d143aca72b35737264be05fef021f31cb865c365ca535108c4565", "object_relation": "sha3-384", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072318, "uuid": "aebf8e02-f4ba-41f8-8840-2e487a9e0218", "value": "T1831105F93F0301A576D543602D8626960CD6421E91486C3D486F9B2637D95D173FD9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072318, "uuid": "f11cecf6-b19e-4747-ab0c-50185dd26038", "value": "24:tBrg+ePYdAuhWOJlbvYiixE27ezJWOJ4J6U:fM3PDuhWElC7+JWEu6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072318, "uuid": "e71d75d6-756d-4483-9db4-1fff79a84dbc", "value": 984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072318, "uuid": "6af02cc3-1ade-4771-b5dc-d670dfc0ea70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072318, "uuid": "e9891b7b-f6d6-4ae8-814c-86ee465015c4", "value": "checkping.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eba5bd-3738-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085268, "uuid": "b5b7d701-1dd6-4505-9b50-139163caa8a9", "comment": "Malware payload", "value": "b0feacb72ff7339d08595369f4f11c5b", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085268, "uuid": "e84ea1e1-b75c-4ee7-b85b-212a53646d7f", "comment": "Malware payload", "value": "24d26803a3f2cfaa6c784c443afb9102abcfbe88af090cad3c4303545415baa4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085268, "uuid": "00898dad-2ad3-43f6-ac1b-d8dceb5dae7e", "comment": "Malware payload", "value": "bc899567f67212faa988563aa941860f47e0e364", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085268, "uuid": "9fbc4481-9f6a-4e00-9db4-30b3676817d1", "comment": "Malware payload", "value": "0f239a79ffedcf6d8b393f3568506f41acbd27c4bcde9ca864739cf579382441cf298607c00998a2c65a23a928eb184c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085268, "uuid": "cec0d983-156a-4af1-af99-4c205194701b", "value": "T11C512B803220DA18D5914A7ADD82DB856736FE11FD42D3577071334F5D765A00D52667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085268, "uuid": "a7d6c0e1-31a8-4fec-a22a-0aaf4fac5bdd", "value": "12:rl3baFqzH5gCUTs2ACZ9A5ol0sNYKhQkr/0df:rtH5nAZEqnh7r/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085268, "uuid": "4019aeca-4692-4371-8b23-c28a6ce87b97", "value": 2516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085268, "uuid": "daed4428-257a-4269-9a0a-e7cfe10caf69", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085268, "uuid": "54ea54fb-84b7-4c69-b7cf-e6407a121340", "value": "payload_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e185d01-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046867, "uuid": "bfc5998f-46cc-4b3a-ad92-6f9bffd7346f", "comment": "Malware payload (Mirai)", "value": "75fb707b80b367ab9b6a82d6b4ca4454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046867, "uuid": "87b43aaa-aa7f-4fb8-b2e4-7bfc6ba554e1", "comment": "Malware payload (Mirai)", "value": "256c64e5ad3250491c520c48bc32794bb89508a6a51399bcc223b60ed9576510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046867, "uuid": "4563bc2c-d3ff-4700-9641-3647f07888ba", "comment": "Malware payload (Mirai)", "value": "87d6a65a6552bc719eb4176c054cfc82c7efb830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046867, "uuid": "9f5240a8-7497-4f80-8e09-27b7f1659a53", "comment": "Malware payload (Mirai)", "value": "e370feb7b30636bf75f23f270f84a5bb26e326ee2c71ebf603873f991b13d1b939f889f9929f2a4670f35d6b3029ce7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046867, "uuid": "9edcc487-f2de-4f28-b728-c9acd169f235", "value": "T13FC3178ABD419B02D4D325FAFA9F414933139BB8D3FB3112CD259F60278A99B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046867, "uuid": "e9201d6c-8dd6-4dc2-a8fa-73704e54b8b8", "value": "3072:6flSNOTJo87uuQ/avhiWxhwuneqd+NI/Sj/Xp61Ri:8oaLUavkWxhwunRd+Hj/Xp61Ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046867, "uuid": "1689c686-f842-4f14-862a-aee4bd8d673f", "value": 123700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046867, "uuid": "3de3d443-4e3c-4e1d-8434-5d11ad8e77e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046867, "uuid": "ae386cd3-33e4-4fa4-8625-2e0acdf629e1", "value": "SecuriteInfo.com.Linux.Mirai.10456.24156.29967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e541c62b-375b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100325, "uuid": "44050a8a-4cd6-4293-8aca-880e67f6cd2c", "comment": "Malware payload", "value": "e8eeb0538476b61904534dc0bdcfe5a1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100325, "uuid": "d23173d0-c7a2-4176-ad77-2fdf6d08b739", "comment": "Malware payload", "value": "258283b27bb5e7409048e413100b37ce484248c39582c4e9ba1a3c7d9d48017b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100325, "uuid": "aea37df0-b836-4818-9fc9-650fd58d2787", "comment": "Malware payload", "value": "c35c768fec1fcd081b8711606b00f0c140e9ec4b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100325, "uuid": "9c7eb859-24df-483b-b196-58f422a88d50", "comment": "Malware payload", "value": "f593a74a73f335b60f1669278a7f5b206eecec6a02e15d09c316ff85565bfd0cfcc21cc457e265b1bb03ebacce37fc52", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100325, "uuid": "289f182f-ae64-4240-8d71-48ccbd9a0b1a", "value": "T1E5E022E88E16FE22C070483BC00AF3310F26B90E1B40B1E300E0A6D9E8711893E3627A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100325, "uuid": "e99500ae-b759-4829-be5a-c9c3d1664e99", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrllyWXNeWLVpFyC61AiJWXteWLVlHV:4xtJCUOblw7BJYXHpjXNeWRhfeWwebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100325, "uuid": "74258c7f-87ef-4283-9e39-800bd008c2e3", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100325, "uuid": "aafbf401-195e-4320-92c4-96a918bce81a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100325, "uuid": "fd3031c0-bd61-4226-b68a-9d3aa371a1f8", "value": "form_897893.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8d3cf9-3749-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776092502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092502, "uuid": "e58eef9f-2ea3-4bf4-bd43-d1c84fa966e0", "comment": "Malware payload", "value": "0b3621e75b85ef84ee8a2d5ab2f73b4f", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092502, "uuid": "e0d6737f-8f1f-46e0-892f-3bac745470d5", "comment": "Malware payload", "value": "27b28402efc1ef4c0457da0beffa9faec2c5579d30f733d55ecd16d93083b8ab", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092502, "uuid": "1504edc1-63a2-4d61-b5b6-a9936edb6d56", "comment": "Malware payload", "value": "85e77201ceea9d8b98151690d3a34cb4fc64cffd", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092502, "uuid": "5691a751-e623-4193-a7a4-6f8706585b35", "comment": "Malware payload", "value": "1cc1e0e919acc506cbaa0ebbbde314dc1cf08cca1698f7ae6596316f6feff76b54604c58ea14dd5ebb09f34ce3fa148b", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092502, "uuid": "af499cee-6ab8-4196-abf8-6a7efaf30f48", "value": "T1BBC59D0BAC9145F9D4AE97368CB26291BB74B8490B3133DB1E90BA743F727E05E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092502, "uuid": "075452da-e603-4ff4-9981-73257357ce22", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092502, "uuid": "d67e537c-f773-404b-8571-b577f483bdd1", "value": "49152:inqsMOKFEUhyfBBKAvLAXptvCYp6Mj//ZrqDIw9p:iMpEfTO55p68//ZrqDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776092502, "uuid": "fcb81ada-504e-4481-8684-4be3c24b18b2", "value": 2710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776092502, "uuid": "4c77db34-5cc3-4636-89d2-73cd837aeee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092502, "uuid": "2b6686b8-7c8a-46b3-b943-77be73e47d5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ec8ce1-371b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776072494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072494, "uuid": "5e1c281c-f68a-4f3b-9c05-58f998f70aa3", "comment": "Malware payload", "value": "3c9ad24dd8a3d52353c61cd2772bf53e", "object_relation": "md5", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "client2", "colour": "#A78371", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072494, "uuid": "6d916f22-5c8f-4696-acda-9edad7a6044f", "comment": "Malware payload", "value": "29891119e3e89fdaa1a9201656ba958c43e6ed312064195b899bbbcddc88ac63", "object_relation": "sha256", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "client2", "colour": "#A78371", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072494, "uuid": "1368947d-c450-4cb9-86de-db44526396c0", "comment": "Malware payload", "value": "a12f25488ac92e1a2482ab41fcbbd38f04279b3b", "object_relation": "sha1", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "client2", "colour": "#A78371", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072494, "uuid": "ab939d9c-bfd7-4f11-b165-642e5d7974e0", "comment": "Malware payload", "value": "14b4462252dc2f89abd59b7f21f0bddabb992058c7acdaed2c384894f9f29ea986d35207dd09ae0761795ae9ad67d809", "object_relation": "sha3-384", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "client2", "colour": "#A78371", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072494, "uuid": "140c2404-0d51-4d5b-b7b9-761eabb312e9", "value": "T159873396FC35D3E6157BE41254943A1A4B8F802E1EE229BFA430D1C719F3CD35AB642E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072494, "uuid": "fb2f2128-68d6-4323-9d92-5ea94b2e5f39", "value": "786432:fNKy9EZoj6hdIsOTr/3Dz1k4JWVt+NgCX6ygwjB5oB/ezEOPRpBvR:VdeZojyRcr/zzO4Jek6O5oBGASR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072494, "uuid": "e0c8b3bd-1ba6-45c0-95fe-2cf136e14875", "value": 38530458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072494, "uuid": "f623478c-be55-4d72-8f6d-0c3c473c1a23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072494, "uuid": "33d7694b-3018-4714-b3ad-70b4ad4d746f", "value": "client2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac8707a-377f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776115769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115769, "uuid": "6ce84ce5-cb83-4eae-bac4-74474e67c596", "comment": "Malware payload", "value": "9af4f1c0f39779cf1bdb2ec4b5ff1082", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115769, "uuid": "2c2172f0-ab74-478b-9031-b7ed43fd5133", "comment": "Malware payload", "value": "2a54f64394be9dcc430f4b75b09789ade638b4b6f774a38f2d59c27fba19a272", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115769, "uuid": "7a2de9cd-e4ad-4916-8ffd-b6ff175f86e9", "comment": "Malware payload", "value": "5355fd4035cbbb48abf12d13dce8fbf87dbbb834", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115769, "uuid": "24d60ab2-c244-4c4f-bd92-06771d39d1f5", "comment": "Malware payload", "value": "2a59c1d60221246b6a920c336e06992ffb65ff34b4d19e07cbd124af11951c3c47e7624e45425a97349b49a9cd01ddd6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115769, "uuid": "8fa1b75b-fc36-4f08-ae38-257a29f7cb4b", "value": "T12923BE1F2035B1199C66471B914A3803F89BC9DDD282EB9456C72BB8C601F9E7F21F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115769, "uuid": "d7a63b63-73c0-4c9a-8b35-3888fb0d3cef", "value": "768:6DOiTyqrdSx/1Tt0wVEhAiG6zTKFkPF7hLadR9UCsF9yWoftp:6S8RKtVuhAiGHaqdR9UCsvFofb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776115769, "uuid": "6f90e335-2536-4a0d-8309-c5c7f48d8e6e", "value": 47806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776115769, "uuid": "9cfdd7d5-67ce-4af2-9a19-abcbebecc548", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115769, "uuid": "d4fbaac1-df0c-4ba9-a8e4-88ffe1916360", "value": "Portal_Procesos_AUTO39994034_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481a9dbe-378e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776121965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121965, "uuid": "c3980513-7e6d-48a8-bdd9-73a9e63bcf41", "comment": "Malware payload", "value": "678a50026f858442c0e4736efcc7a832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121965, "uuid": "efb32400-3585-4966-a963-e33a2531ba3f", "comment": "Malware payload", "value": "2a66517cedacb808725403d02b88dbdd47067f29fd2ae957b90ca22460bf0f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121965, "uuid": "4741569f-3e69-4f42-9a0c-3788b14c95cb", "comment": "Malware payload", "value": "81da9e49527e80f13847778241f8eb242a62214b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121965, "uuid": "243899d2-b687-44c0-9537-9a2d9087d4f6", "comment": "Malware payload", "value": "42e2073583e6a097ad2de4306c4a365fb7e4cfa1895729fe63a0e80d9610ca3f182a986c921a7eed556b8db51d4fe6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121965, "uuid": "49c8eb9e-7d5e-4dba-bae5-81cf72c4b338", "value": "T197C43116EA20A02FE49389F0797995467D293E321690EC5BF7801F993470AABF4F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121965, "uuid": "a8d5c1c0-8756-48cf-b660-ffb64a9927f7", "value": "ae8db5183c63f052b7db761119489225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121965, "uuid": "8d9e9607-965c-4827-af99-d8f18d67f658", "value": "6144:nY9L5gsXs+I+1qeiso9r2+IOyxVxo6H2gk1d1wH1dDlATFIl0cFKHQokHt5XcUyD:nY9jXskWgrCnygo2JQSgPuq1vTvKPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776121965, "uuid": "9cfd4f9b-dcdc-41c6-9daf-8766e7d72d0a", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776121965, "uuid": "004635bc-1871-4992-b30e-ff6ea7164ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121965, "uuid": "e23fb89e-2512-4aba-b72b-074a5862e0fd", "value": "ORDINI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac593c1-375e-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1776101596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101596, "uuid": "71b80826-d393-4174-a3e0-54e990ad5800", "comment": "Malware payload (DeerStealer)", "value": "76b9bb237da1241f294ddb6bbae33851", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101596, "uuid": "7c931dc0-5ca4-4e04-8913-97a13b54e8b5", "comment": "Malware payload (DeerStealer)", "value": "2b1f971f0a4f1b97560936543a216589e820960d64569dd85e40a242b680cba9", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101596, "uuid": "35d9e3d2-8d76-495e-9407-b9b86275a3c1", "comment": "Malware payload (DeerStealer)", "value": "acdf7e971dc74429ab1a2e198ee0cf3b565a093d", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101596, "uuid": "6030297c-ffe2-4482-945d-05bc21058ec2", "comment": "Malware payload (DeerStealer)", "value": "dd66a436902402a167e925311d6120f35e46af7277a573cb337c08d6835a0f179e05567cbe7ff5c16ff5063b1a9395ab", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101596, "uuid": "c34ff24c-5e39-4295-b87d-7d57b227c942", "value": "T1625633B4F3E180F9CDF2977648B3AD938297FAB55D31164E664C22206E33FAA0635413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101596, "uuid": "23c6f243-e1e2-4792-8b8b-100697f25749", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101596, "uuid": "744eb4e5-3c05-4e76-8757-f349b9531f7f", "value": "98304:SpIRU1sWHtz+VGqCrZmWpyih9Gkj1xdJ39V4wK9cQE12XHk9EH2Ud0SVHdNYXEB5:SpUUtf1d9FnP39ViCDmHX0We6Xx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776101596, "uuid": "b6410feb-637d-4072-86e6-f74d6fc52086", "value": 6087999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776101596, "uuid": "46b9aa08-a361-498d-9924-cf9ae417fd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101596, "uuid": "802d06a2-80ad-4273-a7ea-6bbd4329e3f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78fdf62-36f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776056493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056493, "uuid": "2bf6f891-83ca-4e30-9dea-8389b596ed07", "comment": "Malware payload (Mirai)", "value": "40d692368529c38623793072b8e020b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056493, "uuid": "830b92f8-6f94-46bf-af41-c58ebcc44192", "comment": "Malware payload (Mirai)", "value": "2b4d8e7bcaf850ead0283268ea0c5500c95e33c16283bba502506025e071928d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056493, "uuid": "a16c3a38-1936-47ac-af89-7c80aefebf80", "comment": "Malware payload (Mirai)", "value": "7f580a77ddb99069c19e13d1b23ea6784be5fa3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056493, "uuid": "5f6efa90-9d30-4c7d-a2bf-54dd56be9037", "comment": "Malware payload (Mirai)", "value": "9b7fe0d505eb1aa87dab1807b068ca8e5a8db9cad98502ed7b4893439ae467886dd2877eab6935c22c27b180628bbbf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056493, "uuid": "12ba2d3d-ed52-408f-8062-5c08a5547d27", "value": "T1C932D80797BBAE97C0D0237302B30751B2A99F827590637FBE051C4A5EA63446C2F7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056493, "uuid": "5643ad4e-8371-4ce0-97bd-3f9cf6cdf3c2", "value": "192:c0VM+0OR1CQyMwno5NHHsB0TeebLSBWgsPlkUGrHlaz7IDsOeK:zVMdLxcNHMuTegL2OdnGDoz7IDs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776056493, "uuid": "f25ab90d-3d9e-45da-9231-6597a63d4782", "value": 11612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776056493, "uuid": "afd534e9-3a90-4be9-a8ec-681b99bb0696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056493, "uuid": "f0fa0b73-4585-4b48-a86e-6507d1a96363", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663ca938-3758-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776098823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098823, "uuid": "8ff96b15-cce6-4326-8982-8a7f9391ee02", "comment": "Malware payload (GuLoader)", "value": "328af7facdea18af90a26fdf6bb93ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098823, "uuid": "0a7eb572-9eb3-47f4-ba65-951a66fdf277", "comment": "Malware payload (GuLoader)", "value": "2bbb37485871adac5f5fb129a01cc638e2ecaafa178ff807d08bad9bd37a1b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098823, "uuid": "d610b05e-2f87-4ff3-9d47-2a5aec88d435", "comment": "Malware payload (GuLoader)", "value": "bf95a90915965b3bb635a43982a52351937f3b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098823, "uuid": "20fad1c9-2078-4959-96ae-654e89022e15", "comment": "Malware payload (GuLoader)", "value": "91229c96e4bc6b35d464aa9afa29962a2deb370b259cab34028edf61c787ecbb32f3a9673667e76e77099d315aaf18e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098823, "uuid": "b15c0530-2acc-4a49-9186-f7bc42489fdb", "value": "T1CA469F12ED6809A9C592A37A887351537E38B800171123E76AD9636C1F737F8D37AF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098823, "uuid": "bb8c2ef3-bda7-4b71-92fd-43829ef1bb78", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098823, "uuid": "fa438fc8-264e-424a-b724-0e48df9d3867", "value": "49152:6x8hZ8I2gsng5o42dCqX8ZNKBgFjipzQcHfnrw4KGvuWXsEgm274S3ncqmygXjBa:6xIf6BmUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776098823, "uuid": "608817c1-861b-44cb-8ee2-4ce4af2c31e7", "value": 5582180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776098823, "uuid": "02d4825e-d2a8-4f43-a5d5-635391a7282d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098823, "uuid": "acbe4450-ed38-45fa-a141-cb7ed06fcb10", "value": "SecuriteInfo.com.MalwareX-gen.99815525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660083af-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776085508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085508, "uuid": "31e07c49-1ddb-4230-9728-1728c37a841b", "comment": "Malware payload (RemcosRAT)", "value": "237f4597b3b0dc5917a117f0f8db79c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085508, "uuid": "8337f201-ee26-42a9-90ac-9d737b616f61", "comment": "Malware payload (RemcosRAT)", "value": "2ca8575a0980f59b14a4584040ecc7e782c39f03bc0aab98a2dbff47d3248ec7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085508, "uuid": "97223be3-7127-48e3-8685-09a8a961e31e", "comment": "Malware payload (RemcosRAT)", "value": "0a462cf9ec2996b8115d46a97ee41937ebd3e899", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085508, "uuid": "76949e59-1770-427f-ba90-6e3d91c5f5a8", "comment": "Malware payload (RemcosRAT)", "value": "6fe540811bcbdfaf7e5af7161541c0a7d42d936b2911433b344be9cf6ec0390c16e11b400835863f26ce969c94cfc750", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085508, "uuid": "5d682a75-347e-4c71-9a6f-05ecf0799bf3", "value": "T1C686B518E26DA03835C6E3CDD036B6708C4D94479BCDDB99342FD2687A89F239391AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085508, "uuid": "3668144a-e006-4467-b9f3-52711fe949be", "value": "98304:tt7OEN8s/tNySnLxlYt0d6XwqcXhBwVX4Tmpx1pf+7/sKCK3acwXO6LANW:ttq+H/t4bm65cXEVE4pfawb/UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085508, "uuid": "0d2569da-f101-495f-87e9-350a8d5bcd88", "value": 8532594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085508, "uuid": "dd5b178e-4030-4b4a-8110-0279e598358b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085508, "uuid": "aa907055-02fa-4095-83b6-28a8d249955a", "value": "Stopanska Banka_\u043a\u043e\u043f\u0438\u0458\u0430 \u0437\u0430 \u043f\u043b\u0430\u045c\u0430\u045a\u0435.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818299fe-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043464, "uuid": "f8c5c2c8-7bdd-4036-a131-3abecde0f8cd", "comment": "Malware payload (Mirai)", "value": "9bf248bfb20859ffc82d5a18442e570d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043464, "uuid": "2447ab33-554e-4de5-ba62-6fbdc4c11001", "comment": "Malware payload (Mirai)", "value": "2d466ff53ca751883540c44ac05cf9e01344a96fa7c9f7314d0ebf65d4d7419f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043464, "uuid": "be97e039-a2d7-4d95-b982-37a23db940a2", "comment": "Malware payload (Mirai)", "value": "c6399987bf53c7f375078f8a0a361e64deb3625d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043464, "uuid": "bb15d1cf-62bb-4d27-8419-61a1101bd721", "comment": "Malware payload (Mirai)", "value": "35d139b080a57829c843e2a85f338610ee814e0e23987dbef108974bf119a1afc28f12b7a5cb163c9be2aec2cb056535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043464, "uuid": "6b0ae864-82a7-4136-8e62-501e22b751ca", "value": "T12BA31996BD418B12C4C225BAFE5F454D33135BFCD3EB31128E25AFA0678A4E70A3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043464, "uuid": "ce795891-ed48-4332-89f3-ba3ca1347c0f", "value": "1536:ZZna/tPnGkGRI3lvTnLfjbgFJCz9z8VmVRH+9YxM/NW67ZTDuuTq8dlNC8WG4Xrd:KFY6XKLT3QZycaM9UJnnRggkLo8Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043464, "uuid": "e78369b9-fc7a-4540-81af-0b9500ec45f9", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043464, "uuid": "37ad9661-4330-4a72-8432-f6f4cdb02fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043464, "uuid": "6f9f5c00-d70e-40ae-b835-30f7d70c549c", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782a6f19-3767-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776105296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105296, "uuid": "5860dbdd-b2cc-4680-b422-b8692097c0fd", "comment": "Malware payload (GuLoader)", "value": "e8160d86202a1bb8754717d43f281884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105296, "uuid": "23ac1c8e-b3dd-4117-ba86-72cb0a36b301", "comment": "Malware payload (GuLoader)", "value": "2ecb64da9769bc86b4e6d4f0f878baa991b9eb0aedf616d41bdcb20281417162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105296, "uuid": "91ea639c-de38-465b-a23d-d54a25b41dcd", "comment": "Malware payload (GuLoader)", "value": "3424ad72c184c13321ec9789589f72c75084489a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105296, "uuid": "d299bcdc-0144-46a0-90a5-5eb6a31d9e12", "comment": "Malware payload (GuLoader)", "value": "7502ed8d873dc62e693be9910db12e71db37658f9e3a1f25c264c577169cb6f7bfe3d00eac0ca74ddacb0a2529e2efef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105296, "uuid": "bc7db546-5b2e-4a78-9023-c8e5ca534e19", "value": "T1E5469016ED6804A9C582A37A88335153BE38B400572123D77AD963AC2F637F4D37AF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105296, "uuid": "8179871d-abbf-486f-b36b-9142dbef6f04", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105296, "uuid": "e607ce02-9ea5-40ce-bc4b-743beba602a4", "value": "49152:8Rsl3W20TmbdG2RXPqhyv0uB9KfPr+HjaLe3QclugNVcr3hfcEzelQLbL+LncdgT:8Rom0Jie0rha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105296, "uuid": "8b8581cc-29c1-4a50-a659-0cf2207965cf", "value": 5595650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105296, "uuid": "e57711f0-7f1a-4bba-b057-e627cbd3dcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105296, "uuid": "66e92e38-22e0-4139-ac66-4177333e9b9e", "value": "SecuriteInfo.com.Variant.Midie.178032.19996341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233288a7-375c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100429, "uuid": "7ba312ae-08a7-47ae-846e-4422db53e557", "comment": "Malware payload", "value": "79993d1dc3c12b3624c3a652c1e5c1fb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100429, "uuid": "46333a33-d1ee-4f5f-b448-0bc4b45b0d6b", "comment": "Malware payload", "value": "2f350b5899e556ffdf1d52674dd739c8a683de0114cc120a717c6a1deb58d105", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100429, "uuid": "4fd6450a-a3bb-4dc2-b500-f9b9a0e92674", "comment": "Malware payload", "value": "fb54e89a6bf2a4c0cf570ad02659984a097a2358", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100429, "uuid": "546a0ae2-a607-4bad-9b2a-625358f10bc6", "comment": "Malware payload", "value": "39d5cc36bf2e3628c6d7c54701746846a9685bb16b762cf436beebb1452a17871f754f83c25d5547c2ec2fff4e4f43d5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100429, "uuid": "a6b937ae-b147-480c-b140-7b4f93708f69", "value": "T1B7E022E8AF55FF26C0700436C12AF3300F1AB90A0A40B2E200E0A4D1EC7118A3E36276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100429, "uuid": "ce64ad47-d4d1-4afc-9754-3b73c9675cdc", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWXECFyC6w5fJWXk6HGPebRJ:4xtJCUOblw7BJYXHpQtXEGxlebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100429, "uuid": "e1017d19-0686-46d4-a8d6-63002e04ce33", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100429, "uuid": "64baea41-a039-4cfd-bcd6-89344c95e8d6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100429, "uuid": "e9b3cc32-407b-4679-99a1-6a90872d913e", "value": "form_99893.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41139b0-377d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776114872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114872, "uuid": "cfb04c85-94e2-418a-ab0c-f2de2ef2fda6", "comment": "Malware payload (SalatStealer)", "value": "c215a08a3b32d062c528dd0be46f6cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114872, "uuid": "55a121a8-6106-4c59-9664-dbab7e0ded65", "comment": "Malware payload (SalatStealer)", "value": "3019d91b3e62096ec7c2a68e9fd71c875e6afc3829d6a39d1177df1851af879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114872, "uuid": "eb795b7f-0793-4472-8b8e-9eca27d4ef6e", "comment": "Malware payload (SalatStealer)", "value": "13c953dc55969d7d2aef5962b4b45f26404b47cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114872, "uuid": "d1291988-5a0a-41ad-a06e-744c289c7c65", "comment": "Malware payload (SalatStealer)", "value": "d37b9dca50260ee3e2c7f11f25142ae60ac3a35c440e2a75af6a4829028d66080b9a10436df5474043a204afc8a9b53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114872, "uuid": "cde4d0d2-34e7-4c8a-a209-e2ff934eb523", "value": "T12CC65A11FADB95F5E9035831006BB27F23315D048B28CBDBEB547B2AF87B6A11C6A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114872, "uuid": "1ce7f174-04fe-4dd5-948c-be4732e8ca8c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114872, "uuid": "2be2d424-5f7c-4860-b5e8-825b72e1717b", "value": "49152:So5/R6s2wFGFDXVaPsmSrZJ6DqS56WSCiodGmeoxclqT+R5TayCENAqQwjMunTXr:t/gsAVa03rK2DOxrENL4JuOEgdMEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114872, "uuid": "d9e9e0c2-b0c1-4e98-a7da-affdf07cc6b6", "value": 12575232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114872, "uuid": "11040e17-4d52-43f5-a035-10cd794ecc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114872, "uuid": "51a701fd-559c-437d-8c3c-f72cf633536b", "value": "ButterFly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46019f4d-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085455, "uuid": "7f58d694-8a38-43c5-a889-f16cdc82390b", "comment": "Malware payload", "value": "e2004cd464cb038be889c2ee5e95d7c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085455, "uuid": "fb3aa7eb-0292-4bf2-9996-ef48281cbdd0", "comment": "Malware payload", "value": "30b8fea1e21da63ddb5eab512378673362bf5dc96212cfe9ffda6ea337b1527e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085455, "uuid": "a9d74239-daab-4c03-a0cc-67d8f6621307", "comment": "Malware payload", "value": "b1ad72ebe818589a63b5981435772d30a0b9b6df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085455, "uuid": "78d79752-aedd-44d3-bb61-e0a98f8850a1", "comment": "Malware payload", "value": "006a270fabef438584bc113f810571f4f5109a1b6c40afb67678098231d8104d89785910208196d22b68500c93a82f64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085455, "uuid": "c29de902-1345-4bdd-80eb-9e695644f534", "value": "T143727EE0A4DA584E2F72E08FD78E8237C4AF30069748E9C0F15C470556A757B6AA376F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085455, "uuid": "28e0950b-9ee0-4eb5-8a91-42ba5c0c6d86", "value": "48:35wHMw77ucg+b2nSSWaLBbA7dTgL2fybvLfAW2KgY4bvKQSmA9Ul+xSnr+3fJckv:35w73JhEVJo6Nv+AT/NASOG8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085455, "uuid": "9d834cee-0ae9-4fd7-affc-ee5fc0763df2", "value": 17465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085455, "uuid": "ecc776c2-3686-45b1-a6e6-3133809be586", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085455, "uuid": "d6d7e85c-866d-4b1c-9bd9-b08d7ba487f3", "value": "AG-0413026-001_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac7a881-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046889, "uuid": "61d081bd-897a-4c67-be66-47675765c7e9", "comment": "Malware payload (Mirai)", "value": "515abfe698b070a4c055b2d10acd4198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046889, "uuid": "d2c84de4-bb05-40ce-944e-94871de292da", "comment": "Malware payload (Mirai)", "value": "30e92bcca4a51ceb45d55b4c25a253dee7b0f68055d6656a2a0c7e006ccbf4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046889, "uuid": "39263bee-19c3-48f3-a485-5c88f9f2cd5c", "comment": "Malware payload (Mirai)", "value": "bc5f763ce441595f19657c6c1cea280afe8ca0cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046889, "uuid": "6629e0f9-1b4c-4a2c-9cd2-10f20837178c", "comment": "Malware payload (Mirai)", "value": "5f3301a1ea5a5ee8ededabb2f86ef31206cef1c0a193d26f4b3ccc123b9d85d6a243abb99afe899a588ef79aa95d435d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046889, "uuid": "11df2573-262e-493c-be2b-78488d9e4f24", "value": "T175932A4377080F47D2A32EF03A7B2BE45799FE9124F1D584A91ABEC643309B26542FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046889, "uuid": "2554682b-0faf-4687-bf76-fcf0263579ca", "value": "1536:/Zmj+vpRM/MREhzetAzIoQjvlxMplumiTjHQHu1oG3E7PaUVbZXehqYRi4:+apqakgzzmHWoQ4jHeJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046889, "uuid": "61d7131d-4d3c-4f64-a66b-df4fdd669910", "value": 94696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046889, "uuid": "db8ed51f-9314-46b7-a409-467850347c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046889, "uuid": "af25fc62-74dc-4691-b9c4-3944a7f18989", "value": "SecuriteInfo.com.Linux.Mirai.10456.14241.19788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30b7938-36f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776057828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776057828, "uuid": "54214c5e-7594-40cd-bdcf-334aad0c2039", "comment": "Malware payload (Mirai)", "value": "bcebedaf30c2dd4dc041b450e8c76973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776057828, "uuid": "9664cb1a-0968-4c62-826a-c71d52952074", "comment": "Malware payload (Mirai)", "value": "3132a9b85061961036c69db8e0d6a0fa406d2fb23d8e6ec3882ba70f847e9b7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776057828, "uuid": "44afdc59-9d53-4306-8441-ef13236ae61a", "comment": "Malware payload (Mirai)", "value": "ec659da0dacf85bd6e7e0e8f56ae61bbddf43e77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776057828, "uuid": "63e880b2-c747-4cfd-9eb8-eb9137951766", "comment": "Malware payload (Mirai)", "value": "2b79e6e1c098942e7d260b5c68688001e4a82b749fa41c7c5d104bf1e8701265f029fa623434f96ffeb4f0e817523208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776057828, "uuid": "f04e4464-0951-4186-8e7f-a907457a303e", "value": "T181B30945F8505B17C6C252BBFB4E438D7B2A1768D3FE720399256F20379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776057828, "uuid": "b710fdc6-e533-4dab-8d75-fb68aab000f7", "value": "1536:WQtUqnn8Pd0z4VJtKT13v/vy6OZ5OZpqrcElOgwywXvqTVFnXYPqmp3j85vR:t/nnxz4JKh3PPnkzmpwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776057828, "uuid": "607c9a42-b9d7-4762-b671-2d7bd6912486", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776057828, "uuid": "d8f08dd5-5513-4c25-9f48-aa7e9971a8fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776057828, "uuid": "9a7d0819-2436-4e1c-98a0-1c314dcce010", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3ce7cc-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776060075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060075, "uuid": "cc1bc561-524a-4ed7-afa2-dbd26acb84c8", "comment": "Malware payload (ValleyRAT)", "value": "91671a8b64e5b944a83af82ee6e58a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060075, "uuid": "f40ad075-ce12-42db-8e04-d99c2832fe9a", "comment": "Malware payload (ValleyRAT)", "value": "319003deff1bed6114aba4f16891f603976834d0b9fbba04df15c514c57ecd86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060075, "uuid": "820cfee3-8d5b-4edb-9439-b76ecf8d9802", "comment": "Malware payload (ValleyRAT)", "value": "27232d5c22b004eccb1c9c4c3fb68c267cb2fc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060075, "uuid": "2b2af747-4b0c-414d-9d99-776d00ccfd1b", "comment": "Malware payload (ValleyRAT)", "value": "98b1e934b0df0f71f5d28aadec5b3472afa78dd4df221e9b48f84e0772ee9bc4d5f1df2f430f365ae1b1d9982ab354a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060075, "uuid": "b31eee3c-d667-4384-9b55-d6f71461389d", "value": "T1A246E102A281C1EDF2A6E6748A0681F1C7767C017771F9DF06E1B6172E3F9E34A79A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060075, "uuid": "56b11984-dc5b-4fa8-9669-12e10db45b30", "value": "76a65fc1eb986e164e489afaddce12fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060075, "uuid": "e56e23ad-75cd-4131-b285-7b96b7a944ac", "value": "98304:W2C4SaKQ6RiIqvT6UvPzUc0loFE1W+X2xaQVSYM05NB+nGFXJqEFSKTKK4KKDyKR:Wf4yQDJTdvPzUc6oiW+X2xaS5NB+WtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060075, "uuid": "3133c810-6a2f-4b76-8746-d9445d147e7d", "value": 5429248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060075, "uuid": "79ebccc9-9d34-464d-89fb-949c8ddb9f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060075, "uuid": "0e6d2fb6-8b84-45ce-b5e3-0e5ef790973b", "value": "319003deff1bed6114aba4f16891f603976834d0b9fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18022fc-375c-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776100641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100641, "uuid": "3297cf97-2c77-4c54-9ee4-17ae86fd8551", "comment": "Malware payload (CoinMiner)", "value": "68b2604f6193694bbb7fab6c3ad0b46d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100641, "uuid": "65bd4126-28bd-4a37-b0fd-541c0aa0951c", "comment": "Malware payload (CoinMiner)", "value": "32cddec84197367a6363d2c6cdbb448cc22b8497e88178c748213ee7469f0681", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100641, "uuid": "c178dfaf-4633-4423-9521-f3d52b9b0c2c", "comment": "Malware payload (CoinMiner)", "value": "87fe7150955f016e2ec41fbd9897b6f9b0cf453a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100641, "uuid": "2315d19c-9c4a-4f0c-a3ad-d9d64c06b25a", "comment": "Malware payload (CoinMiner)", "value": "c670aca6c9ddb8b508ad366d329b102e6b33658161021043a403cfbdb477e843a3fe97271e22d5782d9774943b85348e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100641, "uuid": "ba7e9da6-0d33-45e3-ae86-df2465516b6c", "value": "T1BE222A1E7E4A4130D39449B013F54A4D467D56332796B3EFF373D5C90BA93888852AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100641, "uuid": "d4ca856e-f694-4487-ab92-1e4828ed0f5f", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100641, "uuid": "44f71be9-027b-47b2-a129-84c989268eaf", "value": "96:8EodPoZR5Yz/J4hgkxZZB2dyc0CDL1x+ZQNgT/hPFJxGE9mZ2FFhxC7tCEW6zF:zgoZMfkHZBkx+eNcPFJxTEZmFhSW6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100641, "uuid": "b5dfd86e-56f9-4ed7-a784-f95dc2ef5a6b", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100641, "uuid": "6b7990a2-eb74-4091-9dab-99f282b8d64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100641, "uuid": "3b771d31-cabc-40fe-acf6-9246b3d7f991", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d19074d-3737-11f1-a769-42010a9c0008", "comment": "Malware payload (ClipBanker)", "timestamp": 1776084715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084715, "uuid": "e744b971-2fc7-4e8c-b284-551efc31fb61", "comment": "Malware payload (ClipBanker)", "value": "4c900075beb09cffe5dacd6abcfcc62b", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084715, "uuid": "8dcec3b6-778b-411f-85e2-62d88f6c5d58", "comment": "Malware payload (ClipBanker)", "value": "351f8344a4781ad55196f66fcac7703d39b0f772c6a73dc38fdf4ada903dfde6", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084715, "uuid": "a2bd8256-f75e-4e88-84ca-35be1a57e5f5", "comment": "Malware payload (ClipBanker)", "value": "e98e58aaf52fd5c0290a59dbce3ba6286637b083", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084715, "uuid": "114ce5cd-afe6-4bd9-bc08-3eb3a9337747", "comment": "Malware payload (ClipBanker)", "value": "3665cecb212916becdf0418e57ae3f26a46165a6d984b339c38049c9f1d1e7d0f19d1d7d398b89c770f784bda95b29a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084715, "uuid": "7f035906-f4f5-41af-ad3d-0dd85d2996a2", "value": "T129545D4A776040F4D8679139C9A78A46E7B2B8550771A3CF13A443BD5F2B7E09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084715, "uuid": "5baf614f-bae7-42f5-8d87-d4b4e7f43a93", "value": "7c7c51c33ee21dccb68077e47572762c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084715, "uuid": "88822b1e-4eae-4022-a7c0-8b003a9fefba", "value": "6144:XXhHTJd/s30SoYIpAob4WDHRY4T5H2vQ8hb0YYpG1e+95gzenrz:HpSIiWDZ8dzk+5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084715, "uuid": "3c4d161e-3a46-40ac-a9a2-b139ebe6ce7c", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084715, "uuid": "bd86c768-af87-491c-a438-3fdf1a4b2c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084715, "uuid": "60b8e630-557e-4ba8-99f4-287f28c43682", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58969b9-376e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776108513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108513, "uuid": "e3f47c12-24de-4e8c-8551-d12379fbef4e", "comment": "Malware payload (NetSupport)", "value": "b1474b10c9169f7a494210e2f889cba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108513, "uuid": "a88a48c7-d0e8-4bd4-9942-f163c7d9fc25", "comment": "Malware payload (NetSupport)", "value": "35bffefae9ea98e5230f833b75f3cd03b153c75aff4e2de85f128eb4c46f2d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108513, "uuid": "bad934a4-3c9b-4e6c-bba7-aa1adf3c3b81", "comment": "Malware payload (NetSupport)", "value": "6c46f77e478395b84b520459e487614272e4ec7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108513, "uuid": "0580e600-8f4b-4d59-b359-4f3c502f763e", "comment": "Malware payload (NetSupport)", "value": "6186ff4ab4d8d3a72bcee3a8b3219f02b5cc5446d64e0bed773d1841c8d3f52d682fc8069b924635c21f5f7109a2274b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108513, "uuid": "fdfaef2d-2446-4c98-ab6c-61973a60118d", "value": "T10D469F16EDA80899C582A37B883351537E38F800571123E76AD9636D2F637F4937AF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108513, "uuid": "aa216d9d-7b97-4880-b7c5-9c8eaf2b6bce", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108513, "uuid": "508051bc-64b4-4d67-a93c-d673a0168b17", "value": "49152:Pky6yQiYOMZoa+KsF+bEcEjD2zsBUwDjJ9cl10hMT+E+RIgiHxZrzLrfbq6Rj8ma:Pk1XZhDrkS4BFDhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776108513, "uuid": "5d79e668-4928-4c48-bd26-5430712460bf", "value": 5557722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776108513, "uuid": "2ae7710a-c600-4b59-8187-48064a4a2449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108513, "uuid": "bd94f013-d2a0-4b04-b7fc-d2f5a8804f26", "value": "SecuriteInfo.com.Variant.Midie.178032.24380.5186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d95b01f-3702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061845, "uuid": "c22c37db-8522-410a-b0b4-6bdd627cc2b7", "comment": "Malware payload", "value": "4673c75fbae5b05b85a5cf0ef93c6447", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061845, "uuid": "73a45a6a-18ec-468c-bc3e-8a4599022cf7", "comment": "Malware payload", "value": "36a4f484969a4e9037ba398e6349164643cd58cea5568534dcbb0af2c32014c5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061845, "uuid": "dab44364-a778-4025-abf0-70f337c50320", "comment": "Malware payload", "value": "98e7898509be64bb7a1fe75f179591866829f19b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061845, "uuid": "707ddf77-8a59-40ea-90dc-3aec4e6d1d31", "comment": "Malware payload", "value": "ee598b1c8fb5990214bc02ba9670d3c993556684110dbfc477e6fd9c822efe1783ab6d0f698bf300d1bc5d91ea5b2df5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061845, "uuid": "3383bd47-e342-40a3-95b8-9f2d7cb497d6", "value": "T126936D3B996A3C76EB507C51FCA1BC095211E4F656AFC7080576C730BAAD2CA1F0EAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061845, "uuid": "1f42cc96-4bae-4c00-bc3c-a9661de6237c", "value": "1536:10lI3JeMsjVqMOOOOOOOOO6bbbbbbbbbbbbbbbbRaaaaaaaaaaaaaaaaaaaaaaa5:ilIZepLOOOOOOOOOKaaaaaaaaaaaaaaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061845, "uuid": "2bc6cc15-b16e-4ce9-a2f4-fdb353db441f", "value": 96439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061845, "uuid": "9d2e448b-8aed-4ebc-9624-993f6f75a6f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061845, "uuid": "15eb3563-f79e-411e-9e79-40364bfa2676", "value": "Scan_3_12_5_1759_10.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2715af5f-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776085832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085832, "uuid": "4fc8c518-8d8d-4d11-b8ed-5b5aa6d475f5", "comment": "Malware payload (RemcosRAT)", "value": "1980472aa1558b7d4042ebeee4812324", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085832, "uuid": "abf529fc-9a6d-45e6-bcf2-5c8074e75621", "comment": "Malware payload (RemcosRAT)", "value": "36efbc313122f82b029788f5c0055eb59aef2be2682078257ac27d572cefcfb7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085832, "uuid": "728a06ff-5935-4b30-acfa-7697664d4928", "comment": "Malware payload (RemcosRAT)", "value": "a3eb2029571e9f123659ee51427f93e79b25fb6e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085832, "uuid": "73837c2c-09dc-43a9-8ebd-4bb8a7a03541", "comment": "Malware payload (RemcosRAT)", "value": "d188d815ace9b7c4b02daa443c5402d999ddfde597808b892ef7c35a1b23c7a235d954bdf5a31500042d48b12ab64538", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085832, "uuid": "e69211db-e9e2-427c-9da9-3b837f25aa0d", "value": "T15582C926CE05EFF006B97161BAAB6C1A69500367B534394D7C8FC5AD3F39610CBD14EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085832, "uuid": "ca2e1825-920d-43f3-b5fc-6c39f93291ff", "value": "384:KYTTDSJ2b5F5MG6gnf657Ep1Pr1PBhN6qSQR3j4cc1Gd3sc66rc:KYDK2bzbJjOOkBc66g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085832, "uuid": "3d9cd2d8-8eaa-4827-b42a-28a7e78d069e", "value": 17633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085832, "uuid": "4d86f7e3-bb99-4b15-8e52-dcb4460260b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085832, "uuid": "b9062e63-6da0-4768-b53c-73bd3aa42b66", "value": "ORDER_SPECIFICATION 293_204126.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84f428c-3776-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776111846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776111846, "uuid": "1e93f5fe-5be7-48f2-be82-5d220daa7707", "comment": "Malware payload", "value": "20d9e0b000baacd7efe3634815f32f7b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776111846, "uuid": "5116fd81-4012-489e-ad80-3f7fb22cbab3", "comment": "Malware payload", "value": "374ebe1b250f97b73f841725b1d9038c78396d9e0c27a237e7d8a73dea33ce63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776111846, "uuid": "59bb4b46-3edf-4c0a-ba6d-88098b29a521", "comment": "Malware payload", "value": "0f95e97ee96cb0f09e43932b116491074f7d1320", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776111846, "uuid": "29fdf460-9dbe-49aa-b2ac-a931872b2ed1", "comment": "Malware payload", "value": "7468fe624553299351f18d4e0973c3c11283e7e0d88da231d95ad5268c6cef93ae2dd9f4076225a8167c15302c9627ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776111846, "uuid": "9f1eab12-c196-4230-8b44-17e9eb6b4163", "value": "T1E0C164D4FDB8F831BC7EA738A18890887AFABB5E42333C0479565B9A135D548310B936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776111846, "uuid": "9f38b4f3-5b19-487d-8346-517d1c7525b4", "value": "96:clNR1tlZjRqIEvwMCySUq9npY0R5BGIkRtdLRQHJ5YBDjavLfhtR6xgcre:cl5dfQSUq9npY0R5BGBsPmqZci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776111846, "uuid": "295c3b97-3bac-4926-91bb-6d748c110f86", "value": 5751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776111846, "uuid": "b6a9b345-a981-45c5-8123-8784810e3089", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776111846, "uuid": "b27d799a-8775-47b2-9975-db015c05a791", "value": "dkb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d231181-3746-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776091158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091158, "uuid": "3950d492-9128-41d7-a9b8-c2dfce5c27b8", "comment": "Malware payload", "value": "7f4c1820091b1c8444c1259de7081d77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091158, "uuid": "8989385e-9de6-4aff-aee7-e17b9cb80995", "comment": "Malware payload", "value": "37bdcdb26c04c38ee4c123fd986dc0f8c0449fc8456fe25dd7f4fd9d0a1c8d7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091158, "uuid": "6845d1b0-8405-4a18-b65c-0699899c03e9", "comment": "Malware payload", "value": "4c5e02f2be8d2f4a4841c0ea0f44fa629e92c3b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091158, "uuid": "32c8f516-7bca-439b-a585-10b75ba0e5c2", "comment": "Malware payload", "value": "57a4a1100067df8de312618264f880e96c5029dc19ed592790f86c85e067975a813d6a744fc8b9942a1fefff83a43e4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091158, "uuid": "6643ac15-e412-4499-aa50-960074b31eb6", "value": "T1C3F58D09EC791E70DECA96326C8D00D1FFB221554A26C1A6B836D099F74379ACB7FB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091158, "uuid": "b7610ae9-a5be-435c-a7ff-941c8ed9f296", "value": "98304:89Zbi+TP2iK99qbCbG1npsTnm3YU9KV3vC+l6Wk5XAe0:4oI2iOAbCcnGTnm3Ysc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776091158, "uuid": "59c32fef-abd1-4b94-96f9-b98fbbe48c63", "value": 3631648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776091158, "uuid": "4f8386f4-6977-4b2c-839a-0b530f2bb28e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091158, "uuid": "8a90f36d-5c65-421b-bec4-a6f499a45a00", "value": "libearnify_sdk_arm64.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f17245-370a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776065540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065540, "uuid": "c8195e4d-6849-40ef-b7b0-6abeadecd220", "comment": "Malware payload (NetSupport)", "value": "fb7f60287b361a23b940ec2e462f1dc0", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065540, "uuid": "69bf93e7-d0a8-433a-a520-1a4b07fc32f2", "comment": "Malware payload (NetSupport)", "value": "37ecba11ef26fa26824dc44882674c55bfa7daface3fe075ca99353223d08387", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065540, "uuid": "fbdf9183-2b18-4172-af00-2fb7a3fbb729", "comment": "Malware payload (NetSupport)", "value": "38137bbc2d506c72450c890db0551244cc0d565d", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065540, "uuid": "c5473783-2cc8-4460-95b4-09698426b4ca", "comment": "Malware payload (NetSupport)", "value": "6740abbefcc1bca0c82fc81f41e52cddcc7c90b6b482df8e1317d8f107a7e02869df012d1f3618972ac71c6d6b9a4656", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065540, "uuid": "a8444056-4bce-4b27-ada3-2630bffb6910", "value": "T1D6A2E06392B4800EEF47CFFA931561C4D184457AD9B4C2F906B79FA92A960DCBC18B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065540, "uuid": "8aaaad85-8e1b-45c2-8b28-ec311cec9abd", "value": "384:gXPUdt0/EdxVq8rJATJfN9nAfM1k3UBDF2FhzIrehJWoxpqHo+cOM/XV:gXP8W/Ejr+VsmBp2T06hJzxxHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065540, "uuid": "e588e871-c3ed-45d6-accb-7a56a2f88e01", "value": 22112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065540, "uuid": "dc44f20b-ea2a-4faf-b299-4d1d6a6eaf0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065540, "uuid": "93bc7795-c0dc-4a94-9d40-a351fed984b6", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5b16e8-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776086133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086133, "uuid": "709af930-d04a-4761-ab76-786e61dc11f0", "comment": "Malware payload", "value": "cbe68b2ab15cb396a26f62e05b6c9778", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086133, "uuid": "db7186bf-48fd-4a77-bace-a74608847598", "comment": "Malware payload", "value": "3909824f548be8b186a060b2c6d37384470426ba17e63b92ccca1198b16424ba", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086133, "uuid": "0013dc5e-6364-4d20-8a77-1f833ed63680", "comment": "Malware payload", "value": "5f153ebf648e324211a10b474bdb687e1514a376", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086133, "uuid": "c1d51a9a-40b2-4888-8100-0cace6d055d0", "comment": "Malware payload", "value": "54e2a6851ac095dd13405916c6b4816fd9ff1b2eb93e4fe14b3dc005391311eb8e48a426dc3f4e632d2e096287ba8846", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086133, "uuid": "29ad5af8-bdc0-4037-a7cf-934ebea8862e", "value": "T126218E0543FA6A08F3FBAB702EF5A5404F31B8616D26658D1156428C28B8F68ECF071B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086133, "uuid": "50a8aeb5-ab4e-4974-b018-d16317d8eb4a", "value": "24:8+h6cg/NUF9AG1EdVe2ywsD6smHthVX84mN:83cg/s2OEHq7DdmHJMDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086133, "uuid": "1179d80e-ffc7-4b10-9a20-2545fd7ba81e", "value": 1298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086133, "uuid": "47fc49a6-e193-4d06-a0a3-20d51b902da4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086133, "uuid": "97eaa39f-cde1-45ca-81df-656da860b754", "value": "RESUME..lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91f8899-3788-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776119578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119578, "uuid": "99c684d3-ff69-498b-a936-02fc089b0d87", "comment": "Malware payload", "value": "cdeff4ae789f7d188d099c0179e7155b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119578, "uuid": "2d0797e1-1dff-4ebf-bb91-6bcbd122aae3", "comment": "Malware payload", "value": "39dbe2619b507122e29398f97dad678d470e170aec87e46d9ba5efe69fd1144e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119578, "uuid": "35c5206b-f5e5-47a4-a24c-7d6c9606972e", "comment": "Malware payload", "value": "4bf32c06ce35eb94530c2e2c503be1b8be3443f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119578, "uuid": "3778ac61-c52d-4473-9349-c858aa510020", "comment": "Malware payload", "value": "347c73b7ae5db25196fe03a9983ce8729dba285169aeb9a25a12a04265bdcbdfc82015f2ca1d06858afce198486c2d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119578, "uuid": "d95acf05-3838-42c7-b74c-9add383aa691", "value": "T16D647C16F6B615FDD577C5788953440AEBF23C4643A09ADF27D08AB21F27AA08E3D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119578, "uuid": "2d38ee91-8907-4f77-bf1f-1c118eef4e04", "value": "00d4c98e3620a585bb2edffad43e0e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119578, "uuid": "657d5e57-7064-48ea-b973-21fd7c08ee64", "value": "6144:hGsmMnCWNQ3gwNg5ryzJgpmhhvhMgs67FNa5:hwXRu5ez7HvhMgs67v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776119578, "uuid": "73ddcbb9-e7c8-485f-8e4e-bec13731b40c", "value": 334552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776119578, "uuid": "06ca527e-46ff-49e2-b0f3-91627c359025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119578, "uuid": "bafe5410-9e9a-4149-897a-3d076a0799df", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a915b367-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084762, "uuid": "9edb5ecc-7b56-414b-8b2c-96efeb5bae8f", "comment": "Malware payload", "value": "7ae5e6a53b8e6999fe80f7ae075a01eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084762, "uuid": "feb12c12-3ec9-47f7-877e-a94a2097b0ea", "comment": "Malware payload", "value": "3b501f1509aa68a8c9780fa70c99feea17293a45c8a757b3ce4b8f664cc7652a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084762, "uuid": "d3d997c4-cd43-473c-8b12-0124cbb46f23", "comment": "Malware payload", "value": "1651633b967dcae54a28a7005a449ccf6a9014b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084762, "uuid": "e2ed0ad1-0256-4c4e-b45f-019aa6cb1c61", "comment": "Malware payload", "value": "f10755e7844b1d6fb87703ae6e789d4a16e2b3420256f5889f45774a3d9d41584c06154c8bf39171932ef24c75b459b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084762, "uuid": "407a5e2a-19ef-44db-a617-4469b60b591f", "value": "T10485318AF603ED4BE3C5E8348825DA76526637BE97F348B9BC5CB5D8F21A5533014E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084762, "uuid": "194b8901-2249-404a-be5e-42c13a50c9f8", "value": "3913a61afc7b8099cddac314b48d90cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084762, "uuid": "ac24184c-b2c0-404e-bb65-46bd743580d5", "value": "12288:9/LzDFuNup2G3xm3/CmiiiUY3YQqLWQc0qpb0qD0xc:4uVxWiiiUY3YJLnq2qDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084762, "uuid": "507e2e47-8a1e-407b-b4c6-b241a9c643d6", "value": 1857024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084762, "uuid": "89f6d4de-b09b-492a-b881-16c06e26850b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084762, "uuid": "370d749e-5dda-4135-a677-05c897a087cc", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04a8d1c-374f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776095055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776095055, "uuid": "c0921060-d5b4-47a4-bd2a-84b20218b597", "comment": "Malware payload (NetSupport)", "value": "6cbfa1f5575aa0ce491a97bdf3123758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776095055, "uuid": "13f580a1-c24a-4854-92f0-a3d07326bd65", "comment": "Malware payload (NetSupport)", "value": "3ccdd76e9c0ee814fc0461111b5c7cc7e7c7f8cd69d9eb16ee669078e5b9f5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776095055, "uuid": "1d7ea191-cb8b-4d1e-b2e7-949ca59e1186", "comment": "Malware payload (NetSupport)", "value": "bc436187a4d22c31046262d95d6316662c8f1051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776095055, "uuid": "e5e757cc-84dc-4852-a7af-23821f6b279e", "comment": "Malware payload (NetSupport)", "value": "60e9e9988cd4db22a08e9c5ccf950b4f8d3e791a598eb8e9211896c511d048c2c7bc9c5f098175dbdce7d8db0b53c07f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776095055, "uuid": "9a7bb8c1-4c62-4680-906f-780c3f89549b", "value": "T1BE468F16ED6808AEC496A37A883351537D38B800472123D76EDA636C1F677F4D37AF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776095055, "uuid": "e9ec1b0b-7dec-4934-bf54-8df781d096b8", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776095055, "uuid": "4f2018d5-c31c-469d-a75e-d2c4f45a2b88", "value": "49152:E4BsC8AEmlTZf6bUk8BIQyUjQgQcgMNUmOMjKFATVDZvidg99H4CMndwHnTOX4+j:EFszqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776095055, "uuid": "73edc2c3-b717-42df-af52-d054da0b2697", "value": 5688240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776095055, "uuid": "1abcd40b-2ae9-4302-9c5e-0cb514d28812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776095055, "uuid": "2deeb31a-4f70-4a27-a1a5-bb7c48055132", "value": "SecuriteInfo.com.Variant.Midie.178032.68329744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b7e583-3706-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776063473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063473, "uuid": "1c17d13d-c5b7-498c-beee-19f035e2fa31", "comment": "Malware payload", "value": "29e7382ffdcc3b3c76c29a69f820bca2", "object_relation": "md5", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063473, "uuid": "64ecddd2-9b73-42bc-b5b4-951e05db5eb4", "comment": "Malware payload", "value": "3d0fa79eb21b7a4e765cffbfaeee373cba12292941bef8f117dc17d2297ad76d", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063473, "uuid": "9b8b899d-c613-40d2-8e4e-7ca9d1d395a5", "comment": "Malware payload", "value": "0104230e0d498f66c58a60bc9ad5db65957d056e", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063473, "uuid": "298aeac9-7367-494e-b610-db96191ac099", "comment": "Malware payload", "value": "fe82e2fcd9f37be816b02b5ffefe8c8a66bbd348c3e2af89ffd974df9d8761538decfe95fc83924e4c1ee6ced629a245", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063473, "uuid": "caa12380-ac25-4a4b-9fe3-628d3fd98f81", "value": "T108416B368D04661A9B6340FF2810E950B8DB553B93CDBDC9B68C5468BFD533DC9624B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063473, "uuid": "c2350906-65d2-4883-9c3c-0482d8ece209", "value": "24:qtUUV5GEwrHw+HT1//0fj/A0+dXcO1hNwB7QRmvOazTn2hDOaj8aFdXclGle8Olt:0GEyR/0DA0gSko/zjQOY8CE8Ri5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776063473, "uuid": "9ceb201d-1c4b-4ddf-a573-74e292e2c98b", "value": 2118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776063473, "uuid": "6cea5db2-20ed-4577-8d5f-0048a4ca045f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063473, "uuid": "06a9ebff-3987-4c7d-8f4d-0935ab854cb3", "value": "3d0fa79eb21b7a4e765cffbfaeee373cba12292941bef8f117dc17d2297ad76d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55dc326-378a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776120431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120431, "uuid": "7f33ae93-1ea5-4b44-8e67-235539f89dcc", "comment": "Malware payload", "value": "8fa8eed4bbb5eb3aae0d4aa2ae59a69f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120431, "uuid": "547891b4-ccee-41ad-9c29-83f8e9b80df1", "comment": "Malware payload", "value": "3de142ddd80f04d60b3c00fbc71860eb3c0f67d593d9eca54226c2b833a0b039", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120431, "uuid": "7b1f16f3-54b1-4eb8-975b-95c1755cf14a", "comment": "Malware payload", "value": "9b60afd894636948713ce5c2a26f4f5db6250580", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120431, "uuid": "1a82dab0-f992-442c-a79d-f602b6fbbe57", "comment": "Malware payload", "value": "ac3bee0afead7974ef6de3a116b11ef5c25b7b9d3d9204503048461ec5f01b9dc0a99d7f44c55d0657ea89a41d8951d5", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120431, "uuid": "7770c434-b50a-44ee-a2ca-d48d2858fef3", "value": "T1D3D30FC94E9A88F89B5F6028462F5C16DE8EE127061DC9D17EDEEF847F119E430BA4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120431, "uuid": "1f63fb3f-d63c-42be-96be-8da126e4162d", "value": "1536:q5xnjCfR8bK7MJMLiiUwZO7iniLoW99MtU4:q5giiUwZO7iniLoW99Mm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776120431, "uuid": "3b7ef60b-f275-4348-9307-a6427068864f", "value": 133876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776120431, "uuid": "1f02f29b-8d06-4380-a8a6-fc98579a73f8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120431, "uuid": "f0291803-7d19-496c-9df5-7779ebde8e2c", "value": "Z_Summary_Holiday_6061.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6c905f-36ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776053896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053896, "uuid": "60382c70-a298-4db4-b57d-14fae2f80941", "comment": "Malware payload", "value": "7ee140a07300ec79bf20b7b6664f8352", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053896, "uuid": "9a8c0aa1-2a78-448c-a8ef-7612e0f9357c", "comment": "Malware payload", "value": "3e1102af12c223b2506b16e37a787977a98a24b31f655e7f7010a8f318e73114", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053896, "uuid": "97de367d-4de5-4dfc-a279-a4ec3503cd62", "comment": "Malware payload", "value": "dd4dc2927b32230a6585d33c4720727b83ea0ac0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053896, "uuid": "3e60ce26-0f47-41cf-a994-4e450269eb51", "comment": "Malware payload", "value": "65bd70b15326bedd333c5a4184ced89524108f53743b75011046d1f67d3820473ee042e04873b7357e7529470a947457", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053896, "uuid": "d23201ed-ad95-468d-a27a-e6337d49aa61", "value": "T18F137D6566953C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053896, "uuid": "da335940-479d-41c0-a462-28a1d499327a", "value": "768:byXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b+lxccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053896, "uuid": "e5aaed0c-d4c1-4ddb-9386-05af12d85943", "value": 45503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053896, "uuid": "b319d89c-0bfe-45d7-bb6d-87753295fbdc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053896, "uuid": "1ace6bac-3926-46d0-b090-8c8d9d8ade47", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c41ec-372c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079763, "uuid": "5202f175-b1e7-49b5-9c9d-2a18426e3d1b", "comment": "Malware payload", "value": "91bfea9380ea1ef7d3cb68240be7be24", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079763, "uuid": "d18a1f90-cdbb-4157-8862-e19d4fa4219c", "comment": "Malware payload", "value": "3f278a6d65ce274a2a3b8c3e700d0d16a874765f144b8c53e6cacd12906bc493", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079763, "uuid": "71ad1705-be1e-4e14-8e04-f4ed2c079dc5", "comment": "Malware payload", "value": "c38f716e67fc6ee890526a3ca9b1261d38fbfdae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079763, "uuid": "1f515e99-44c3-4f52-82c8-f594575f0e77", "comment": "Malware payload", "value": "25149fac4466795951b4ac174bf770c3fb10fece68d7d9a4b8371f9d8be28f1b802f15e005c0e927b0986373c24803c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079763, "uuid": "9fb76f44-1263-4ef5-9f8c-ca58bd679848", "value": "T164137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079763, "uuid": "8809dda2-42b4-4bbf-b53b-6a177fcb3cae", "value": "768:bJXRWNGxVO99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bDlxxcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079763, "uuid": "9318c098-62ef-4c45-afcd-7f763453dc08", "value": 45503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079763, "uuid": "2723c212-2010-45d2-80b4-68475b8ad7b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079763, "uuid": "7a08181c-7b06-4abf-8551-12369cbc5ff8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b9d8ba-377d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776114843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114843, "uuid": "155b9d10-5236-4686-bc93-f58a1c15c71b", "comment": "Malware payload (SalatStealer)", "value": "c3a69ba1ae93abebe969831e515d5b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114843, "uuid": "3fc709ab-aeca-46bf-a304-79f1374f033d", "comment": "Malware payload (SalatStealer)", "value": "3f5bbdb78b0af94f95762ee128ea405cc237786265235f9dcdc5e2a7ebdbf885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114843, "uuid": "d49bd4d4-98dc-417b-80a5-1e8eb90ceef7", "comment": "Malware payload (SalatStealer)", "value": "71547bdaf131c0a05347386aacbf96ccef6eb71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114843, "uuid": "84f449c4-3b8d-4d54-a7b9-2dbc3b2ab688", "comment": "Malware payload (SalatStealer)", "value": "6768888ccd96ef15dda162da9553c2295873c83482d24a3532fef0b43361fbc6892e682501e027f24c63e89e45795f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114843, "uuid": "bb0556af-1bad-4dc3-846f-c00d626cf406", "value": "T1BBF5330FDFBC5960C8B199BA46CB9253836C0B907638C50DF69D16EB0F766630D6A06F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114843, "uuid": "0818d16a-552a-455e-b7be-06362f5a6958", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114843, "uuid": "0db221ec-f7fc-489f-9834-ccb6e3b2be0d", "value": "98304:oEx5rRQd7IMm6pkrRhH80zGTdWl4/WJuvv6M3v4R7V5xo:N5rRQdIH6GrR1DGkmU/M36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114843, "uuid": "bc424e95-9282-43c3-a5e5-0488f3e10b67", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114843, "uuid": "a7c17bcf-e78b-444c-a7ff-8824c1747ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114843, "uuid": "4be09b10-5368-4c82-bffb-e27dec459d9e", "value": "ButterFly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e342e-372b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776079423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079423, "uuid": "a751ecb8-7cd0-4a0a-b7d3-93f2a3919d79", "comment": "Malware payload (Vidar)", "value": "e72417bad19d00d109aa7b8971e6ad55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079423, "uuid": "433a0bd8-04c6-49d0-adfc-fe53f89a4af2", "comment": "Malware payload (Vidar)", "value": "3f5f2b0e6f02dbada42e2746629569dde1feabd62ef1acff714980b22b294e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079423, "uuid": "99128384-4369-411b-ad28-0b5bd0030735", "comment": "Malware payload (Vidar)", "value": "5071fe1285daf14d3d114ce91286bc0ed19c5d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079423, "uuid": "5d4df904-053e-40ae-8039-a481c7376b77", "comment": "Malware payload (Vidar)", "value": "88739753d1ebc59c01a657b2ef0172f79b6eace3ed17c8bbc10b72937e4ea8c19a84754d4167e66ac42dc03149079fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079423, "uuid": "cd582ec9-8fa7-4d59-aeb5-a67a0648ddba", "value": "T13CB59D177CD004B5C0AAA3368AF65196BA71BC4C4B3633D72E90BA743F763D0AA76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079423, "uuid": "c491ba8a-20b8-4815-bccc-8505bc59d6c2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079423, "uuid": "b3cd0640-312b-427b-9980-d68ad76dc578", "value": "24576:pNKe9SvsD2PoXzi0WeW6eswT6hFR9gj7mQomvQSc51FMqGiWPtU40:pNT9STPojiVeW6eswT6hFDCqQAMlT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079423, "uuid": "f2e16bb9-8532-45a8-8506-1425477c5a99", "value": 2341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079423, "uuid": "18b24254-d6dd-4104-97f9-cf15fb366265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079423, "uuid": "ba4c0664-0e0e-4273-a9d4-dc10a07932ba", "value": "3f5f2b0e6f02dbada42e2746629569dde1feabd62ef1acff714980b22b294e72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec29581d-3748-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776092176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092176, "uuid": "d7ff9e01-020f-42a2-8851-bf8080eca7f0", "comment": "Malware payload (RemcosRAT)", "value": "d27f3fb138b1220b15e2532e660045b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092176, "uuid": "c3151ff4-eded-4874-85bf-ba687cf38733", "comment": "Malware payload (RemcosRAT)", "value": "40abc182a584480c59ca25a0a115f441c0c82ccf8e87f195143301027c32000d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092176, "uuid": "24c7db2e-903d-4e68-b0ef-bc8d77183e73", "comment": "Malware payload (RemcosRAT)", "value": "bb233adb5718e0b3644921ad89185fb57d65e19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092176, "uuid": "e372a346-9c0e-49e2-a532-227c5651a4e9", "comment": "Malware payload (RemcosRAT)", "value": "e28092a576e04369235e4f08b89ee900bf87ea6f093f14982f408e29e235ba9c57ecedae793b7ed58f44c78c381d5dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092176, "uuid": "3e14e559-2953-42ac-860d-bcdfe1fe1cb8", "value": "T1EDF4F1897B409BB6C26943364FD78391133DEC606BD1971B7292F39E2F72261A6473C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092176, "uuid": "2f5919be-0535-4bc8-b276-a7513ff47a8a", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092176, "uuid": "fba53ccf-2b9a-4753-8f2b-10095befae0b", "value": "12288:OXyWmdPEZJ7SyplVh6bhND2mDb8AhPuMUryFW8JkygqYNbwixL:OXrmdPud3Vh6bhhbhWMUrr8JkyYWixL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776092176, "uuid": "7a6ee216-0632-4041-95ac-d22bdad9d802", "value": 770448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776092176, "uuid": "5ec3a3b8-5b93-486f-9ec8-98c7d0d94f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092176, "uuid": "0d492c61-5ab2-49a8-8f74-f769d31d1f53", "value": "Skrmfil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecd5c0c-376e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776108179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108179, "uuid": "697dd246-d2ad-4b37-b0a8-bd225a6e1fbe", "comment": "Malware payload", "value": "a7cc61ffbd13ddabe09614950b3b797b", "object_relation": "md5", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108179, "uuid": "2b2d0753-0e64-4ab3-a519-224d626c7a6e", "comment": "Malware payload", "value": "4147788b1da502a44822584fd2807518de229831ba33d086f6fdb35e4792d828", "object_relation": "sha256", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108179, "uuid": "35cbcd45-0fd4-4f64-827b-4fd185f05ade", "comment": "Malware payload", "value": "996885c1dcb2a918b6146d16117f4f35da9b3908", "object_relation": "sha1", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108179, "uuid": "a8dbe423-2e55-4040-af04-f2be4df2b745", "comment": "Malware payload", "value": "405b74d0369bf0ef23765bf538abd0e63bbd70eb3dea8d2f05bac43fc39bf0919bb9b9a4131050e3815ccd9cb7be1f5c", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108179, "uuid": "e70d4365-f78b-4d91-972a-53bf4d1d58e7", "value": "T1AA520888B3C94A36E9BF8779643362355775F80B0552DB0E0CC6486E2D633589F28BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108179, "uuid": "c9d290c4-722c-4665-811d-1bc889994698", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108179, "uuid": "89974723-79db-4f60-ab77-6acfc6814550", "value": "192:Zs7xzgeslapf6S8QvOb1UrDEiCkHBG8ju6pH+7IhwrvqL1slqC2w4:+xzgeslapfz8QG6rDEiCwBC6peEqT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776108179, "uuid": "2f480609-5d7f-42c1-882e-a16708320b24", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776108179, "uuid": "9e63de29-3356-4e56-92bd-3b4e4e97644a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108179, "uuid": "d01f906b-aecb-4747-84fa-d28763548dc4", "value": "a6a9b826.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d666aa-3758-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776098816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098816, "uuid": "ca2c4238-6dbf-41cc-a319-218bb64b6f34", "comment": "Malware payload (Stealc)", "value": "69cd45bf76f04b12e08d5856f0a53d8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098816, "uuid": "c035a8df-81de-42f5-84d2-876f4541448f", "comment": "Malware payload (Stealc)", "value": "432d81eea7e758df49927049f0e059fffd3a9188f94da3e1f0a49efdf7190ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098816, "uuid": "84675143-0c3b-46bd-b4c7-bfb57d21d4e6", "comment": "Malware payload (Stealc)", "value": "927512fd2f2987fca542035009d301ef91c1aa73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098816, "uuid": "507e0fc0-3bed-43e3-8fb3-d78d269c119f", "comment": "Malware payload (Stealc)", "value": "4f33b2f425c3949649c4932f6e25d78c205bdcc1d9cb9a7935f16be4d59d425bc874db6d5085f5e0c161678fa0c656ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098816, "uuid": "e2ec3814-7fe4-4aac-bdf2-ce1e4a35e993", "value": "T1E0860233B289A73EF16E1A3759B6D2508C3B6A11651B4C16DAF84C4CCF2D2602E7F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098816, "uuid": "6de5b4be-7001-4c73-8cf0-c3848ee05613", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098816, "uuid": "e83fbf0f-a6d1-4938-894c-b302e55e9a7a", "value": "98304:nN66et4PxxFDWasVmtn2XwDIreeq6bRdkgguvqP6N1:fLZxF6auEn2Y2eCRnNbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776098816, "uuid": "24e0c75e-685e-4fff-8384-385a39fe2d4c", "value": 8040290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776098816, "uuid": "8ffcbe66-d646-40a0-a054-a1a8ad5bbcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098816, "uuid": "8193f8e8-a0bf-408c-910b-83bd83f26bdf", "value": "SecuriteInfo.com.Win32.Malware-gen.58858636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9042123-3713-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776069434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776069434, "uuid": "e4532fb6-9289-4f96-89b2-b26af66b0835", "comment": "Malware payload", "value": "43883b3b72bfc3d2ee8c12b5961d58cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776069434, "uuid": "90e097b3-5f3b-4204-b5d7-fc7ee313624d", "comment": "Malware payload", "value": "435bceaf240dd7711542a723a6988b280948e77e9953614d981d653680de9f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776069434, "uuid": "5b6ce32e-3557-45d2-80ec-5a3606f72602", "comment": "Malware payload", "value": "05f2500ca75f28c50ab84779d426d61c0a703625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776069434, "uuid": "c215b491-668b-4827-b73e-1a25ff593d17", "comment": "Malware payload", "value": "757c6a7f76f68b3ddc6791b2fce6096738f5ce91cd98110826aedf6754efda9bff83490fcde6f58f7fd95725f2c6edb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pwndrop-llcsintez-n-org", "colour": "#E356A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776069434, "uuid": "a4774a99-c113-4de5-a7cd-fc566dcb5bc6", "value": "T16AA57E46B3A601FCD477C038CD466217F67274041774ABEB55A08AAA2F33FE12ABE715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776069434, "uuid": "cdb05121-73a8-4f4c-abc5-88b2cf19f0f2", "value": "60ba5b792d4c2a461f8f022c804ac87a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776069434, "uuid": "4f8a72b9-26a7-479c-861a-bf483d9d4079", "value": "49152:5skw1zUpovIPhvqgxecI6f3WXWi84TdK:2RvVV8tydK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776069434, "uuid": "1462d410-2ac7-43be-92ca-e91e03ef6cdf", "value": 2118656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776069434, "uuid": "79851c30-2c9a-4f26-ab5e-f9054be45064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776069434, "uuid": "ab4ac06d-cf92-4d7f-8374-ff6ed4402ade", "value": "Built_Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9902ca51-371a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776072280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072280, "uuid": "1dfd0307-302a-43c3-99c2-153414bfefe7", "comment": "Malware payload", "value": "b02a0dcac53ce739ca9069eba8da9ff0", "object_relation": "md5", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072280, "uuid": "c461de01-77a5-4dc8-bd44-9324a58129e6", "comment": "Malware payload", "value": "43a7281f56b51e3d44112b95199ae9f40367c601fd0b20096fb6b79fd20535b3", "object_relation": "sha256", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072280, "uuid": "6c2b456e-5468-416c-8187-473943bc703b", "comment": "Malware payload", "value": "5c2778808bf660747daab1b905b8e034edd70bcd", "object_relation": "sha1", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072280, "uuid": "7fa007d4-ad7f-4639-a2dd-60e006b4d51b", "comment": "Malware payload", "value": "4ccd153d88987a8d5dfe51e407235deea055fcdeff2d75bbbd9cae48fa898f5bceefec2de202e538f6552df9bfacb1c2", "object_relation": "sha3-384", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072280, "uuid": "1bd33fff-80fe-4611-a3b9-4acbe2f1e65b", "value": "T1A7F024B7B0BB41F4464FCBFD665850D610C90A0449032D18AC369A7074A4600E979E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072280, "uuid": "47147eeb-c4a4-4e25-9c24-9b8c8966ceba", "value": "12:Aj3uH56353UaWwDEPzHYB9uyE9urc3mn9uBK7HXZkc3UsIe5:wSU353BRg4+ytKm0EJHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072280, "uuid": "ebcc2367-a181-48d5-81e5-b71d48d45873", "value": 529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072280, "uuid": "c9cfd39b-4c5c-4090-893f-2a8eaa97a7a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072280, "uuid": "6acbc6ac-5c3c-4d28-8a42-827fd33b38d3", "value": "update_tcp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd66ccc0-370a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776065576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065576, "uuid": "f465cf38-b162-4948-bc71-c2f0eddcf4b1", "comment": "Malware payload (NetSupport)", "value": "50068de71c33d12db6f96e7715e782c7", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065576, "uuid": "1e641cbf-9acc-4d3c-94e5-c0474a9462a4", "comment": "Malware payload (NetSupport)", "value": "446131e81894af6b3acd9296d27c2a4c1e459f09d43d232fe076f9a6784205b5", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065576, "uuid": "2f617af2-a220-4e18-b4e2-01f1ab0fbf59", "comment": "Malware payload (NetSupport)", "value": "2f8802ffe42e1f97559b7f93c4b358801bce4a0c", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065576, "uuid": "ebe7d5cb-0c38-4dd8-9bff-33833c7ae66e", "comment": "Malware payload (NetSupport)", "value": "22fdccd25fb09c86173fc1a32aca3dc7f595eb98622b18236e78ce731a96d1213df731ea2a45265f43c2a60b39ee1bf4", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065576, "uuid": "d80c15b0-221d-4e1b-b284-e808236ae4d2", "value": "T11AF19E38C8BE5169E52C06B6020261619E72CAA8C296E8DF3A61BC247211F641EB329C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065576, "uuid": "a5b5d29f-fd95-47cc-ab99-cf908bf3fda0", "value": "192:5TU24gOidLNkQz4fnopD2CRqVH/NxJTWUTLSk7t3fya7N:B0g7kQzeopD2XHzJaU3SkpfyaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065576, "uuid": "54f81fc2-9845-432f-bb7b-638775b38345", "value": 7735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065576, "uuid": "47deafd8-cc62-4d26-bcfa-9dcca56f9b30", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065576, "uuid": "21e26bd9-d31b-42aa-b393-a5bc983c24d6", "value": "446131e81894af6b3acd9296d27c2a4c1e459f09d43d232fe076f9a6784205b5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f660081-378f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776122541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122541, "uuid": "139c613f-3a34-41c1-a60c-23e346c9e92e", "comment": "Malware payload (AgentTesla)", "value": "2574f2dadb7dcf452bd5e22cc33886fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122541, "uuid": "a90c9f82-4cd6-4993-9c14-a59ce48a3013", "comment": "Malware payload (AgentTesla)", "value": "458006548ab9c613545ee5732262593ed09b01d3b9cff93dfe10ecb38923a469", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122541, "uuid": "b1ec0435-5eb9-4469-92aa-c5244942552a", "comment": "Malware payload (AgentTesla)", "value": "89a6bd413a5b382a9070d7ef9d3ade3ecd77e22c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122541, "uuid": "e15cfd10-3fa5-4e01-958d-78585287b918", "comment": "Malware payload (AgentTesla)", "value": "9a86f85b279da01b8f09d78514f91e9c8a47ba250bf3ed79c9b98961effe1ed9ad797c8df79f0f84a2003985dba3faa5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122541, "uuid": "82d1e27d-d011-4324-a518-2bb2c97682eb", "value": "T13C25225573D4D24EC4C00972CC25F6A236EA6C3227551B2E37D0FE29E8B29D3AB475E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122541, "uuid": "9bd5100d-891a-400e-ab8b-b20c22f83967", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122541, "uuid": "d6c41cba-2916-4023-a142-772af7ee94e8", "value": "24576:xT20JJN6kODLQuZD0hPEfWC6wYcPIEOBc8hjE:xT7J8lDLQuZD6c3PMc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122541, "uuid": "c60eb6f2-1b1a-4bd5-acf0-e7e95c76184b", "value": 1003944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122541, "uuid": "71bd819f-817a-413f-83d5-ab56e568e817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122541, "uuid": "6bf5f5e8-b9d4-42ac-b3df-41520127812f", "value": "New Order 96342#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f107d493-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776047087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047087, "uuid": "6687f066-2bbd-4620-bfd7-22e960e2d41e", "comment": "Malware payload (Joker)", "value": "b7849db1416083e12045d901b0463596", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047087, "uuid": "704ef5a6-a0da-4e43-bfcf-24a3cb362e12", "comment": "Malware payload (Joker)", "value": "45b4d2ca11a6927ddc40dcb2aed7c7a9da9ea5176b938fcf916c1e4fa31df6f7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047087, "uuid": "7363e642-7412-45cd-b7e1-9797de8595b2", "comment": "Malware payload (Joker)", "value": "017f1f2a3aa34c2ebaa1942c1284340708aed874", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047087, "uuid": "cdae7f8d-775e-4ac5-ace4-e01c9558b3e5", "comment": "Malware payload (Joker)", "value": "f7815c9bee6be629b6bd273b6c33dd214914fde471e8d5c01976f3c52f6ba9292ec9a8096c8daff34dfcbf48e6bdea72", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047087, "uuid": "5cc8b84c-f7fa-4b04-b712-bb2b2a4bc9ce", "value": "T1FFA70146F60CC82BC9E6F07C9D8B07D3B9166C555A10C28B2D21F61DBEB37E49A527E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047087, "uuid": "51139689-c7fc-4510-8227-b6db3d2e979b", "value": "786432:zRtBFyii1aTZvUstoNkL5pLvnSvF2HcFv4Qf:zjOa9UeoK3SvvWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776047087, "uuid": "941e335c-9bdf-4b80-8643-06cd66847d8e", "value": 45462141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776047087, "uuid": "584c7942-e268-493c-a120-374668ff30c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047087, "uuid": "9c21bed8-346f-4b2d-88d3-ce13c9c4e61c", "value": "com.sms.text.messages.chat.mms_1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f6ac29-370c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066154, "uuid": "f64e75e3-1bdf-4ecd-8cb7-39b1059119a9", "comment": "Malware payload", "value": "cfe8520c7d24962e01de876c3c6c5f92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066154, "uuid": "d75e2d39-444b-4c5b-839f-3ffa6359ef27", "comment": "Malware payload", "value": "45ed04300fdeeac28f77ba60d18f4c720e5a84fe8fa5e3d3f17a72fbf52fb0e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066154, "uuid": "9766d7a4-c692-4b5d-acc7-aa41fe9e321e", "comment": "Malware payload", "value": "6dd437718ecf5353e343f4bc9f98b443429ed283", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066154, "uuid": "f7e02769-2d07-4269-939a-af23d28a3158", "comment": "Malware payload", "value": "c6b476b79d440d3c8e849a08b04923d18abff78bd8da4172f41c51dedeaff171556815ec56478725374cab1019de2dd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066154, "uuid": "16556acb-2ac3-4e33-ace1-3ea226ad660b", "value": "T145365B00E0A9EF98B8A1DF6546B6749185DA535B3D8A8D33F03E057CBFA7BE2191014F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066154, "uuid": "f5faeb46-0603-4e0d-9061-1ce9b7ede295", "value": "98304:NPbPrrJgxnzupr8+beK5OZcxeBM+eGr+aQ+8nkJQzT/0jNmB337xqkdmDiI51Lj8:9PrrJYzupgVPqx4MCikJQzT/SNmBH7wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066154, "uuid": "fad981f7-1502-450a-9839-c9f0005c154e", "value": 5308867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066154, "uuid": "f5089937-e026-4a65-aa41-e5ba59039d67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066154, "uuid": "3d6c3f6e-56ed-48cb-a727-7870bd288913", "value": "MACHINE QUOTATION.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f59f6c-370c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066240, "uuid": "b3ad5b5a-5666-43b8-9b9a-fba3651dd754", "comment": "Malware payload", "value": "08bec164c35eeba768b37770030b31ed", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066240, "uuid": "193ec4de-2c6a-4829-bd39-4e4a8ad28afe", "comment": "Malware payload", "value": "460621fff09cebcbd2ded09dd933ed66952d98c787548131136f3692d504fb44", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066240, "uuid": "6ba42c47-b6ab-4bcc-b8d8-65dfcbb84b33", "comment": "Malware payload", "value": "e272d531bec65cac9bbea65439f1bf3480308e77", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066240, "uuid": "adbfb02c-5f0b-40a5-b132-f6e24f9d5629", "comment": "Malware payload", "value": "ad4bf14f614cd815b3a86b28d5e58dacaf723625575ec356f424d860707655e4355b4e2be8b113537788be32adcb0f81", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066240, "uuid": "a0376486-b4ad-43c9-ae7c-c6ae6ad9fe6b", "value": "T1B8D2759BEC037FACC3492042DA4717C2B674507EBA6D2454761007ABE46FC946BCAE7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066240, "uuid": "e7ccf8a2-0eee-4a8c-a205-346899c4d591", "value": "384:kghjfzIsWOFxDJuJQJpJWJqxOeTbWchhqHGZQ4GJRDDzray9AoNxC7wdSqHnk0o/:nfzIsWOPjCkyrLraqAo3C7wlHnkXkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066240, "uuid": "f79c167c-e278-49ad-9580-80fb01c958d7", "value": 30202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066240, "uuid": "a6116df6-d784-482c-8312-041b47b953c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066240, "uuid": "f1b04745-7e9f-4883-9699-d13531f8efc3", "value": "3_12_5_1759_10.04.2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1688169-3735-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776083944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083944, "uuid": "332ca4a3-8a86-4579-a679-20eb9df5511c", "comment": "Malware payload (RemcosRAT)", "value": "5ef9fd28c95beb2f143373e74af4fbe1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083944, "uuid": "3d6f57c2-e30a-4822-926d-ea8f307c3bda", "comment": "Malware payload (RemcosRAT)", "value": "47dd6cfb102a1b35af96e3b0608125f3389f748f35608701d76f2a1392b3ea15", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083944, "uuid": "c3850890-4184-4b68-873b-55ad422a0e9d", "comment": "Malware payload (RemcosRAT)", "value": "52f94db9ee770782e4fd5d7663f0c9e5f574ed86", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083944, "uuid": "f37396f6-466a-4683-bed3-081921eca074", "comment": "Malware payload (RemcosRAT)", "value": "21b54e7b170ac9d03fccf36fb48f0f4325240a10aea2ce956903975a328cffb087f85d9e9fa77061bf90a7ea17ab4c04", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083944, "uuid": "b6f1074c-37c4-4618-a5a3-e33a103f0bba", "value": "T1AFE40175F64C89DCC707C8756A968986434DEC146F6A9B0230DEB72FB473BAC92C3426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083944, "uuid": "027c3414-0dab-4cd1-af77-0a99896b4348", "value": "12288:wDpuDsVIj3epuDsVIj3ve3uGI+fHFfi8QqzGPqkTU:KuAVzuAVTeGIqfi8zzjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083944, "uuid": "6e69600f-da4f-4474-995b-b2cf59a460ff", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083944, "uuid": "9c7f6b46-8f11-42ca-a1bf-25702935641b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083944, "uuid": "09c2e816-741f-4f56-bdec-81470cfc2238", "value": "Naro\u010dilo GSI432.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b16881-3766-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105075, "uuid": "f84f8187-f45b-464d-b645-6afa1a525e36", "comment": "Malware payload", "value": "ea1cb3145677986b8998138a9aa15366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105075, "uuid": "fce435be-a963-4f5d-a26d-a67f708b7a93", "comment": "Malware payload", "value": "485149ae92f96bc22f056d1996a29aef46cc2b60739fff879aeda74d06146f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105075, "uuid": "23f7b015-4823-4a21-b18d-7f4181081e7f", "comment": "Malware payload", "value": "4d2f9757605c864fa7fd5746a61007653ad45f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105075, "uuid": "82fc9d9f-44f2-42d8-a2fb-ededf4fc771c", "comment": "Malware payload", "value": "aa5db8c5067d2f744f24f72397bbe216799fe2163089f568f7fdde76ce9e3a509dba193994a284eaea321955d57de142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105075, "uuid": "969d6649-67f3-484f-82bd-60e69bacb619", "value": "T15116D02EF2681099C56AD6B582431B559F317C392F2227CB1120D2B4EB37EE0DB75F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105075, "uuid": "b7f40dc1-649a-4001-9e06-3ce632f67daa", "value": "99b5eb6fbd8d3958521962b1d3a6c21f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105075, "uuid": "58413b5e-0690-44a5-85d3-1bea24c41d66", "value": "49152:GQMqKus20ohL39WuGg9rHmVrv4O7nfLdoAiNa8rN+vvQDN3YtAynitmuXa9rHmV8:lMqxsRoxggpArAIgjRNId8muKpArA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105075, "uuid": "755eac1b-60d6-4315-bbbc-e4fdff96150a", "value": 4129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105075, "uuid": "b2f21403-7846-476a-a05a-245683e1a265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105075, "uuid": "e0ffcaff-0aad-451e-ad33-044d0f33d724", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6adbcc-372f-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776081333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081333, "uuid": "d45e22a3-4bbe-406b-bdff-6da1089ff69f", "comment": "Malware payload (NetSupport)", "value": "8229644518f764d2dd974d310206dcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081333, "uuid": "de350bc5-935f-4f98-b544-de63409e0d3f", "comment": "Malware payload (NetSupport)", "value": "4863b48593a52c56ea53b50e09bd0d6fa6a716911da50af310fc8aead076b5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081333, "uuid": "a4eba86b-0d63-4a74-be58-6f5d28e4ac91", "comment": "Malware payload (NetSupport)", "value": "3870cda707dd8800acb03c0dcff2eb6ff2408783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081333, "uuid": "bce0150d-281b-4488-9844-ed9eceeb8882", "comment": "Malware payload (NetSupport)", "value": "664cf8acc6bff73a1f810419c8fee145e4c0553f70676305afa55cff6e2534e4ede4d714dea81a346091b519bfe2f186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081333, "uuid": "66b9e534-1a63-4998-8a7d-803a295e4199", "value": "T137569012FDA408A9C4966376887351937E38B800572123D76AE9636C2F737F4937AF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081333, "uuid": "30cf902d-e6ea-4f2b-8e3c-1d41ca80de2f", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081333, "uuid": "432079db-3fd8-4795-a73b-367bf95e5889", "value": "49152:v7hNvXxDXxSVBPplpxkn+yyg0PapHOCj3QcvNiwT4+Bu7Vg6YrfOqZk5wDUfE43j:vb0NPyuJGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776081333, "uuid": "2efe5540-f2dc-4ca7-b57b-9cd6744c0ca7", "value": 5889048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776081333, "uuid": "0ff32508-7222-4a45-a128-1b62e0c11949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081333, "uuid": "b9ace968-524c-434c-90f0-da444064f43a", "value": "SecuriteInfo.com.Variant.Midie.178032.24045.20376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904026ec-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043489, "uuid": "2083deb1-52e6-485a-bbb4-03833b7b99d2", "comment": "Malware payload (Mirai)", "value": "530566424b55519dca8ea9aa8890cd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043489, "uuid": "ac4b7aa1-db55-4ec0-828d-5f4ec1b85e3d", "comment": "Malware payload (Mirai)", "value": "487de8ac9bbc420bdcc1baca5e21a0f2018027694b1cf1389f9fb1cf65abaf67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043489, "uuid": "2c521a94-8ef9-4e47-b0e7-2258caf14951", "comment": "Malware payload (Mirai)", "value": "df8ee62495442ff5e821e2187c974025ee2a5c4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043489, "uuid": "f3bae96b-3cee-49ba-953d-534e75a2ca1e", "comment": "Malware payload (Mirai)", "value": "4a69978720af8418e5f2adc2e43fcb821e3bb75bd4cf9ac058126b2bb5b8d70012fafd042522d5faf8c2e025098b4a7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043489, "uuid": "460c0e0a-8cab-4920-8622-a4b830be0562", "value": "T157B3DB4B7E128FAEF62992704BF34E31D65977D627E1C581E26CE9401F202CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043489, "uuid": "3e892a0a-0002-48d9-b8c0-afafe239299d", "value": "1536:/4Pn/JpOAnQj9UEL28PAhQ44YucjDPX8sMxKO+VnxnLUwpZeQTWw6SsPm:wuj9xKHDPxHOwtYwpTWxfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043489, "uuid": "6e392907-36d0-483d-8ce4-80650933c1b8", "value": 116748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043489, "uuid": "981780a1-8615-4b33-96df-474706500597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043489, "uuid": "d8926c48-378e-416f-ad5d-8b12a131f9d3", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f663e3-3722-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1776075870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075870, "uuid": "ad8c781f-e1eb-4354-be4f-a87341b5415c", "comment": "Malware payload (a310Logger)", "value": "0c789535455bfd5d43640aca7df5b96f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075870, "uuid": "82c481c1-036e-4d2f-b58f-2ed685016e62", "comment": "Malware payload (a310Logger)", "value": "48bec8276b42e705dd46ca3bed2a4670cd63a3da3c34a70efaf83567de5663f9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075870, "uuid": "c899e9a8-e0ac-4531-9673-9eb625e0a66b", "comment": "Malware payload (a310Logger)", "value": "5715b01a35e65156860a4676a2e4011a5400f8d7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075870, "uuid": "2fcbe954-b187-40a4-a457-2689158a94d7", "comment": "Malware payload (a310Logger)", "value": "c2a02262fe32a24e707604e8bff5a66eb5c1730e269a5d57d5c76876c7e154fa4c3928c1c9b06b7c56f73e6500f351a3", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075870, "uuid": "35abd1a4-05eb-4e27-a113-e0d07e2c6075", "value": "T149452264726CC411E9AB1FF85A71E1B123385E9CE204D6938FC8BEEFB13E7141665386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075870, "uuid": "7e208a4c-1ac5-49fa-b7d4-113111488a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075870, "uuid": "fb497b64-52e6-4f2d-b2a6-5bbd75ee254c", "value": "24576:cXcxtRnI0mJUPBLV0Y4Iyqb3vFg2C1liSIhnBrZVRWaMDgCb:csx/I0mJsBR0FJqbfFg2CSSIhNZaaMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776075870, "uuid": "019ae66a-01ef-456f-8062-49aef3f2983e", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776075870, "uuid": "65dc3830-d97b-490f-a02e-8af88d1ab7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075870, "uuid": "509dc1ec-409d-4380-88ff-66713d1ca642", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f82570-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776085829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085829, "uuid": "7511019f-0786-4dbe-9c18-ac384c8051f0", "comment": "Malware payload (ConnectWise)", "value": "e594346219ef7f0c2425aff4ce0b2610", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085829, "uuid": "577c7f9b-e86d-41c5-b8dd-6f089ff84440", "comment": "Malware payload (ConnectWise)", "value": "49617209c4ef8c022949311852de4e5bffa8069cb0642c0c1790c47131c69fb1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085829, "uuid": "628960d7-0daf-4eff-be0f-bb100c693cad", "comment": "Malware payload (ConnectWise)", "value": "c1a09cb30fa6e64d5d3491d613ce7ef6b596ab8b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085829, "uuid": "96006c76-608c-4c44-b999-c5071639631c", "comment": "Malware payload (ConnectWise)", "value": "e9bf4bb4ce51a11759c034ca9474d76b46eb810849022e51520bad3b0e73a50c45ad5d28ca00051e8d5773d4331cce40", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085829, "uuid": "8c8930aa-02d8-451c-a953-9791b701691c", "value": "T11E51110FBA0B6270CD729310829A581DDFA3026716642498BF4C495CAF3276DEBF58E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085829, "uuid": "a61d42c4-2fc0-4c82-964c-b38f1427bc15", "value": "48:02ZPvoM+/0XNNEUKtKA/97hD2pa1w171SEx9lhCuaV6+RiJsaVxKO6yYAAR/g4/h:isCU2KAV7hCDxbsu4jRiJs4p6yYbR/g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085829, "uuid": "1679bfcc-b962-4332-b5c6-c01ba713e343", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085829, "uuid": "0599f2e9-bcce-42d0-8861-d7060f78746e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085829, "uuid": "f156712e-f401-4712-af37-68848fa0aef5", "value": "fb2b68a3_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dda8c0a-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085575, "uuid": "e4a95384-1d53-4dd1-aa46-6cd4beccf334", "comment": "Malware payload (PhantomStealer)", "value": "bfa90c4f58ad7da0765dab9db6f9e33c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085575, "uuid": "055fd02b-68c7-4b42-887e-67b49e0829a4", "comment": "Malware payload (PhantomStealer)", "value": "4a6476000affc9b9c43ca446e6d670ceae8a0555bf1e3d10591249c9c8b02a42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085575, "uuid": "0b5acddc-c173-4b00-bf51-c43bc02df6f9", "comment": "Malware payload (PhantomStealer)", "value": "3b61321ace3c3d1db8444a09bd97c0fa8982ab31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085575, "uuid": "e040f160-3c88-4b8e-a5bf-f8cc27c0329b", "comment": "Malware payload (PhantomStealer)", "value": "a81e8dcfa0b279fff128955c1185928358c7e77270e2ccf20d977a062bf0b042553c6d3fb0a5eb8e0a8d765e3fe3838c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085575, "uuid": "71f33c53-8a5e-4749-a889-c609ef1b81b6", "value": "T11586E908D0A5A11C5CC2CFAABD7298F148EF757B5E8D8A72E42F90BC2C56F93951148F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085575, "uuid": "dba42af0-28bc-428d-977d-bfe6bda3c28b", "value": "196608:OHp/WebIIipGT5ajNUXllrtuw2nWdkTQIAR6PB6t0VyLGKckJa/z4LST:OHpTEGT0jO/rKnWdkU24g8JYz4LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085575, "uuid": "34bbb1bb-8441-4a8d-b2c2-9470651c5857", "value": 8211114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085575, "uuid": "dd777cce-1740-4a3b-864d-1146b233a895", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085575, "uuid": "0003f701-c903-49f9-ac0f-c347301bfa9d", "value": "Inquiry Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca8252d-375f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776101733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101733, "uuid": "9fa5be54-0b48-42cc-aa3c-8c025a82234b", "comment": "Malware payload (Amadey)", "value": "9e83e1bd3b082ef5017139e936731304", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101733, "uuid": "451a2834-1fa1-4f7e-812c-72be09c49574", "comment": "Malware payload (Amadey)", "value": "4b563e86564aafb8b2f57473e649f95189f6064e1bde038c95cfdc25757f90f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101733, "uuid": "27132b16-b984-43e5-a6ff-7b43338ab1e3", "comment": "Malware payload (Amadey)", "value": "a67914153ef11408c55b63740e79d82dc71473ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776101733, "uuid": "0193b6b6-5969-4847-b84a-fe12654bbe09", "comment": "Malware payload (Amadey)", "value": "f0405241011db085fcfbb3eb6f165ab02a2e4b406bbb12fba7f464fbb5c0599f08540bcbccd6bbb77aa22ca5054940aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101733, "uuid": "76b69760-2a5f-4735-accd-fb387223422b", "value": "T17AA47D213C0AC072C66161712938BFB997ADB9255B7417DB77840F7BAF301D26932E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101733, "uuid": "7ed886fd-041a-4946-bd1e-cd20b3535514", "value": "17fdfd4b0f74c4632463578cbbe1a2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101733, "uuid": "a7af03f9-53b1-49e6-88a8-af3e0ece9477", "value": "12288:3dtcg+XmLDESEFB72arjA7vBmYuvOLLIzx:ncg+XmLDEBFNFA7cmIzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776101733, "uuid": "3bab2d88-0d74-46cf-b797-1f803ced48ec", "value": 462112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776101733, "uuid": "1140ccea-8b24-4be1-9520-36e22d78335d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776101733, "uuid": "2c18410f-bf7e-4022-811f-01b9a4dd748b", "value": "x4b563e86564aafb8b2f57473e649f95189f6064e1bde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a127baa3-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048671, "uuid": "293e24f9-beeb-4d26-8585-5921d05233bb", "comment": "Malware payload", "value": "59327238ca31ec7cfa684bf6acf34ed3", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048671, "uuid": "2c1c146f-f501-4098-ae7f-fe74b17dcae5", "comment": "Malware payload", "value": "4c3648325b13c9ba4659186abe38b5e7e2203a2a1bffb1834930e59b44791dd0", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048671, "uuid": "a8dc543f-3b2c-4ee8-94ec-6cd6e8f07ce9", "comment": "Malware payload", "value": "c5f2c432f6fe8446ff8be1c3e15c4e26a9538315", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048671, "uuid": "82eeecc4-536b-45e9-8f89-2f011a835b4b", "comment": "Malware payload", "value": "648808a19382ce5b205a0a3db02f7e40183169c8063a020828f8f22cff2280b66974bb46438b477810ac35cf663608b7", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048671, "uuid": "744072b4-8120-4188-96cf-0d8478ed9177", "value": "T17F24B633E6A288F9C49FC2749BD6E2A26670BC584174F21D5F804B127E07F609F7D689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048671, "uuid": "6d904bbf-aefa-428c-af22-d2c7bf0ee667", "value": "fb3237bad2e3a80d9e1f2968c22a2d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048671, "uuid": "6c7cd7bb-02b2-43b1-b017-a8e8ce596c31", "value": "3072:Fi8DJRkb21OS5qhEAHUQmVQiMmYR4ZVDR6z4U2SBN3ph0+JP5L5m2x/yT:Fif2UbN8Rg4UBBNjfJP5L5m2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048671, "uuid": "3ca008d5-7603-4e91-8aef-c4c339cccc1d", "value": 227624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048671, "uuid": "96f68e43-c2d3-424a-903c-b2030efa1c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048671, "uuid": "58b416d7-a8d0-4ad3-bf10-e34de112acb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95409c5-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048819, "uuid": "94adf4bb-495f-419f-8aee-0c9c27a25a9b", "comment": "Malware payload", "value": "d3226430c859078f77fd3ebf050c47b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048819, "uuid": "d5247aef-e7f1-4d52-93ea-bc03e3589cd3", "comment": "Malware payload", "value": "4cbe78b05cfc86d720d29be3d1f787510566b5697cc8332a98154b34d2d1e053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048819, "uuid": "217b7301-40d3-4988-a97b-218098ed84d5", "comment": "Malware payload", "value": "b13f1859197708313c3fcab12dc1e64a5a192894", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048819, "uuid": "586ef610-0aab-4c77-bb41-186ac52cddb5", "comment": "Malware payload", "value": "089b8d172d2dd8f3f78de0cff097491136d292aab8dc40486d086442c2aa0ab4165bdaa84116e1b1afed2f95db55657b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048819, "uuid": "4f4e733e-f178-43e9-94fb-a39509e81e79", "value": "T1358533A7538E1AD9D4E4D33B3B12B1F557570F30B56A4166A0EC93E6498C4B3ABE8C30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048819, "uuid": "962b08a6-0ed5-4a30-bf1b-6ca6ecda0513", "value": "49152:ff9oTPxeCkg1CW4lV6kFuKvGZtNULzsXF2EqweC:fuL5fr4H4GavyzCF2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048819, "uuid": "cac5d4c6-e50b-432a-811f-420d99b5e361", "value": 1863960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048819, "uuid": "3142b98a-87f4-4dad-9f06-c1c963eaee00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048819, "uuid": "616cca37-7c70-43df-955b-86e975377405", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2d80ff-3711-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1776068418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776068418, "uuid": "3fc3cd66-400b-4ef5-8b22-e710572ad655", "comment": "Malware payload (RedLineStealer)", "value": "00ceed403228d22340cde79ca56a0f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776068418, "uuid": "6c292ab4-f992-486f-9c3d-76679ba609d7", "comment": "Malware payload (RedLineStealer)", "value": "4d598bafdcea52627cc45652e78ba810026ecbcc63a36d026733ee4ff3daf4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776068418, "uuid": "c8be078b-5edd-4857-aa57-9aebdb0bb295", "comment": "Malware payload (RedLineStealer)", "value": "fab0ceeef3d1d315fe9556ae0d7f15c472e1e1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776068418, "uuid": "46809165-3ffb-47ef-8df6-e6139d100e13", "comment": "Malware payload (RedLineStealer)", "value": "91f379ae8a6f87a4de5da38da0a1c10b7f4eb837900e7488eb52155affe3d0abceaaa0a867ace54cedabc8d23caca88b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776068418, "uuid": "99497296-739e-4777-88b5-57b316de7af3", "value": "T1BB05121963ACC902D1B62FF41870E0B427B85DADD924CA821FCA7FEFB8797115684397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776068418, "uuid": "5aad4288-f1e3-4c62-917c-841c43f14481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776068418, "uuid": "06f7f1e3-abd8-4936-9d0b-9b250bdba2fb", "value": "24576:3e3bSrN5f1P7oPiTjD4hZHZwrpGwUZbX:3ob0NjM+4hHwA5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776068418, "uuid": "17beded7-8d73-41cc-ab4c-9882ce092e45", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776068418, "uuid": "34a93178-399f-4eb2-97c6-91e12eaadc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776068418, "uuid": "37b72eed-5c07-455f-a980-114b4d8349bd", "value": "4d598bafdcea52627cc45652e78ba810026ecbcc63a36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76ea4c7-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776085672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085672, "uuid": "47ac6ac3-703a-43d1-90de-f9fff9e6aa6f", "comment": "Malware payload (Formbook)", "value": "6e7b1e336dd5480349496bafbf7fc3bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085672, "uuid": "00f0e3a4-6ad7-4ced-92b1-4b53193aa397", "comment": "Malware payload (Formbook)", "value": "4d72a16e70bb005810bbaf4323e4f4247126ce7c25d283544280a2930677dd02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085672, "uuid": "90e5a247-442f-4529-aed4-bcb441d06d9d", "comment": "Malware payload (Formbook)", "value": "9675d3012bcef91796628f4b24cccf9fcb3a4ea8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085672, "uuid": "c3adaad3-8eb0-404a-b84b-395892f26afd", "comment": "Malware payload (Formbook)", "value": "6cc6c076fcbe1c52cf12091677cf63e4befab100addbb8489c3df5a5f8d7f0d4285fd9e8b27469702f35a3f651b40a31", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085672, "uuid": "7061524b-e597-44cd-997f-9a6f688b8221", "value": "T147A502115AC43FB4CFAC662990BE160EA3F04A8E541579CDFB73BD0ABFA7604521B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085672, "uuid": "6a26555f-2895-4b0b-bf06-b2316494f159", "value": "24576:4eYG8E4sqlfMhw3lSmnMb6lZLgefXhL8EhSOcfxgkD4KdxrFNadl8gAo++gXkksn:4euEdIqdmmiJvxVncfzD4KH5ng/+do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085672, "uuid": "59c2145b-25c5-45b0-8a46-68f913c1a585", "value": 2066226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085672, "uuid": "f53d8af7-d308-4eb6-902b-5dd9d65cf2ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085672, "uuid": "15d8c2c7-8069-48ec-8be1-d4222daf99b8", "value": "RCN 01923.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afffc776-3762-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776103242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103242, "uuid": "06da6722-9c93-4c13-8489-792c90c36926", "comment": "Malware payload", "value": "4b665e506432273332b2d3cb029c997e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103242, "uuid": "4c15b0f9-8189-4f7f-8f38-6fd977292b2f", "comment": "Malware payload", "value": "4edbb66bd585fd86b4c6c2ee7e661b3e45b0212c5c9ec1b6347de965f2f230b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103242, "uuid": "78e1c75a-9122-43de-b50a-ff724f62db75", "comment": "Malware payload", "value": "56ecb388dc5512709bfacb4d79a210ab09c85ede", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103242, "uuid": "eb34b03c-740a-429c-a347-0d1d538b1eeb", "comment": "Malware payload", "value": "8b0b84c5191135c4a5277e16610440c92935373e5226b813c631d240aeff894de8cb4cb67bd73352d5e56bb3e0376d47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103242, "uuid": "800a71ad-bf68-4bee-afca-624a31b54674", "value": "T15EB1B4C812A354747DF68E6372698A28B9C9B182DDC58F80D4EDF4F5588CF08BD416B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103242, "uuid": "2f487789-9176-4d4f-a550-7b672f350c5e", "value": "96:IKhEcfEnsTE1OCxACxm5FbTvXRtnfB9/HrZ:dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776103242, "uuid": "efa67a65-a31b-4fa2-8e75-58b1ee83fa68", "value": 5158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776103242, "uuid": "4cb26f79-2091-4090-b31b-c52f8ce9e266", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103242, "uuid": "50eb3384-bc7b-4179-8591-78ecd494173d", "value": "col.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9517a013-3743-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776089882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089882, "uuid": "8784fb3d-a729-446d-acc2-7be7249ebc25", "comment": "Malware payload", "value": "493cd7b9473e0b7a1f4b072b888d02f8", "object_relation": "md5", "Tag": [ { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089882, "uuid": "38dd5b79-93f0-4f69-b1ae-ed72aaf15e7f", "comment": "Malware payload", "value": "4ef5daa2a2fae50d0290b88598b4ee0edc2b608cf4df93d7f379f87ed91e3214", "object_relation": "sha256", "Tag": [ { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089882, "uuid": "a7a99d4c-7cac-4401-8033-5f42792cfc03", "comment": "Malware payload", "value": "1969744a5996f31e9b512780b17f2459b6b460c3", "object_relation": "sha1", "Tag": [ { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089882, "uuid": "c4896be8-0df1-4f50-b03e-15616852baf5", "comment": "Malware payload", "value": "8eabbaa8d734de1b94727a51eb91efbafd59f6ee76992a7f37a7b3d1d25381bf5733863ca4ee9b9c50271e67010810ed", "object_relation": "sha3-384", "Tag": [ { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089882, "uuid": "6481367a-025e-4e4c-8874-66745a2837fa", "value": "T1FB3110E4B402970DC70222BE88F98565C8FACB51530EDFD2B2E012E385756198F5F6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089882, "uuid": "ba0c2f1b-dedd-455e-8b7f-b27a71b117d5", "value": "48:8HmPhTBeEmp0fh30Aix9BVEjzdvI5Za4tBRoKpGMK:8Afe5CfB0bfV+dvCZa0Fwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776089882, "uuid": "01d55126-4945-482b-8948-5730c24369d9", "value": 1664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776089882, "uuid": "05f7d7e5-ed9b-426c-bd7f-0a9f39c1c09b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089882, "uuid": "5cde6bad-7302-40c0-b5e4-01313bac0b80", "value": "M.LNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaba08a-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776085523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085523, "uuid": "2fd9cd92-d726-49ad-8140-c1a4870e6c0e", "comment": "Malware payload (Formbook)", "value": "f52fd89a372d4a4ae4d252c8acab8810", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085523, "uuid": "68b7523c-44bf-466b-8982-c3f200c02157", "comment": "Malware payload (Formbook)", "value": "4ffa238d2408ee6c67a26c6b186f0f587ba9b55b8f32a546c8a1a91fd6477a56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085523, "uuid": "89ec2772-25c2-4aa7-9319-1037963b938a", "comment": "Malware payload (Formbook)", "value": "7cdf62672034b142bd3c201a20a4a3ef59962b09", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085523, "uuid": "8635c082-4edc-41ed-82ee-2370d9f17255", "comment": "Malware payload (Formbook)", "value": "12096b15d66ed582a5701000993c2e4ae960055f0dfacaeb0e38640f5f7568436439ebc64e4a73f0c9e26d4995cd31e5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085523, "uuid": "42b86517-3cc0-4c8f-be39-e4efe03710f9", "value": "T1289502018AC43FB5CFEC561980FE160EA3E04E8A5526B589FB73BD47BFE7600521B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085523, "uuid": "a26b8614-2e39-4869-8ccd-89eca6bded3c", "value": "24576:jrg5pJ++AgkkYGZB8lQPHznUvoxQmYbahGmziR5yDTqA+iHQIYf+1YOKZ8Q5fK8:oN+K6zGzwmBqeSi5hiWQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085523, "uuid": "31b2ead8-b68b-48fc-ad4b-cc2ed967a089", "value": 2048217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085523, "uuid": "1764d6ea-402a-4403-8436-0c1804b9b705", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085523, "uuid": "7605aaeb-741e-4759-a71d-31e81e3463ac", "value": "swift payment MT103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd9085b-373d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776087129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087129, "uuid": "716b1a72-c07e-413e-8e14-adee01055829", "comment": "Malware payload", "value": "f4f225488a15d32a1f49fa28eeb6b312", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087129, "uuid": "ec099f5c-ecd2-4b52-8d81-ac190fca6899", "comment": "Malware payload", "value": "507d40eb1542e9c2a763b765a540153cca93e9b86dbbf4004f28939290bb1135", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087129, "uuid": "874639a1-b2ca-4aa1-9238-eddf3e9db894", "comment": "Malware payload", "value": "d0b2e4a8a6058d5686a7bfbfbfbdc0c6bbe0ed15", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087129, "uuid": "d4456d1f-5ec1-4c7b-b2de-c2bc7436ab80", "comment": "Malware payload", "value": "f521f461845b721dc27479403643facd67b2864726a50847cd7217e2ebe4129b0310760c00df1d9adc5bca5d30ec468f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087129, "uuid": "118f4440-9b8e-4c19-87ad-578195d33a44", "value": "T100C6FB3F9208F9B8191ED8BFD422504A131664E9F0F6E63E2DA877F479B2DB05635C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087129, "uuid": "14628e3c-3a05-4486-9bb0-45b0509b1abe", "value": "12288:jw7hSsOPudwGkXdLhOwPq89h6W2T27iNcMKMi6e4PRaQ5IxfNqqcQ/vs4CHn+:kPOPudw16f8iNcMKdIPRaQgLR8bH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087129, "uuid": "ad672a7b-a216-4d09-8867-766577c325d8", "value": 12238022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087129, "uuid": "14bedf47-06fb-4b39-a53b-d5c624f17e72", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087129, "uuid": "fc98768e-1b62-47c3-9b50-62039f563cd7", "value": "Briefing material for bilateral meeting of visiting Delegation.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f3bcc9-3766-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105057, "uuid": "ab74569c-a94e-453d-aa73-1385e7a07c24", "comment": "Malware payload", "value": "1aa265647abcdf0e3d8cbe728d2760c5", "object_relation": "md5", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105057, "uuid": "de4328e5-b0c1-437a-8249-d41868c41e9f", "comment": "Malware payload", "value": "5124b89548b54b91cb8034c76c68e47ea01237688aeb6bedfa386b30de0b208b", "object_relation": "sha256", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105057, "uuid": "681cd9a2-598d-4d78-9550-e6f52b988242", "comment": "Malware payload", "value": "49179cb152091663e12c15051f20610f9f18257b", "object_relation": "sha1", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105057, "uuid": "7d5d5c1b-cf98-4204-85ae-438ca75db84e", "comment": "Malware payload", "value": "46a98829ce22763abe3b09f6e2f2e182c26e40bd635f92f0f1d82dd85de3705033df83202ccf314abb5e6c34c951ceb8", "object_relation": "sha3-384", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105057, "uuid": "44aa8b68-5bff-437b-a756-b890ad8f8197", "value": "T1FF76332AF67C5DC4C879F476E1B00D5087D3230EE542C47A9692BAE8B1F17CA4D8D86B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105057, "uuid": "19f7296d-e9f6-421d-bb5c-a2bc0e35c4b3", "value": "196608:+Zfts+j+LP6PDrEaiLOMDIh0uU+HB/OGUElH6XU8YYlbHXUF:+BJjpPDwbPIhrU+h/PUEl0U8YYlbEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105057, "uuid": "09855e03-ff8d-4060-82d2-0f5f05ef6d44", "value": 7734135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105057, "uuid": "f2e7859a-4df6-4af5-9567-91c7be5d3143", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105057, "uuid": "7085d91d-c083-4572-bc61-aea340871b80", "value": "ghanioilandgas.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90135d2-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776085701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085701, "uuid": "a3d1a7c1-ab09-4fcd-93c8-30c73cdc6b55", "comment": "Malware payload (ChromElevator)", "value": "f1fe74532719694e7a499cb73951ee45", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085701, "uuid": "44e0d78e-11cc-4480-a089-10654b552d38", "comment": "Malware payload (ChromElevator)", "value": "51a32f79c6f02ac71c495e6a8e82eb552a1c0ed6aad060ac1b47b7376fde5bac", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085701, "uuid": "bea63b01-4720-4765-b83d-67aa9c0d2ff5", "comment": "Malware payload (ChromElevator)", "value": "59acf4999a91ef2bd7bf5cb05ff56173ac8c3604", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085701, "uuid": "145288c0-b2dd-40a0-b112-dd71e3183e82", "comment": "Malware payload (ChromElevator)", "value": "1eccc738d265a37c303ba74fbdd32fe7de7248243c3dab65a64f2a42b0690dd273cf33f90489be7dc4964215c48be329", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085701, "uuid": "9f9ca129-ad2d-4c6c-afc4-6d19e8f67e12", "value": "T105F291ED3A39B2D836EFD5EC092A553C48F3256D2613B94261ED948C8933132B4E573B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085701, "uuid": "fbc3c904-705a-410e-b783-19e12cc6c57f", "value": "192:0zO0ZEo34hQgEXbzD5pnJUPdSLmYYBLzKhqeRS8H90hiTsi03RXSNxsaxDxjWKWm:8Ew4SkAFIUXT737hLuyRcFKQKHECb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085701, "uuid": "36e82c64-4819-487a-80c3-ba2b178ca93c", "value": 36435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085701, "uuid": "76a76e3f-ec18-4905-b8e1-e61749063660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085701, "uuid": "81725b27-08fe-45be-971e-bee3a65fca75", "value": "invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94775f0d-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043496, "uuid": "586ef731-12c7-4cac-a577-2d19a649dacb", "comment": "Malware payload (Mirai)", "value": "0a2203cd7b628c85345337c37e70bcb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043496, "uuid": "6bd46303-e622-451a-9a17-1ec834dd2d8e", "comment": "Malware payload (Mirai)", "value": "51c726ca1f5de33aa2ea2e7971eb309a2ffbc80903c26db3dcafc6b724af9393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043496, "uuid": "f45e31c1-feb0-4c3b-9fe7-6a02f3b87ecb", "comment": "Malware payload (Mirai)", "value": "ff2f6d4146fc85a9f1a8e1157f054bbf05e66764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043496, "uuid": "f840bcfe-0033-4e99-bb11-b9b5b828b369", "comment": "Malware payload (Mirai)", "value": "7daf700d1a5d96341afa400e5b94b5a3ee0d80f2ab7a485a4248209b80dff74c0fa0cf268a5de86991dbdc12e4577973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043496, "uuid": "447f21e7-390b-43a2-92b2-c013f0c41644", "value": "T1B08339C5BB47DEF3E84311F022F7A7365830FC3A0876DA85E7A47CA199215D2621A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043496, "uuid": "636cb183-2e31-4870-b97a-c9998588c9b6", "value": "1536:v8pvAq9bEX7SHJ8yfdTYb657lHxCoQ2e34y7LuMvBg:v8pvoX7Sp8aTHxtzeoUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043496, "uuid": "690cabe4-b93d-48c0-8916-f4b6523fa131", "value": 82680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043496, "uuid": "7aad81c4-f58e-4abf-a2b1-ca5fc3d034a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043496, "uuid": "787a2f5e-8bfa-4100-a207-4c2104535af6", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7fe11d-3732-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776082756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082756, "uuid": "0034649e-9293-479a-abe0-b642abf12f20", "comment": "Malware payload (GuLoader)", "value": "1093517c4b9da44b63d45487a75d17b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082756, "uuid": "c3f5bde0-025d-4c26-b687-bc81ae631493", "comment": "Malware payload (GuLoader)", "value": "527c7729e5e0398d6eb98dc8c97255a729eba54220877e72d6f5f08193d912b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082756, "uuid": "8ba59171-186a-4ceb-bc3a-ea1e705ded03", "comment": "Malware payload (GuLoader)", "value": "5f5e4f99c41841b223f3222c2bd9dfca0d0a40f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082756, "uuid": "3e28b7a8-3d01-48fa-add2-29feae815e48", "comment": "Malware payload (GuLoader)", "value": "723213128858b3e04347e280d49147cf55e07e04ec98d1a0888e00af6fbe8a8ef90d2cc54cf03f64b7bc964e2ec7b01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082756, "uuid": "f8508039-c63f-4a66-bfd6-b1b01b69f4fb", "value": "T1473512E49069C151D9C206B0F5B3F1A7567DFC8A5EB9E74F27033E88BA3E84B810659C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082756, "uuid": "d8a30469-1f92-4754-be9c-24efab62ee91", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082756, "uuid": "3e5bafc0-792b-4737-8211-365a6ee16dd7", "value": "24576:d4ojf+quUIlWLxJzmVeUEQ6EA87jYCpOr1QZiZ/AovyWC:aAHuWueUEQ6EA6kNh2a/AovyWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776082756, "uuid": "9271a6d9-fed0-48e1-b6ee-9060129d1b08", "value": 1109232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776082756, "uuid": "eea91cab-37d3-44d0-8bc4-1288bd8ece7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082756, "uuid": "6dc6f05b-9111-4d21-8341-69a10a974459", "value": "1093517c4b9da44b63d45487a75d17b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2df1f46-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048808, "uuid": "b91bfaa9-bcd4-4436-a5a9-cb3e32a83d00", "comment": "Malware payload", "value": "5d5f9e2e19005d6e32f1ec3fb165da60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048808, "uuid": "f55b1506-d03f-4d2c-8347-0e416ac7696e", "comment": "Malware payload", "value": "527c90178ebf72c03c652fa9ff14d9a89d93aa3bbe706f7ef05531e106ffef70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048808, "uuid": "8c58dfcd-4ef5-4b3a-b50d-1129d5856e19", "comment": "Malware payload", "value": "70b2c66b7de00ab24b67b8babb53d171845f4941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048808, "uuid": "13086f97-0858-42e5-9405-ba09a971f377", "comment": "Malware payload", "value": "2f05e5d6a8f8bb72ca20ea1eb590360c006cb48568d1b9f72f71cfc4f7f8978521a4aa273e0467efc91b1609e3e2dd8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048808, "uuid": "2baca758-6034-4c48-b25c-adf8d492dee4", "value": "T1D466F7C1E991D24AC63D6D31EFEAEFD8D2273F315D885A4AC9D8F33E18B214580B55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048808, "uuid": "4474658e-23e0-41bb-8886-59f34a9be771", "value": "49152:P56wvvKP8nT71IsnR63fll+ExhTNQwOpx3bEHosdg8u400Jrh1Hxgt5EW:P56wvvKP82snR27bXzRgjEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048808, "uuid": "de7e54da-a9bc-43c4-83f5-32de356fe18f", "value": 6684820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048808, "uuid": "4cd0f853-b47e-48e9-bca2-ba370abd1f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048808, "uuid": "d0740a65-dba8-4046-90e1-a58208504f76", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9399853c-3782-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776116938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116938, "uuid": "ded2af46-ddb5-4c7a-8326-461fa578be5b", "comment": "Malware payload", "value": "8e98ae3277e962c5dd72807971e777cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116938, "uuid": "0966be85-aa58-497c-9cc5-6856233c2fa5", "comment": "Malware payload", "value": "5398c48926cbbd5913728bedc2b84f24b42315054f092ad3b4b88bf0730eb4b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116938, "uuid": "6f067197-3019-4ecb-8345-cbb369b92cd2", "comment": "Malware payload", "value": "0086b594c308b2eee344e1f9fcabc993549e0a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116938, "uuid": "d63ad44d-830b-4373-9771-4437245f9dc2", "comment": "Malware payload", "value": "d9e551fd386e4aab58077913ba24470f78255ce05e9b936381ea2ae4a5e32ee055bb6d96806575135d3ce573413c4a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116938, "uuid": "9127a8f8-c7ea-45ed-8993-ce2ba9d753c5", "value": "T166A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116938, "uuid": "4d9a671e-05b9-49e2-9f12-4ed04790202f", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116938, "uuid": "b27788ac-dc75-4166-9e8c-271a4c95fed3", "value": "393216:s1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfF:sMguj8Q4Vfv7qFTrYr/Wyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776116938, "uuid": "0186b5a3-bc7f-4340-8431-f87ad5393743", "value": 47117100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776116938, "uuid": "a964ad96-2948-4fbe-9287-e4c177197e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116938, "uuid": "013e5a5e-30df-4138-87e6-38cb0ecc5102", "value": "\ud835\udc00\ud835\udc27\ud835\udc1c\ud835\udc22\ud835\udc1e\ud835\udc27\ud835\udc2d 28.1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03fa7da-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048804, "uuid": "f19d3bb0-fb62-48a0-80a1-c048ae62fd49", "comment": "Malware payload", "value": "c100d5cd21ab9cc009e17deecbf675a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048804, "uuid": "01b72ba2-6963-4589-af1b-e5c1ec3ca955", "comment": "Malware payload", "value": "55b3b302a0f8f5bc70335c27c0eba1b824369c2e62a54411a039b272c61fd303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048804, "uuid": "64c433ab-a761-4b8d-a6b6-f13ed6512f41", "comment": "Malware payload", "value": "1d0d227170d8c0870726f4d17076946e1943cbff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048804, "uuid": "87f04cd9-34bd-4157-a7e2-d0e712cdc2ee", "comment": "Malware payload", "value": "840e42b98d326043fb44279be7aaec33d0408a437783cbb05acb9a4466972bd38bfea04c792b7682f6a0a6837aaa2e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048804, "uuid": "18120f73-61a1-4992-9fb9-3b1d83fa65c5", "value": "T11A9533E6137B2ED56E3A7C9FD8F42A7D36536051182560FC2327473B8EF118ABA18C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048804, "uuid": "d0d8a1d0-9576-4a90-b1f3-d5a010b6a25e", "value": "49152:POci7Gv/fdEzHLBBE1GcCxUxIhj0P3ixEUYyOYyPQLX3WZfGPC:2ci7fNcCxkIj4inNfZLHbPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048804, "uuid": "805e1c33-ec88-46d5-aa27-2f34ec6d2fb8", "value": 2013708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048804, "uuid": "8d1a7956-bf5b-4fb0-b5c8-a5a2815eac46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048804, "uuid": "d5dd9579-bb23-47e0-832d-3b500b98dda3", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a673b3-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085796, "uuid": "dfb43149-c9aa-4377-a4e9-ffc2c309df0a", "comment": "Malware payload", "value": "c788b689f7c53dfbf41d52cc40edf38a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085796, "uuid": "6d2eb739-c75a-40d1-96a9-ff17981decdb", "comment": "Malware payload", "value": "56baf4455e81ac0edcc6e89efcacd08e581f25ea4c8ed166d6d49ddfddcbc7f5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085796, "uuid": "76310e57-1229-4752-9fbb-a18cf3a6e811", "comment": "Malware payload", "value": "1430dee8a55ce9e26803e0b054f53552ea231500", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085796, "uuid": "2f3be1a8-71d5-4930-9608-3e5eaec6916b", "comment": "Malware payload", "value": "c2561427acb0a6a6dd40bf9c8a8304b5e5b3577cd3458960fa65cb5ae8bc369e04bee305b42ba4a553bf773a53707d6a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085796, "uuid": "ec3edabc-aa09-493a-94e1-2f829816b586", "value": "T127747B1567E5C904F1F29F0691B234AB362BBB633D6ACE2D0599598C0FF2600D2F079B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085796, "uuid": "271d9b71-9e87-47ca-8059-90ce804bb1fa", "value": "6144:CXNoy7Ho1Zld2nvt+GOt5iUpAoKVuh8NX0TPHR9RYlb70SC78cBB2sjSAZoN:CXNoUorld2nvcGowVo7h8NX6wbgSCoci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085796, "uuid": "5a17d0ae-381d-41a4-9e88-dca39ae8d78f", "value": 370086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085796, "uuid": "1418af65-bb5b-4fa9-82c4-178c268b4d4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085796, "uuid": "a39408c2-b833-4d5d-b1fa-c4b78b704881", "value": "\u0437\u0430\u043a\u0430\u0437_179630500030213042026_GENERAL_FILTER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0975f83-3774-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776110947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110947, "uuid": "79d46d79-b9e8-46c3-9d12-322bea1dc414", "comment": "Malware payload (NetSupport)", "value": "fb006806f7a574d77b6cd396c93916fb", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110947, "uuid": "bc9ae6fa-06bb-4f1c-88ff-7be024ef76f8", "comment": "Malware payload (NetSupport)", "value": "56fe3bf825f9230a5599bfa7695f825d7f946ad685b4547b0340b3eadeb1c982", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110947, "uuid": "d87d9f05-f9f4-49b0-82bb-dd284968fb69", "comment": "Malware payload (NetSupport)", "value": "a07722cdc62961d2a63faf2d827b1883efe3e173", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110947, "uuid": "2082fc34-9218-4713-a843-ffc99ce27fe7", "comment": "Malware payload (NetSupport)", "value": "7249035ad2ad696812cb2e214eb1cad5a52bbae76b4c116601958e09e6f0f70394efcecdfb44bd2fec2d5eb7327b4a56", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110947, "uuid": "5d0a0fec-d250-4894-b416-97be8418c1fd", "value": "T146365C17BD740DE9C796A1784923E3C2BE24B440172123DB2AD962692F337F84677F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110947, "uuid": "47df3048-aee8-4ed5-8b3d-1ada706122f3", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110947, "uuid": "b56e8acf-b67b-4729-9691-cd27724dde22", "value": "49152:6i/KH5CLxzUt2qT3PWEOuyTL9CEMuNbDJ7hGvEsjtQc6E/VIKcx:6G6RmRCExNb1fA/V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776110947, "uuid": "3e3ae96b-918a-43f4-ab1d-78c4b3dc5ecc", "value": 5225328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776110947, "uuid": "eca3873b-0c43-4561-ae8a-1a099c89505f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110947, "uuid": "e1bac089-e549-40af-8daa-5a6f4098f18c", "value": "ck-dce6bcbb1a728ea8d871de6d169a2057.cloudflare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153c73f-3722-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776075783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075783, "uuid": "0bd70d62-9e4e-45c4-997d-06f35d20e101", "comment": "Malware payload", "value": "5eb9f442bbd0c3ce2d291626fb67caab", "object_relation": "md5", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075783, "uuid": "17201333-c5d6-4006-90c4-35e2fd31b3fa", "comment": "Malware payload", "value": "577e57c645e7ba1dc6924d7990aa2be2939119cd1c8d7f4b301e6bbd87004615", "object_relation": "sha256", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075783, "uuid": "a65d22d2-cf91-48e3-8a32-ac80bfbf0dd4", "comment": "Malware payload", "value": "7ad6dc192454a1e4bb71b2fa3434ea7058f2949f", "object_relation": "sha1", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075783, "uuid": "41f090de-e69e-4145-bed5-2a92588920c2", "comment": "Malware payload", "value": "9c55433399dbddc5e306d9a65a5dbbec4d8263df5f06e4afc4467bd8fde5630076554f0a8cf58cae91b34a316213ea2f", "object_relation": "sha3-384", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075783, "uuid": "724e5a17-709d-41df-a1b9-40fad76df49a", "value": "T1848423F529BB1F5917B4971E6041BF156D544C9388BD86C90BD0E6C2228AA38F2DFF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075783, "uuid": "f0eded40-8eac-46b9-acea-0831dc854168", "value": "6144:V/DDwWBrPrazqNtZillkOs+ZqIJO674/uj9xeI8stJfSW7UyJrtmgd2DPqFtT8:V//LraaQzvqA4/uj9xR8sfatyJrtmI2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776075783, "uuid": "74f5b8ba-dae0-4c28-bf35-62aa3c6c665f", "value": 377587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776075783, "uuid": "85745627-92fe-4808-ac93-3aaea9318a3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075783, "uuid": "0ad03db1-d536-476d-b474-899302bd313f", "value": "577e57c645e7ba1dc6924d7990aa2be2939119cd1c8d7f4b301e6bbd87004615.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31526318-36f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776055355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055355, "uuid": "54a50075-5930-425b-b645-12aa26ed413c", "comment": "Malware payload (Mirai)", "value": "242dae61b01c2e77c489d860178eb535", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055355, "uuid": "91893cfb-38a8-474c-b28e-19fec33e2f1e", "comment": "Malware payload (Mirai)", "value": "57a64d5c60be00d3adcc4275abb95bcd69316c6639b4d5e168d6be470176ba85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055355, "uuid": "5e108c7f-ac99-4e5f-a9f9-ed9c1f095f74", "comment": "Malware payload (Mirai)", "value": "f4ea8c8dec702a875bfa883d104a54668ca1f3b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055355, "uuid": "1a7d265e-4406-4658-acfc-fd05613c88ce", "comment": "Malware payload (Mirai)", "value": "1b7a149001e3570b6da826d74d7e3845c633a4736c53b1d50e2710c2beb1235624230ef31e4097c3def3d3516bfd46fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055355, "uuid": "dbe1dc7a-5638-4a31-9208-538a93e10aeb", "value": "T103F33A69BA0F6C41F2C2C3F9DA8C87E13E1735E3C67A8DB1790252EDDBA39D95940502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055355, "uuid": "3ca85dfa-c75c-4745-84cd-a30fdcdd45b9", "value": "1536:KX7D//cneDHabMcgqIN+10Rw4b1X75zdm/Xa3yiIfMpNEn5p5M/LW:kLqgqIRRjR7Ndmva3yvfMpNxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055355, "uuid": "a4c9b7d9-648d-40dd-8a9b-97f3ae3cbe40", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055355, "uuid": "9707b8ed-9c8f-4d3e-b01f-efb8a8740472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055355, "uuid": "026f179d-0fe1-4503-b3c6-7e90e3e45809", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127e368a-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085368, "uuid": "963958df-23ba-4dfd-8c47-9e6fc0fa0678", "comment": "Malware payload", "value": "c21f8bfa8a5fdeefbb1618abcbce0308", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085368, "uuid": "8181cf93-4785-4d93-98d2-c8bfc9d7065c", "comment": "Malware payload", "value": "57f4597c8c57bf72047b12adba0ba8eee1e1bf7bf97a35e7798f2e2f3dca83b7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085368, "uuid": "63151f83-56f6-459e-8cef-5d6c0d8fd670", "comment": "Malware payload", "value": "78b6deb3f6b02c8898d1dc6209d8daf8c1b4416b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085368, "uuid": "f1276bba-863c-4c8f-8354-500ace2d8d09", "comment": "Malware payload", "value": "22adc9ff117db0f619a2a32523de066e8d9a509cf549da634c07facb996e9d70de9565bb3509789360f2d67489ce9999", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085368, "uuid": "5c9604ab-ed2c-481a-921e-de098cf677a4", "value": "T195512B803220DA18C5914A7ECD82DB845736FE11FD42D3573071334F5D765A00D52667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085368, "uuid": "3fd4cd4c-6c14-4943-ae7b-d8664de57827", "value": "12:rl3baFqzH5gCUTs2ACZ9A5ol0sNYKhQk7/0dX:rtH5nAZEqnh77/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085368, "uuid": "27be89e0-f08f-436e-a7a4-7f70a9657e3a", "value": 2516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085368, "uuid": "0401caf9-75cd-47e6-ab05-1856e9baf691", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085368, "uuid": "d7ba8221-57d7-4920-81d5-740ff75aa9bc", "value": "payload_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60053801-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085498, "uuid": "449d2e47-7f53-40b5-925c-177f4ae6d734", "comment": "Malware payload (AgentTesla)", "value": "11b2546818777191c1f4058f4c82fa68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085498, "uuid": "2b5a6919-37de-4ef5-b100-5db65e4473f7", "comment": "Malware payload (AgentTesla)", "value": "590375790628820de961fbf951d4ca17165074fb3d26a265f8f785d6ed7633c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085498, "uuid": "462e3b40-bbe5-4387-8e19-d174aecac0a2", "comment": "Malware payload (AgentTesla)", "value": "c5745fc98cdbedbcea17aca01ef8feef6a552b4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085498, "uuid": "28a435cd-9ecf-48a1-99d8-f1e96a9fadf7", "comment": "Malware payload (AgentTesla)", "value": "e22af5dee0d5d81b6ea76ccbcac8bee17ff732188ac44d93af4cd5ad7eb0b5ff0ef8e3ffb973f00cd55bae18c7591b4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085498, "uuid": "b4320330-27f4-4dff-b28b-73654e466e3f", "value": "T175567415D0B4B60E59C2CF4A957BC0B0888F796A6ECDC9A2A43F947C3C5AFE3941158F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085498, "uuid": "c6018a4d-1417-4def-a2ce-bd3a29677a36", "value": "98304:lH+z7zTdSfqpNIo2FJz+rNx+MrmzRr3nRJ0fjN3s/bQvHP7snZcM0p5stO1lUZgB:lHqPof2NIoyJ6rNx+MaRrXRuLNMbQvv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085498, "uuid": "19b519bd-45d1-41cf-9083-66b80a55fd13", "value": 6191778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085498, "uuid": "60fca83d-c433-4a11-b378-161899302b14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085498, "uuid": "0c195647-9ba2-4664-85f9-8f7798036245", "value": "New Purchase Order PO#8776374647863 pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b837f92-378f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776122535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122535, "uuid": "7b6ca8e6-c406-4d1c-a48c-a63563b2dce5", "comment": "Malware payload (AgentTesla)", "value": "4aaa6a23cc752a9a62411da8bdb54552", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122535, "uuid": "134d785f-8fdd-4f8a-bb67-3ae8dd042d1c", "comment": "Malware payload (AgentTesla)", "value": "59221ef93ad609dfddc918d4612cd968975af52b8e851205ab2f76f23919fad1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122535, "uuid": "ee5af141-1c0b-466d-8eb2-f5c517c695de", "comment": "Malware payload (AgentTesla)", "value": "da7030b98b7a68b9f155aefdb43eea883ff9619c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122535, "uuid": "0d1a6f0d-509c-4466-b36c-057213853ee3", "comment": "Malware payload (AgentTesla)", "value": "61972812642d37c99ca4accdf44c5e52f93f0d04ace580e289b6de6914b25308846cb3e67b4b5e8b23eb03356322d345", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122535, "uuid": "00209b9b-07b6-4bf9-93c6-69a3271f6c0e", "value": "T15375235573D4D24EC0C00972CC25F6A236E66C2227550B2E37D8FE29EBB29D3AB475D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122535, "uuid": "4b656b01-5269-4f43-95cb-1aeb030dcbce", "value": "24576:0T20JJN6kODLQuZD0hPEfWC6wYcPIEOBc8hjE:0T7J8lDLQuZD6c3PMc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122535, "uuid": "8193e904-a26e-4cda-b9c5-b50ade94a80c", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122535, "uuid": "7f7ddec5-cf0b-447a-b8e0-104b3fdb3e2a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122535, "uuid": "8414c274-9f05-4e6f-bd62-ae0d6cc5f36b", "value": "New_Order96342.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f98e126-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046870, "uuid": "a0d4a0f2-0d40-418a-b810-4cf777e08085", "comment": "Malware payload (Mirai)", "value": "1a1dbaacd60621750016accff2cfa7b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046870, "uuid": "c1431099-2770-4ada-bf07-e0189d013b01", "comment": "Malware payload (Mirai)", "value": "5ab846a0e81706fc1ef3132c44224700da7da629a5abc0cbba629aa8bfe92154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046870, "uuid": "415d921c-9a4f-4871-a915-c00c7506eb48", "comment": "Malware payload (Mirai)", "value": "854c4dcbdfa715f4e6c547b74479f4f76944ef95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046870, "uuid": "8a64c228-ffd4-4021-82c6-9ad66c7222d0", "comment": "Malware payload (Mirai)", "value": "4c5dbd663d55923f8a6deaa3ef4f628ba058bf301ce8c2114a79a3bc87387d463241d424b9a834fc3ae0afe979123b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046870, "uuid": "91a687cc-e65c-41ee-b93f-e0d976576fe1", "value": "T1FAC3F702EF611FABD82FDD7346E90B16348C6D5626B52B75B934ED18B31A1C70AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046870, "uuid": "e4afbbbf-dec1-47d9-9e62-84571ff62c69", "value": "1536:8P6qKu/1IQbcYfjEgo0zwxY53qslJ1AQWBCv3ytWhARqLguPDHHWqBm9lCs55nar:C6zu/tcIrNcsgQBAqLHTs3veF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046870, "uuid": "2f0f4e8c-5836-46f3-8cac-db69460c5326", "value": 120880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046870, "uuid": "3528ead4-4c24-4374-8e3a-0adb9c833149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046870, "uuid": "231fffc7-356c-4309-bf17-30ed060e336e", "value": "SecuriteInfo.com.Linux.Mirai.10456.8672.3012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9935dff5-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043504, "uuid": "74220285-5800-45a0-aeb7-a57a3c756c9e", "comment": "Malware payload (Mirai)", "value": "f45a58136a27d80473c9aede992215c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043504, "uuid": "9c53e1be-e8b8-4ef4-ad21-bb39b3213909", "comment": "Malware payload (Mirai)", "value": "5abe6ca4d1c14d2a82f1ed54696b70833fe94bcc8567d07139c4855fc6c0a3c9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043504, "uuid": "e5e3b04d-0291-4e97-b249-b23b79d1bbc7", "comment": "Malware payload (Mirai)", "value": "7e93981e3dd9ae95b965e7a7b83b3c4498183e74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043504, "uuid": "ecbfebfd-b5df-49bd-9f11-01490902d396", "comment": "Malware payload (Mirai)", "value": "ea02b7902d5982e394a2b28a20bbfecf8438bf82efa6a906eb38f7010152d59677421364ccbda49f1eec9fbb0646fb51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043504, "uuid": "3fa2d44c-1d58-49a1-a43b-21add411001f", "value": "T195715F8B339202F57C54CA2375B4AB80B0C090F05DEB9F19EFDE3B90668ED50B958693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043504, "uuid": "df9c3cab-fc46-4cd2-8e3d-7d9d7e87838e", "value": "12:bi7EVOqi7EVOOWri7EHi7EvWri7EnX4i7EnIWri7EZi7EykWri7EaNi7EaxWri7/:HU4yQFipeL8EnVhVTR28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043504, "uuid": "934abf74-7e1b-440c-bedb-72aa5a759bbf", "value": 3504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043504, "uuid": "9fc5a821-519b-4888-8882-d04165e80db3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043504, "uuid": "8770e273-a3a5-4a8a-a740-6aa489ba2c6c", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3406222c-3740-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776088431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776088431, "uuid": "5baaa002-89c3-4bc9-8409-6f419c23fd64", "comment": "Malware payload", "value": "82a9506c470eebe89140978803b349b1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776088431, "uuid": "d19e5028-6d34-498e-931e-41c93099ff0a", "comment": "Malware payload", "value": "5b967d1bf886ea8bc900e66b55a8707e96ebee8bdb9720d55680209ffb9240ec", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776088431, "uuid": "31b31a28-62f0-441e-a80b-82fe4b704060", "comment": "Malware payload", "value": "541bda14fb999c2303883c611b18ca5db26b26b5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776088431, "uuid": "e0bcc7f8-60db-4e2f-9614-0a5dc90a20f0", "comment": "Malware payload", "value": "820ba2319f15eae4249d394bbb46c4fe0f4c9cb489ec000b70d3581136fff6e33e0da23159a8661a4d3477b632820a96", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776088431, "uuid": "ef37579a-f835-45df-ba85-cfcadc79841e", "value": "T19923A41C9FEC1D92725211178A9A4572BA6E2C1EC5582A9EF09C04D1BF1AE3ED8D730F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776088431, "uuid": "c2d5e2e4-0cb8-4fcf-a681-cb61fb0a39c9", "value": "96:qhgZ8sNzg78sNmg18sNR8sNUxe8sNw8sNJg4x2qlNYxpszxYe/xP6OgHgM9xc3/A:qJyfDj1iIcqlNYxpszxYmZ6b9xO9Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776088431, "uuid": "27bcec4a-6b9d-4542-9c6e-58fbcf58810f", "value": 47874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776088431, "uuid": "c5a263b0-dade-4629-8672-4c94182018ff", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776088431, "uuid": "705717f9-61a7-4c0a-8867-b356e1e36117", "value": "nicespeakingwithbetstthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b295b47-3759-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099261, "uuid": "59d0313d-c122-4565-8fa3-67bd7178a777", "comment": "Malware payload (Mirai)", "value": "2355ec94cff333c9454d3d8a8f088e06", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099261, "uuid": "6be5f5d1-ee38-4079-88be-928379979645", "comment": "Malware payload (Mirai)", "value": "5c57a46d8780e6d4262d21a189967deb5b6a802d759d14024d351bc67cb04205", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099261, "uuid": "e536d244-f9da-4937-b118-be644b1db106", "comment": "Malware payload (Mirai)", "value": "85b77c3c8bc432a3bc1b3bb8cfb5b3b5dd0dda93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099261, "uuid": "80b2df5d-f07d-4b2b-8d15-207d2f6770e7", "comment": "Malware payload (Mirai)", "value": "afa35dd05e66d0c7c51f5f5ff9c8650d13a7644a88b7b7b3b548ae0875b834a2b0032c2eaf62cdbbc1cce1ff38e1fda5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099261, "uuid": "80c35e7d-2497-41cc-9512-ab50fc0e6104", "value": "T135D49F59BB8D3C42D3D7E339DF4A93A1732B75A4D36392A33901431DD4C2AA9CFA1912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099261, "uuid": "5cb59bf9-b51e-4ae3-a4f6-ef05b23af11f", "value": "12288:sncpCYU0S0H/RzRKbn0E/IVEN9Ix+nc/mTfg5FO/UM:8YU25FKbnJ/ux4T5/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099261, "uuid": "d26b8bd7-ad1d-4af2-ba24-eb6df397e7d0", "value": 618992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099261, "uuid": "7cc4a0f0-6f42-44b1-a152-d5f2cfa49e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099261, "uuid": "899b6729-30fa-4137-8fb6-998059055fe1", "value": "cloud.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950a35d0-377d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776114793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114793, "uuid": "869d1084-9d24-491b-8f57-821779a410fa", "comment": "Malware payload", "value": "e10e0d8d1352714116b72cee9e0491d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114793, "uuid": "a875605c-cdc2-454e-b48a-e7c2fc5c2349", "comment": "Malware payload", "value": "5c6dff882209941f465ca2eb1a6aab67d56f7b2bdd2ead29311ff3ac5301e08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114793, "uuid": "b9e417d1-4ff6-4877-8e43-f788531f3f79", "comment": "Malware payload", "value": "752b1340d3056d128fbc9e250b3b1b67aab67933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114793, "uuid": "9f16a245-3166-4510-8bc5-6e4cf56c22e6", "comment": "Malware payload", "value": "bacaa61b1ecb64ddd965212abae204bce2846a1207753c61431715c73ae6c0dcf08ec36ae49377bca07384ce0fc53be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114793, "uuid": "48bb6ebd-6e55-489e-9807-96da9c028e3c", "value": "T1C3E623F988D512F4D9D34B40B24A1BCEB1E1E15D45ACAC2D33C72C429B36EA78649E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114793, "uuid": "e21e5bec-fb13-48b4-a18f-0de28550678d", "value": "0a7ee3ba8ed500d12d25d09603fea5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114793, "uuid": "bb4fb90b-82af-4968-b9a3-86bd100815d4", "value": "393216:duWO2n18/K7mz/5NDzZR/MuF/DS6OASeg:w2n1C15pP/m6OA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114793, "uuid": "ea7e994d-23a3-4274-a5ac-92acb77421d2", "value": 14968832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114793, "uuid": "29458de9-5812-4977-a26a-2439c77acc8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114793, "uuid": "f2b19afe-819d-4d63-8666-219ee62ee42e", "value": "Cryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495f0e70-375a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776099634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099634, "uuid": "1c667f43-38f1-4ffd-8711-527c99eaf510", "comment": "Malware payload", "value": "4785d191a6eac7540d66ca9d1d764d23", "object_relation": "md5", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099634, "uuid": "2b458661-3651-4b9c-a424-4f8da70c07b0", "comment": "Malware payload", "value": "5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2", "object_relation": "sha256", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099634, "uuid": "388d73a7-6e25-492c-b5d6-3d65a1be82f8", "comment": "Malware payload", "value": "477dfc14a560c0ed1c0f984955b4d5f77e3c93ef", "object_relation": "sha1", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099634, "uuid": "5ec424c7-1ae3-4242-b2fa-7af62c9a7f0b", "comment": "Malware payload", "value": "54383a862e513560ef181a52561588b3fe0ec5c272918869b08b33ee29c0e5257c4598c7907e10bc0182302b564bea13", "object_relation": "sha3-384", "Tag": [ { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099634, "uuid": "0c87a88e-d72d-4cdf-9dc9-2f441138e9d5", "value": "T1BF41B5EFE4169334CE434274016A6D9DDF12E63B15029050FA8C4D45BB109B1F3A13DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099634, "uuid": "43625e9b-f8bb-4421-83fe-cbaf88fd2e98", "value": "48:w2KkMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:MkUP4ZkS56kUf6qo8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099634, "uuid": "7b27aa76-0004-412b-837c-98085a784387", "value": 2265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099634, "uuid": "81368b67-88a0-4c12-bdea-071acaeca562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099634, "uuid": "d88fab9e-d472-43db-a2a5-592c8d75fb2e", "value": "testx.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdd9a6a-3759-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099210, "uuid": "18e75492-b3a4-4527-9205-43ab35181731", "comment": "Malware payload (Mirai)", "value": "a3bbdbe82ba9f971f10127282945d57a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099210, "uuid": "c16cafe8-2c0b-4323-98e1-293a8ac33d9d", "comment": "Malware payload (Mirai)", "value": "5d1d224344a3d065cde769ee057c6298516b176a894104dbcd625a9fa483f8aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099210, "uuid": "d3a6473a-16dc-46d1-8cb8-2b40ddb5d884", "comment": "Malware payload (Mirai)", "value": "b31cba393ddf3df2686b9b7995db59a0b6cc316b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099210, "uuid": "1791dfe0-a540-45a7-be2e-aadf01a284d6", "comment": "Malware payload (Mirai)", "value": "66e68b50cd2c27779f984f131ddefd1f156f97e7e10d3273034273d871907c8d4c9c116324706440a28ecf494de6ac93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099210, "uuid": "c3063042-505f-47b0-8be2-e936b490c868", "value": "T1DB256C1BF2A370BCD167C030439FDB63A83AF47A01216E7B65C499352D62EA11B16F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099210, "uuid": "2ab94a1e-1d03-4654-aa9c-ad7f195a5e36", "value": "12288:M+UzGvnpb8P8a4Yw+AknlCqAKvja8ACoUv7/s3yygeUjYkngm:M+Uzcnpu8a4YwvklCqAKvjSCoKuknf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099210, "uuid": "ec64341e-197e-4a73-89ef-7357591b45d8", "value": 996568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099210, "uuid": "2bf4f84f-384e-4222-ad8a-b6d8ce527b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099210, "uuid": "50d4e538-14f7-4a24-b266-c210da6382d3", "value": "cloud.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e67600d-3746-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776090972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090972, "uuid": "ca6aa701-15ba-41a1-954a-336d701c0dbe", "comment": "Malware payload (Mirai)", "value": "5a4c90e143c4f8f14830eac8fa5883d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090972, "uuid": "f0422a86-51d0-49fa-9add-ac98fc2f1c6f", "comment": "Malware payload (Mirai)", "value": "5dc3d80d4cff4745b2315333d02bd6f46b17af026ce47b87866cbc6d659d7c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090972, "uuid": "ad60a2c8-ec17-450f-9e00-6af454efeae3", "comment": "Malware payload (Mirai)", "value": "b20d38cf7bdea18efe5f376445e1b5af90515a6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090972, "uuid": "651671a8-539c-4bbf-b18d-2dd4d40d4c01", "comment": "Malware payload (Mirai)", "value": "f9b5e8eb29bcc69be9b7c131491f32b3a1123caa0598545b6378254c842f0082dcce2ee995ee4588efc976d423d9b857", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090972, "uuid": "572f16e5-14ff-4f55-859d-bba4cf1171e8", "value": "T16DE32BC7F900DEBEF80AE33B48130905B230BBA145925F372257796BED7A1991573E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090972, "uuid": "7fcbcbac-d350-4478-9e9e-151edaceff68", "value": "3072:M8tixvzzW/xymbj0ffhguDWeUgCHuqVxjbiqL/khWr8:7trJymv0ffhVWDHumLPr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776090972, "uuid": "d6096bc6-9a01-4e96-8f94-c6a39c278abd", "value": 150144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776090972, "uuid": "1a710937-3794-4946-b5a4-13e0596ee0f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090972, "uuid": "e385e03b-341d-4543-a570-02dbd685cb64", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fa4f18-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085861, "uuid": "7e9d89b8-9c18-4cd7-948f-56139e969468", "comment": "Malware payload", "value": "d9a9f8400cc99c0840a419a9ef187366", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085861, "uuid": "3b345783-309c-4985-8b12-63d4acc6ded5", "comment": "Malware payload", "value": "5dc8634bde343c9229f6482368ca3ea46ff962fe738420c350e7c27faa3117e3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085861, "uuid": "05f3e879-7e82-4d08-8baa-3da5a119b887", "comment": "Malware payload", "value": "3429e7846c5d1a638d2207142e633c3f6700cc57", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085861, "uuid": "9c6664eb-9db2-4dcb-aeec-84676c0cd261", "comment": "Malware payload", "value": "e90e4a1c0e6d22647a3d73e09dd2b01099f92cfd0805c1d532f1102cee195ca2f94e68979c1e293124acd14aba381135", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085861, "uuid": "f8743991-0d7d-429d-9f4b-05c97b484389", "value": "T1B1E20D17D39C453A37EA0D98F60ABB5F33C806C75B819B703161E1742CAD6366AA93F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085861, "uuid": "77164910-d9a5-4e51-be22-b98881cab17b", "value": "384:KPPosW4PwAK5E1crPCSMvtUeigkloviUA9MsqhUMavJfFEaqY:2wsJKAxtt3UR6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085861, "uuid": "aa5d5ca5-5d50-4c65-a1e4-1beeea1c2e51", "value": 33966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085861, "uuid": "5fe87146-0d0f-4548-bfd5-36e439669605", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085861, "uuid": "14e66e31-961c-49ae-8d93-5867989f9d1d", "value": "file_20260413_bde317.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206436d5-3720-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776074654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074654, "uuid": "a25d86ac-b475-45c1-9808-c09bc896a880", "comment": "Malware payload", "value": "537f1ac7bcdea315b4398785fef908dd", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074654, "uuid": "0031e879-ca17-4842-9a76-1720a4dc19bd", "comment": "Malware payload", "value": "5e26b56703ee8617e1485fc029e4b886061ef86ed75611ea1e02f3b81c876b6b", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074654, "uuid": "2ad267b0-986c-4b25-8a88-447cd9dc03f2", "comment": "Malware payload", "value": "bd46851f84d04b6b5e29c62f51e6e96ffeb14b49", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074654, "uuid": "ef36a926-1581-49ee-a305-29fcf29652cf", "comment": "Malware payload", "value": "b997321e9b31955b12957173b602a89e23d5eb76023e3a9d7bcc296fb94890f23868f01c4264bb19631fb51a549149e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074654, "uuid": "453c9cf0-7c8c-43cd-8b2b-dd469d16cbfa", "value": "T1818423784E778FDA1EEC4BDA304DD6C23CC0CE87439AE595F1E8648853EF421576282A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074654, "uuid": "41aafa53-229b-487b-a84b-5cbee0b00011", "value": "6144:bC/gHxB5h89hAq2wzzsmHKJRNY4FvKeSfCWJaclUF/Kjd9pj8GgCuNKH9K3:m/gj5UhAq20zsmWYZr+yVjSKH9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776074654, "uuid": "8b1b2ff1-78eb-47f6-9d32-747be4917f08", "value": 377587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776074654, "uuid": "66ed95dc-d57f-480e-9cf0-799a6d44c895", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074654, "uuid": "3db6543c-3991-4c0f-8c07-1e91579eac92", "value": "Brio.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae5d1b5-3746-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776091154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091154, "uuid": "dddbe44f-cdb5-4783-8b07-980496c90f91", "comment": "Malware payload", "value": "416810d1310b12e077ec59ccdd364671", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091154, "uuid": "17b46ed4-dca5-4345-b8a4-b6894d64795e", "comment": "Malware payload", "value": "5e90ce13e96a3b3fcdde18036ce18c8e1e562ee1dae546c476dda70a11956178", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091154, "uuid": "4a9849a8-6e46-4afb-ab58-d7eff0f3348d", "comment": "Malware payload", "value": "1b81129665c1bed37555f638dae93c171de46385", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091154, "uuid": "9f35470a-9f5a-4950-afdf-af93a0b6eb6e", "comment": "Malware payload", "value": "910db78861a42e0ee48da1decbf69ae6af014b23c2abe8feaf5015987f328e74d866cdc29952d37177102ecc46698062", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091154, "uuid": "d848bbf9-05b0-44bd-98c7-78df43ac0005", "value": "T1FAE2D1375E19C56EE25AA43E0A09F29118FFC87416F9AEEE27207120EED07485D715C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091154, "uuid": "7e3dd5bb-1fff-49ef-b42a-fdffa16f1e50", "value": "768:xThGF+3mEI129WWAsEkiOCkoIMKIeIMGGNI3:5h++qUWWAsEk7Cxs9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776091154, "uuid": "3e0ed598-457e-4d7f-b7aa-51f43893e578", "value": 33195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776091154, "uuid": "357d3ccd-5e05-448b-86ff-351bff8c6e83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091154, "uuid": "ea4af02f-5c2f-449d-b869-dc5295c9894f", "value": "5e90ce13_maskify_workers.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeca87b-377d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776114889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114889, "uuid": "1ffa56a9-d39d-46ea-9b16-9b5065c03b87", "comment": "Malware payload", "value": "b3b2d800d86027b23432a171e34d46ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114889, "uuid": "a1d54ba2-06ab-4035-96f2-15b4733a5b91", "comment": "Malware payload", "value": "5e9fa0df86fa8363db7c33972de047be18f929c3ec9852221affbb545ef5844e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114889, "uuid": "ef86b92e-01ac-44d4-bbda-90af22aec7c2", "comment": "Malware payload", "value": "3dec6c5be39562c6f2b8e0463df15b28f4539c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114889, "uuid": "1a21363b-4150-4122-918b-1bd18966ca07", "comment": "Malware payload", "value": "0663bf342f91c6464b932c106967ac9c981a3f622a7df9ba1a62f72295b21a6f5a5b399e5a70f4fdb8f2f9c296457509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114889, "uuid": "444fd1cc-2196-4e38-9316-46c48d2468ec", "value": "T1030712E62AD862F8C4D34A30B547229970C1756B82F99D2F37C61C022521DF6A58FFB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114889, "uuid": "17b43ead-f856-4d70-a817-ea38cb25e0f4", "value": "8992aa63a104fde82ffa9c9d0e81eecf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114889, "uuid": "53f2cc9a-1f7d-4a5c-aac5-4661ce3ab3bd", "value": "196608:s4/xS2BtLUDBg/qJn7Hlb7yotBlh8vkjpcUfatePmOZkaWzTbx577Lb30JHh1N8g:tlnLUDBugrlb2oAkjdatekaUb7wBMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114889, "uuid": "e089c4e8-8af9-4590-85b4-9d26b0f9bc27", "value": 17859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114889, "uuid": "16a0a618-7f92-46e5-a711-015e43a08670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114889, "uuid": "4707e823-1e45-47b1-99f3-6a0ee00c5418", "value": "quantium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d3f549-372b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079415, "uuid": "c58c8852-0990-48d0-983c-1b18cf284504", "comment": "Malware payload", "value": "dfe45e00c180f2f8182db516bb1c01e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079415, "uuid": "20a3cf2e-99ab-4dbd-9209-a19ac542746b", "comment": "Malware payload", "value": "5fa36ac4d046208012da92bf89f0e190d5856e496daad0faad5d4a29dd8020ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079415, "uuid": "f3e95ce9-0d8f-4bc0-abb8-5565f1a2dc2d", "comment": "Malware payload", "value": "578b9ccf7983e8374a69ee7ae812df599df7746a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079415, "uuid": "32df3064-0e4b-483b-843f-19764cacaf4d", "comment": "Malware payload", "value": "3110961c9a1dd492ca70f35cf2579f6cc1032e1a0bc4e9ba961089684c64a03a031b64fd256160fa970717afd0df712a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079415, "uuid": "c74b2422-3a67-470f-8fa1-ac3c005be081", "value": "T1A6925218A122B2E4E516C4B29AA1F7CEF815314D87D4D8EE0ED469FA6C54EA313192CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079415, "uuid": "9a77f8b9-fada-43dd-8341-f43d324df261", "value": "70f35a2ef78247ca47a32c07cf455d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079415, "uuid": "3de8ad39-7957-436c-932b-9523d4b76866", "value": "192:Dj1Q85aBXaBjD63FVxHoB3NgxkPD7iHH+uIQD+vNsro1RtyF2g3j1SGBfAUs:FGQB6VVxHQdakLNGozOpSGBfAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079415, "uuid": "2e1716f5-cdf4-4cd6-a7b1-a08428f5a24c", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079415, "uuid": "f3082a89-d095-4387-80a1-4f97a3e2d0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079415, "uuid": "a705ab38-1a41-436a-b7d2-1cddfd4f8142", "value": "5fa36ac4d046208012da92bf89f0e190d5856e496daad0faad5d4a29dd8020ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f7fd16-3709-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776064993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064993, "uuid": "ab2d6b99-11b8-4bd1-b7d1-efc68905aef0", "comment": "Malware payload", "value": "1023bb564b66ca4de650507a478dcb94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064993, "uuid": "9a4ac4b2-18b5-4854-9d71-d90169806d95", "comment": "Malware payload", "value": "608e5c1936511ed51af2aa0eb6dc07f99b86d9ba4cad8ae206a783999ea3a815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064993, "uuid": "5cb566c8-18cd-49f8-a9e2-e10138ea02f1", "comment": "Malware payload", "value": "6d88b2c41f9a566f9d9cc8c12023762bca61ab7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064993, "uuid": "8871260b-58f7-49d1-81f4-e6c9264f0d68", "comment": "Malware payload", "value": "0a9364de7c43d667669bc507479b141cdae86748830dd12bde020631153636ad2cc4361dbd8e11a9e1c41c9c516ed7c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064993, "uuid": "64622f35-bacd-4938-b44c-7e9e64073af3", "value": "T142B64907F89100E8C5ADD174C6669263BA717C894B3067D72BA0F6B82F73BD46ABD350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064993, "uuid": "3afdaa70-e214-4b35-8384-9fc33695a8ae", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064993, "uuid": "7ddad769-050e-482d-b196-b64fef4850b6", "value": "98304:03aN4HhZAkceyqrtzyqCFRAlfbPEQeRZCm:UPhZXtzlCFRAqQhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776064993, "uuid": "12bcc610-f6a2-4f25-98dc-d4d8ed4dbb47", "value": 10489856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776064993, "uuid": "5c99bf57-af98-4530-8e34-acb81f388f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064993, "uuid": "49f127e6-d94e-46ba-90a0-89512801e8ed", "value": "suo5-windows-amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5e91d6-370c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776066088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066088, "uuid": "a2f1c334-ee1d-41e2-acd7-ccc0e6e1c1a2", "comment": "Malware payload (GuLoader)", "value": "d867cd9971231897bd21e3e8428b69bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066088, "uuid": "f32100c6-9e56-468f-ab8e-c69115d13eb9", "comment": "Malware payload (GuLoader)", "value": "6144754d7701662d63030af51c752a572a67e87484a1f171f87100f02940f591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066088, "uuid": "ee41597e-413d-4b42-95af-cbe0c70b5bc8", "comment": "Malware payload (GuLoader)", "value": "0eb125a4e49ef7542ebcce7f20e1b17379899279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066088, "uuid": "faeeb18c-8fd3-49a7-a8ac-55cc98cc1891", "comment": "Malware payload (GuLoader)", "value": "0d3ad78596be2348ce77074d2e1253bc65187472b50e1c600f37965b6c7e3868132cc2fcda41653ce7b4d5e442678ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066088, "uuid": "3855afd9-8b9b-4c91-97d7-cf38dd23bffb", "value": "T173F4028A77408B77C23953354F8786916739EC60ABD2972B3297F39E2F7225196433C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066088, "uuid": "510cf678-d8e9-4c85-b147-0910c38c0c15", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066088, "uuid": "ce971d16-635f-4818-9fc9-fdf70070c4b9", "value": "12288:pXyWmdPEZJ7SyplVh/OM8gvxydpF99UwvyeYiX8JqNQXHjXYbwixY:pXrmdPud3Vh/hvxMF/UnpkzN8XtixY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066088, "uuid": "aa588954-36f2-4959-9b53-c533afa12d04", "value": 781856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066088, "uuid": "df42243a-338b-49de-a7b5-c6d07c905a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066088, "uuid": "dc400a0b-cba7-4270-a622-622cbbae66e7", "value": "Second_Tranche_Payment_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098c50c1-3765-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776104251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776104251, "uuid": "a6f2a78a-be9e-4d41-a2b7-14b2e198d1e7", "comment": "Malware payload", "value": "54b2638604d17fbc556dc730c2c80cb1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776104251, "uuid": "7d70c754-76b8-4200-bcd6-a7fe9c3a5d71", "comment": "Malware payload", "value": "6195c2773a6b83f55aa9328638a601fb10a61c63c0b618e159c0f35082b11ecb", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776104251, "uuid": "064bddae-e1c4-4f08-9800-17eb107d7dfc", "comment": "Malware payload", "value": "02cb94678c00adefccb759fa99a8915b68a1aa0b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776104251, "uuid": "40a8e0ba-0e2b-4a7b-8725-c4b8b6fa5846", "comment": "Malware payload", "value": "74d9edde9d239ab1550ed79190bb706445844e2d28f8dad2f83712c990738b1bf1cefe24487350b222bd446fd20ef6cf", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776104251, "uuid": "650f8aaa-b6a2-4fff-ac7d-472f7593a356", "value": "T195E60110FDC744F2E803153185A772AF27369D050F32CBE7EA447A6EE9B76E20936256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776104251, "uuid": "37288916-90c6-459f-95af-595dcb13c636", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776104251, "uuid": "8e783336-e906-47a9-b17e-e9241616c6df", "value": "24576:mAR11FzUk7u0sV5oc8Ag4kR7DvFxIuIPOdKiXX22q8eLC/OKVLG7n5TayZ5AQgBE:mAR1u6naOsayjYHZKZiAsUcYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776104251, "uuid": "97fe9294-fd65-4b59-8ec5-90bbc3b82737", "value": 14534144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776104251, "uuid": "9f1bc4bc-4733-497d-86e2-df7602ab7799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776104251, "uuid": "25c359ed-707d-4e82-8077-131ca21795bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713f5fb2-36cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776040001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040001, "uuid": "f58e4407-474c-4cb7-bcb7-5a70886fc77d", "comment": "Malware payload", "value": "9b05cb308b922346360441e37513a3be", "object_relation": "md5", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040001, "uuid": "e2976248-c7a5-4581-b3bd-772c0ae2d64a", "comment": "Malware payload", "value": "61ef35c6ac8cd50aa51a6562171544b86346d0f0292fd9ac56cc48a6210e7321", "object_relation": "sha256", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040001, "uuid": "12b7f526-4667-493c-a407-fceca6b515c7", "comment": "Malware payload", "value": "dadef25c4bef63b9e39eea863819472c2da68b17", "object_relation": "sha1", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040001, "uuid": "02f0c113-59d3-43a5-ac14-c51ebc334d4a", "comment": "Malware payload", "value": "3b82823ae24a869fea42fb8b5961d8edd8ea54fb1e82c166c395105601e1ee96db59f1a22983882098d8e2b01e65cdd2", "object_relation": "sha3-384", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040001, "uuid": "5ec9f609-a16d-47d4-bda6-580b7715576c", "value": "T18F3132488AD7F5E42CBF15124B1F6005A1DA1223121CDCB2F84E9BD16F3213428DA2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040001, "uuid": "cf51d85b-7a5f-411c-b86b-122bdfb8d1e8", "value": "24:lA9tJ5FhXASQcDzN9BHeQ0AwFSFQoohnMtZocxkrUQFf1xHgo+gnIW1uTW:lA/bXASQcDznBHexARYyT8D9IW1uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776040001, "uuid": "b9f4fb83-0bdc-47c7-87b8-38a34fc4cb61", "value": 1658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776040001, "uuid": "f25b4845-4918-4843-8231-b24683412c39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040001, "uuid": "0185fce9-26a1-4cc5-bd69-8e3524200136", "value": "Planilha-382726742776412283647837761096952.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf12d87-3733-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776083077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083077, "uuid": "2b675c90-ce88-46bd-bbb3-18b1fea7d1e3", "comment": "Malware payload (PhantomStealer)", "value": "fe530f30912a30e59a4070ad88af80f4", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083077, "uuid": "36b594a0-e001-4d61-9be3-5177ddc113bd", "comment": "Malware payload (PhantomStealer)", "value": "623e380d94ef336723be739f9b42648fba425fba2e39db7241bb9175c3709a04", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083077, "uuid": "705147c1-0427-4005-99c4-7ad8022830e2", "comment": "Malware payload (PhantomStealer)", "value": "c26c040e93a64403917a3f087dea23d054485a30", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083077, "uuid": "c0dc7acd-c910-4b26-8d15-808cc10544fd", "comment": "Malware payload (PhantomStealer)", "value": "09e4656b1e6d91b8f108f540ded22d2bc73781c84ab7847cd739bc4afc471b6434fbcd652e7f5b60a22e417e5f5d53b4", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083077, "uuid": "b3bc5b49-4bee-4b1e-a144-fa07581fc89e", "value": "T1F6538CA63D8CC4FA5843C9A2CCA4E5694FB4484F8135D8FE694D66DD93AF04CC28C68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083077, "uuid": "426ec7c5-b49e-497e-9763-cd166315d568", "value": "384:oGrxAc1GpDWGLMr9TFe7VmGBBtIcHmqa3qAR:oGF9qLogVnDAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083077, "uuid": "7f13f525-fcfc-4da6-8c34-e16845830971", "value": 63266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083077, "uuid": "bc2a343c-20ff-44d1-9aeb-f7fd6992c51e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083077, "uuid": "2de9aabc-83d7-4924-8ddb-bc526d35355d", "value": "Stok bilgisi _27803 _3426 urun_6316 C3 .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7359a809-3725-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776076941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776076941, "uuid": "110e15a8-5faa-4663-8124-4274c855186a", "comment": "Malware payload (NetSupport)", "value": "584e60d7d4feb5545627f3d74fb658fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776076941, "uuid": "3c485061-d723-4054-a843-e1634aacd3fb", "comment": "Malware payload (NetSupport)", "value": "62d487a22c5954809e2f5efd55db70cf8bdbc492bd2b0acc1d6ec75582e5cdce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776076941, "uuid": "320c494f-52f3-4531-853d-d0133a463447", "comment": "Malware payload (NetSupport)", "value": "14e5ffb6fb5abb3bd08c58d06a55605a622aa908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776076941, "uuid": "5e0c9bf9-f33d-41a4-b3f0-17a117886da4", "comment": "Malware payload (NetSupport)", "value": "52c1590ea6944e10c70d5fbe5709a48e16ee1db61b04c54d0838cf7fc9c696d468a6fcd35cf84198ba03f4f48bc26b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776076941, "uuid": "a7fcd9c4-bdd6-4073-ac38-1ec36cbe41dc", "value": "T140469F16ED6808B9C892A37A887355437E38B400571223E76AD9636C1F637F4937EF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776076941, "uuid": "798fb780-a45c-497f-b173-4c9f8ee0880f", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776076941, "uuid": "03f3f1c6-218a-484b-9042-95c1e9236915", "value": "49152:EIO7y2N6Z+arWTMCUJchCajeTvj8Qcl9ljRXZvJtFkdesczy3jI9Kp1e94m9bGSg:EIFETQHhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776076941, "uuid": "f3916ee8-4bb9-47a2-a5c4-07ae9ffa9005", "value": 5556246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776076941, "uuid": "d8c9e3f3-890a-420b-8a30-f707346ff76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776076941, "uuid": "963ef635-fdfb-4e7a-993c-68058c7b9112", "value": "SecuriteInfo.com.Variant.Midie.178032.55151565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0644b601-370d-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776066450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066450, "uuid": "57e56793-c234-4b62-87fd-40914852817c", "comment": "Malware payload (XWorm)", "value": "293ae8644cb957e783d7bba21c18d7a2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066450, "uuid": "df86c886-c929-4d63-8bfd-cb3b22595f40", "comment": "Malware payload (XWorm)", "value": "636b3d4415bcef243aa3197eb8ca3ab4a1546deb981c0946ef196487f4cf4500", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066450, "uuid": "8267aa56-60d6-4ff3-8c5c-3f9ea248e5e4", "comment": "Malware payload (XWorm)", "value": "2b2b566cc80ab6d6ed6c53cea9771c17dc1655f6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066450, "uuid": "93995b03-56e0-4b3a-8886-a9aff4256ba9", "comment": "Malware payload (XWorm)", "value": "3803b25f9b11e33149469769cb149a11285bd151c0a4a1f0e740851c755184702b9632565b86a3e838ffb5ef8522d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066450, "uuid": "387954ea-c011-4d16-9e3d-988b7d55e5d7", "value": "T1C5E241D8E04560E29931F7E31849C2D3DB23BEE7176E8F971D1D2A0923730B6AD26D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066450, "uuid": "55bebcf5-8e1d-4fb8-b351-c563e31cb750", "value": "48:RAcL3pdbDMsgItfWRxhH80zPy7f4dfP4ZUFO48idtIQ6MsQ7OgMtPeSSRIcbE11C:RAcLZdb4JOu80z4f4t4ZUc48SttR0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066450, "uuid": "8182cddc-cc82-41bc-9978-0e40fa370807", "value": 32972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066450, "uuid": "86abc931-4dea-44e0-b06b-85f3e00add6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066450, "uuid": "2e7a665f-c0dd-4275-beae-df0a50cc83f5", "value": "confirmation_of_funds_transfers_docx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bdfde5-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085698, "uuid": "c4a99732-dcb0-4e7f-b723-868e12fc2c93", "comment": "Malware payload", "value": "0218063b726196381c1c06c2d826bcec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085698, "uuid": "e616f859-77c8-43c7-a79a-d7356a5a3656", "comment": "Malware payload", "value": "637bba9b783d6d60d8d90d315ec4ddad8040eeaec01ff4a4265abc243ce5fbbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085698, "uuid": "ac72a1c7-9b49-4ed6-b2b5-9f46b2d55b7f", "comment": "Malware payload", "value": "1414f28ad2bf44d45432e48d1d79191a4f00b74c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085698, "uuid": "7accb6d7-dbc0-4256-8224-8119b29766e9", "comment": "Malware payload", "value": "865dc88bddd4fdb8db2a8588081c85087c6110f242b55e95f09075ab38b03403521d0d4da99883dd9ae856f11a510f32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085698, "uuid": "491b6eca-a7d6-4e7a-a2de-e317c36c04d1", "value": "T18BB45038ADEA401A7173EF65AED43497E96FB373370E585C1081038A4723949EDDA63D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085698, "uuid": "5860ecde-327d-402b-85ce-dcef49d4891d", "value": "12288:tbReZKnbtmX+Bw9r3/nTEmSSd2oIzSmAeKddij15syKJRMoztdEDYjbThKFZvmox:P2qhzemuVenx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085698, "uuid": "336b7dca-293f-457b-8408-3387d9ed9b8c", "value": 507398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085698, "uuid": "07fb64ca-2b2a-477f-b586-2bf9fc2637d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085698, "uuid": "27be2aa2-12f0-4b9f-93b8-391f939cfb72", "value": "ORDER-SUNNY 5916081940.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9069f6fa-3768-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105766, "uuid": "db73e24c-a611-4519-aadd-fff8a09ab041", "comment": "Malware payload", "value": "ae0450890ffa706e8bb4946d900a1b17", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105766, "uuid": "abed8945-1b0f-4b6b-9db6-7e844e7eb442", "comment": "Malware payload", "value": "64286266f8d011f6a7cd3cc1d091c9b2ff5305a49374fc079d8914f97a3c9558", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105766, "uuid": "743d9229-6e32-4d5a-a734-bf783def1206", "comment": "Malware payload", "value": "f1d3a2feb22fdfe9e37527e49ae26e839cce2a90", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105766, "uuid": "0596f901-9f97-47d6-85a4-13c74c1f5ec0", "comment": "Malware payload", "value": "12286378346a4552913e5302bd94c4259d0c63d2d045887bed34c8b4ecdac7b6df9e0c89fff3d2badeccd1fe6b57a5fe", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false }, { "name": "vault88x-secure-efficient2-su", "colour": "#02D64D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105766, "uuid": "8550435c-0ede-44e6-a422-95241b41711e", "value": "T15EF423FB065AB0637777033A94491ACB88D311D4BB64AF914E6A014E37737F7690B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105766, "uuid": "13d90427-34fe-429a-aa52-244cf4139ea1", "value": "12288:YgHncIjPmgHl4SayQf/hE547kwxJJ5hIfBRyPK3MKsiKJ6qUn4Dpz9gh4uy2021t:Yu1jO6uty4E5APH5hIfBR4BiKJDUn4mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105766, "uuid": "41f40fa1-1de6-4268-b278-ba8cd32ea0eb", "value": 758204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105766, "uuid": "83a01cb1-3578-492c-a3bd-48de0766a029", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105766, "uuid": "23202986-b6a2-4898-91bb-1fdb6a3dc1e1", "value": "837a3d2da109d9889fd481898f042f5d67664b83185d15a01a6f95799c8d3644.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64368cc4-3727-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776077774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077774, "uuid": "1e967bfe-6d3d-4ea9-86c9-0ef2b2585f4c", "comment": "Malware payload (Smoke Loader)", "value": "db08336398f7c367c3f396cb7e67e093", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077774, "uuid": "2ce95554-b5e2-4a16-bdcb-8db452be682e", "comment": "Malware payload (Smoke Loader)", "value": "6511bf3c0bea8c7f9adac4f46be3f07e5be382026d8a178855dc55d64838f511", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077774, "uuid": "113f83d4-4d9e-41cf-9322-b54bf1105ccf", "comment": "Malware payload (Smoke Loader)", "value": "929e51bc28c703b83fa19cedbee4792502c790bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077774, "uuid": "1030fa3f-5c06-48d2-b41d-1f13838adcf7", "comment": "Malware payload (Smoke Loader)", "value": "dbdad0ead4f7d9ab4c5e50300fa2454f3879d587b9a84a27266d6be4240a7bce03fe363bfff654e3f92a4fe4bfccae96", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077774, "uuid": "f903068f-ad7e-473c-9dba-5342e6087239", "value": "T1FDA56C0B7C9445F6D4AAA7318CB75291BB30B8490B3233D72E91B6782FB67E05E35748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077774, "uuid": "489dc954-94fe-4a8d-8d83-89beca6abd96", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077774, "uuid": "051317cc-0951-425b-a2e6-7a42d986705f", "value": "24576:zcj4LrzYsJUBEzTafqW/mP9dzZzRoTal4dDS9cyxjCrheleh2KmVVBxBYYThm:zcynYyUgTafqSmvzZz226dDscyPjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776077774, "uuid": "45a08499-6dd3-44d5-b3d2-1387f7ede79d", "value": 2196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776077774, "uuid": "51cf3dac-88db-4633-bdb2-29bad4b8805d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077774, "uuid": "21f2de8c-a3fb-4f47-b2c3-c852d69a4edd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcc83fa-371a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776072288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072288, "uuid": "ffcd3813-472e-45d5-8459-11126bd2e948", "comment": "Malware payload", "value": "7ede3aa7d10fb278f28ff0d7fdfc152c", "object_relation": "md5", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072288, "uuid": "6cc5726b-80b2-473b-9acd-1f718ecf8da3", "comment": "Malware payload", "value": "654b3b28d561950167306cbcf0b09520e4a25d59b265f257957da68e5ff9d6ff", "object_relation": "sha256", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072288, "uuid": "da092cd9-7ef3-4319-b5cd-99171bbef6a4", "comment": "Malware payload", "value": "9e4e4b24c26f97e4fd00dc0e8562816d586752ef", "object_relation": "sha1", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072288, "uuid": "70bba638-6056-455e-bcbc-f0fc290eba03", "comment": "Malware payload", "value": "142a40cd543c205e20d1282a0c811e8011f2862c66d11fe03233567bad4d8b448dfbdf32409ab65e3281af69aad3759e", "object_relation": "sha3-384", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072288, "uuid": "4b17f939-eed5-4843-9ebb-1224e81d22ea", "value": "T104F05045B0EB45F4464FCB2D9A05418494E92B4542473D0A787166787CB8404D77CE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072288, "uuid": "37262e9f-9039-4b2c-8cb8-c77d95d0f7c3", "value": "6:ADziE03T3TxZCvD/0BiSJsHGziKz2J7i3X9qDyE0e8T3PV0RXerHqbPRf7HXbtR6:Amj31ZdWiPzHGo3mn7HXZkc3kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072288, "uuid": "85403d56-f901-4568-a7ac-db2cfea5a3b2", "value": 514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072288, "uuid": "64337a20-0353-41e1-95e0-8f411e600514", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072288, "uuid": "001dcd18-08ec-4c1a-a778-ea38bd03b6f2", "value": "update_client.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c65bbc-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066473, "uuid": "9a5facce-2520-40d6-b2fd-6346c9c8d97e", "comment": "Malware payload", "value": "71d90b80e3880ac624218d09044aa3b6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066473, "uuid": "78a8f3b8-3de7-4b0d-beea-d06244fae93a", "comment": "Malware payload", "value": "658c2210848a71db46689d348a04c039387152a50a8810b4bc81153ccfb3c3e8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066473, "uuid": "1c037f21-8b96-40ad-a611-42694e05b9ea", "comment": "Malware payload", "value": "f82190af60f7fd10841821581f4095d3da77e46a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066473, "uuid": "617a7205-0de9-4c86-9b0a-4eb4b7360af6", "comment": "Malware payload", "value": "f9229c0f5d4a88e99008e2b98343a4da25a59f6ab317794346d091839f298233bbcace731ef3d88f1e07a90a68857299", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066473, "uuid": "e4bf0243-6d94-4fa8-b60c-59f9d93a29ad", "value": "T102C27C617E94E1B85BCF731B77B4F8924538BBB2908D690C61DE84D227DCAD0B63C192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066473, "uuid": "52040d24-e7f7-46d2-93b3-7cf262c96c09", "value": "384:73ClEXYLh2iexnsHXk8kE89OGQR1izmOHfYuB/44a1qQf29spdG5ddbIy0J:OCod2iYdROJA/Dg4shoXdbp0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066473, "uuid": "4f162f42-cf11-49e6-85f8-e4481941e374", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066473, "uuid": "300283f4-6e52-4754-b2d0-d88b473f9ce7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066473, "uuid": "8a5e8985-1de6-4baa-8c69-4573de9227f3", "value": "658c2210848a71db46689d348a04c039387152a50a8810b4bc81153ccfb3c3e8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4a3a5a-3773-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776110483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110483, "uuid": "5a7a102f-aaec-49a2-b834-03616ec88271", "comment": "Malware payload (RatonRAT)", "value": "94b3dc72e2a3e8cb53648e9385ec1461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110483, "uuid": "0546a58f-f0c4-49ab-9275-24bbc345091e", "comment": "Malware payload (RatonRAT)", "value": "65e847a202c09cc5867132c9f95163752f226112e7b18928bc3cd3d0d82d98fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110483, "uuid": "218fd295-f018-4963-a01b-2555563a786e", "comment": "Malware payload (RatonRAT)", "value": "0ce146009f7c83635641b0206878ba7213e44b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776110483, "uuid": "882d6300-6f9e-426c-a9e0-295343021b7d", "comment": "Malware payload (RatonRAT)", "value": "f4d17528c6eb1306c36a4721e5556a998ba94f72226d166b9a688f3a076a2afbad6b2c1b5e0c0c339e51af7d8b1389fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110483, "uuid": "4db78289-68fe-4855-b90b-e1c678f703cd", "value": "T1C8D5121C33FACA18F2AF4BB4E87185664371FD179D62D76C589139AE04B6F48BA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110483, "uuid": "f1f21590-b9c5-4876-bb2f-97b2f7844f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110483, "uuid": "dd94b9a3-ec40-4d2b-acff-77bf54f357bd", "value": "49152:ogVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4I6WU:ogVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776110483, "uuid": "07201d07-9b04-4fc6-bf28-d08d3d2169f0", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776110483, "uuid": "fa59544f-e904-4c86-b3d5-0c15c3e10a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776110483, "uuid": "47297a63-8ad0-464f-bae2-5bc8741fef01", "value": "troll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b7b65e-3743-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776089687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089687, "uuid": "ab2c3515-48bc-4f3c-9c8f-da344648cfd1", "comment": "Malware payload", "value": "6b84f1beebaecb5ff9e66d9f2315a6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089687, "uuid": "859717e2-d853-4f97-9422-1869333cb110", "comment": "Malware payload", "value": "65f89942f20de3e5a32c37c38817e494dc139107a6abf4fdd1a9e52d7f40b053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089687, "uuid": "46c70946-69a9-473b-93b6-9c295b44a345", "comment": "Malware payload", "value": "3bc045ae178b505ee9140759d1df4fbeb29560e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089687, "uuid": "ae36a759-38f9-4a42-99a6-f61f2a45fe52", "comment": "Malware payload", "value": "fd9907396276b288ec36b2c869739a7235aa5d9a8769e7069b4ba1f7c40b57199e2e11b88a52c7fcd51bb24afb1440dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089687, "uuid": "aab49c02-f966-498a-9767-22ad023ef674", "value": "T14EC5AE203DEA500EF1B7AF75DBE474DA9A6EF2237706965E145503860E23A41FDC323A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089687, "uuid": "fbbb44ed-4a26-47b7-9ad9-8200fd93eb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089687, "uuid": "a499ccf2-46d7-4f4b-9bac-c32e872b525e", "value": "49152:sU7YRnirm2NnPlKKSb7L3wip6MaRwE0A:GwZNnAKSb7L3w0Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776089687, "uuid": "91d6ca97-0590-4ea0-bedb-84c8d04fac18", "value": 2545664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776089687, "uuid": "83528283-942a-46ee-b44a-807cb7f3e541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089687, "uuid": "c9313e59-9448-472e-a295-729e181656a8", "value": "XWorm 7.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc46a41-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085686, "uuid": "1a88ed5a-784f-4532-a766-c2f44e39c9b1", "comment": "Malware payload", "value": "1a22061092c9055d560b97cdc5eeb0ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085686, "uuid": "2793ace1-ad59-4ef1-b44a-370c19243f49", "comment": "Malware payload", "value": "676182fda528619d808fab224ec427d7def3fab4878a94f0536ece11a5eb3960", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085686, "uuid": "cbaccf6b-f2e9-4c87-940f-87a008e87469", "comment": "Malware payload", "value": "1cc0d89c8d10c5a89a9404c9cacd4886dffbfd43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085686, "uuid": "7bdabcd1-9504-457b-92a2-89fc175bf02f", "comment": "Malware payload", "value": "342a049f415f5f038f65fc0485015c8a4dde063ab89c01ea98aaa1592cbd3238f5cf8c600ce8211bb31efd2b6332a5a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085686, "uuid": "dd8bfa90-8354-4107-846e-08fd10b07185", "value": "T158A41F38ADEA001AB173EE54AED47497E92FF773370E585D10810386472394AEED963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085686, "uuid": "5844d85a-1f67-4f94-905b-96bd2816f257", "value": "12288:jXZhlEp8flUOdRZONnGyQvtRF1UC3b2SgtinD7GqWoGyYMqhVUPJdqKUFlCjyHT+:eqqNsLwpiqovLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085686, "uuid": "4b4e6eb0-ba53-4162-a056-2b502931ba11", "value": 478268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085686, "uuid": "5f1ed7d7-84d8-46b7-ba21-e1b29fc6ad45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085686, "uuid": "1db27c31-fbb5-4f38-a0cb-face70c52db3", "value": "Transfer_CopyS6076122762.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8af45b-3745-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776090705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090705, "uuid": "f487d1e3-a4cb-4b6a-b2ae-b128eda336e6", "comment": "Malware payload (ValleyRAT)", "value": "4176b4414edba9bdb731f9e0b7b41ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090705, "uuid": "97fa2eca-cc8b-4da9-a743-a7d6d6fb6fd4", "comment": "Malware payload (ValleyRAT)", "value": "679502ee69db0bd74ab27e1a3b3d7e933a767fb45a16b77813609be779cb5f6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090705, "uuid": "dd98954c-ced6-4d61-a8f2-edade42588a9", "comment": "Malware payload (ValleyRAT)", "value": "352363ac2f88f61a84aee5dc26a9fefb45a5230c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776090705, "uuid": "194dfee3-c6c3-4a99-932c-afb70484ac77", "comment": "Malware payload (ValleyRAT)", "value": "e60447e280386ea80f716d621f763ff6b0852101f4c1240fc6ec5641f086f5029e2714fd7845d2f109adb6003ef7048f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090705, "uuid": "ea265882-85af-48ea-ac63-08da106a0eba", "value": "T1B2E3F195F65340F2E45B62F060E6F3FF5176FA178B64ED39CA986190EB23F54810720A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090705, "uuid": "e773e4a0-8874-4df3-b31b-a74300a58ca5", "value": "6fc290e85b9e4c5121507f09cd19757a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090705, "uuid": "dfa62785-faaf-410a-9545-ea28ef594ab6", "value": "3072:41te+SMBq2hNVQ5CIkEISFPNisNYiC5ZqkeBVPKq1Ns3vIaMT34Jy:41ttSOHW3ISFEcYrNUi2NKpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776090705, "uuid": "ca4f04fa-880c-4271-9d82-f8c249d1634f", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776090705, "uuid": "60886007-c97b-432f-94b3-713cf1aa36f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776090705, "uuid": "45e233b5-5620-4b6d-a91a-86de48b8dcba", "value": "679502ee69db0bd74ab27e1a3b3d7e933a767fb45a16b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c391b7c3-3735-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776083947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083947, "uuid": "c1227892-2c76-423c-9e92-2fca4e30251a", "comment": "Malware payload (RemcosRAT)", "value": "f04f5f10b7b5bea5354504b87b06be68", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083947, "uuid": "e191ec7c-30ee-45fe-9b84-6e84289d6f5c", "comment": "Malware payload (RemcosRAT)", "value": "683ec0acbf8bde9238b5def149f656a580c5f221eaa83b8704c836f8eead7d04", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083947, "uuid": "0a56a3a1-e661-4d86-963f-e2d2370627d6", "comment": "Malware payload (RemcosRAT)", "value": "6b204f282430ca61246046b6425bcf236d057e9d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083947, "uuid": "aea4ecbc-c94e-498d-85f2-c92b40ceb8db", "comment": "Malware payload (RemcosRAT)", "value": "9ff578e6e43023d1413ba9da266484e29c63690fac8b6797ef763c7e1292d8ccc2b3ffdb80f648925904b2f87a8a505a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083947, "uuid": "decbde33-461e-4604-a1dd-91535600bfcc", "value": "T155E401B1F78884DCC60B88795A578981570EBC585F6D9B12309FB32FB473BAC82D7912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083947, "uuid": "32925021-a8c0-4d5b-bfd2-2b8d9386a7b5", "value": "12288:8ypuMZlP4Ij3tpuMZlP4Ij3E66KgVQJw+jw5ZYC:vuM7P44uM7P4bBeJNjSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083947, "uuid": "ca5154e7-7a06-4a52-8ab3-a40e5a2d795c", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083947, "uuid": "9d9ff5cf-2b95-4335-9b59-bd6ce6e99094", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083947, "uuid": "2c7abc2f-ed1d-43f0-8362-91eca84ff6b6", "value": "Teklif Talebi ve Sipari\u015f Onay\u0131 No. 58252 SOC.32-14 68387.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c9fed1-3702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061852, "uuid": "252ad468-bac6-48aa-abbe-fc476d116b11", "comment": "Malware payload", "value": "e9c1c1c7b9f495e2a9500e1af063148b", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061852, "uuid": "be54540c-c43f-4c25-9c56-0e552fa3a3a2", "comment": "Malware payload", "value": "6878d3220eabcee08c5ef02891d7a78cd23f531ef9389b43868109e7d03f384a", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061852, "uuid": "d1267066-9968-491a-94a9-42afb4ce800b", "comment": "Malware payload", "value": "4945e50bb92f2ad74fc4cca412b9c4a0a53b5af7", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061852, "uuid": "2fd21e89-190a-43a5-a5ba-6e23c00e7fe1", "comment": "Malware payload", "value": "e3e8a5da10acd7ea869b06e46b4b2c77950804535832be1b62177a32ea55cc3ca3048feca6bb405f4dd055933527e4eb", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061852, "uuid": "76d93e61-661a-4721-990f-a774f665b6c1", "value": "T117900214591124BA5B054374A23454840529B616C46062D72511441A04899B8D95440A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061852, "uuid": "48c807c0-1de3-4c4f-9f4b-76a61b2e36ac", "value": "3:VSJJFIqF1F65IF99cPLGA:s8qF1FhMLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061852, "uuid": "d0759f9a-5477-446c-9a4d-5acf7f0c47c9", "value": 53, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061852, "uuid": "86c5eeee-1115-402a-b91e-ae987807c44c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061852, "uuid": "d21fac0a-45f2-4120-882b-241b3c006d50", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa8c942-370a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776065580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065580, "uuid": "47eaa793-88c2-4c68-bdb9-59795d9be208", "comment": "Malware payload (NetSupport)", "value": "3b3965f98edd3c3bb3f40b556a8fe0a7", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065580, "uuid": "ca896084-cf0c-4456-8c52-db2deb0e57fc", "comment": "Malware payload (NetSupport)", "value": "699b6f4c7a232c12c6c927ff134d08ebc0304c3f66e1c565207321a9fdd97b75", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065580, "uuid": "81360e75-e154-4054-822e-053aaf825586", "comment": "Malware payload (NetSupport)", "value": "b06935b76e79847a1d5ab16f0ae3a9b4fbbfd123", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065580, "uuid": "f099352a-5b12-4644-9931-a34920c8ad87", "comment": "Malware payload (NetSupport)", "value": "9cc65d200a28349b3982a63db15a1f1f878078f21c75683d1541231aff4f09fac8875ccbac0c87d5688e5db63fa9d23f", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065580, "uuid": "f5fc22c5-e598-47ea-a30e-38e0daedf145", "value": "T120A2F13928A8471EE42E1DBD87A680046E17863C6EEAF06E0BD3549077A2C553F91DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065580, "uuid": "62f4639f-9624-429e-832d-c0d5f9120d5d", "value": "384:B0g7kQzeopD2XHzJaU3iaX4X5sNDHBsx0KYqJETh1bXVKlPPJNYIiqpWZPNpi77:BX7YoAXZ3im4Xqje0lqWhdX8nNYpqkPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065580, "uuid": "e7ac7709-bcb0-46b5-b42f-1db16a45861e", "value": 23313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065580, "uuid": "bd79d115-7703-4b1c-86aa-1bfe6278039a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065580, "uuid": "83ba2538-06b2-4da4-912f-8456d49a34ad", "value": "699b6f4c7a232c12c6c927ff134d08ebc0304c3f66e1c565207321a9fdd97b75.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5322460-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048812, "uuid": "8104271f-4f82-469d-aa5a-00f09a593bf7", "comment": "Malware payload", "value": "20960ce958443d1c294ab621f96ed613", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048812, "uuid": "d9941a1b-d12f-4fd5-b882-7e3cbb7f3a68", "comment": "Malware payload", "value": "6a0086c068d2eee2a45e8fca52d3e5c786a5808aefb2f271b7b536e0358d8e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048812, "uuid": "307b26b2-fa0b-41b6-a77f-92c64d34cbf2", "comment": "Malware payload", "value": "b264b4c30742756b788317a0b474f3cd40a6f337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048812, "uuid": "7f7cb138-bb1b-4165-b426-8e2afb357660", "comment": "Malware payload", "value": "d450d420cab50eb7c4afb0e50936d6d19bb3f7a9a4a5980603428ebca2d424924df3544b4d2c34af5c9388beb905469c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048812, "uuid": "441aa1cb-182c-4818-870a-d26ba6a47ab1", "value": "T1C085338F1E4386A4DA8E3FF33D89E9517E1326016E35BD5CB842D7186DE8CA4F35A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048812, "uuid": "9bcf77fa-89ae-4563-80e6-a7bf69048047", "value": "49152:J5MvtivbS3iM9tDXFyHcTQJjoBbyPUF475f5:uIvbgiMnDFTQtoBbysFY5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048812, "uuid": "c706d402-b148-4995-991f-22a3244a75a9", "value": 1783512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048812, "uuid": "20a31e73-50f5-4d04-a665-5c6a2ab37988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048812, "uuid": "37b58840-64e8-477f-a591-1f961ae4d72b", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098d6bab-3727-11f1-a769-42010a9c0008", "comment": "Malware payload (Herodotus)", "timestamp": 1776077622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077622, "uuid": "07c43e98-3804-4351-89cf-5312aa7446f7", "comment": "Malware payload (Herodotus)", "value": "8e890e212aa0710700d359ed384f24af", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077622, "uuid": "028dd5a2-014b-4b0d-a113-6daf8a512bcf", "comment": "Malware payload (Herodotus)", "value": "6a41be0be47457c93f9639921e5199c3cb89ba117dcc6f05e86441414384422e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077622, "uuid": "5a96776c-161a-4a79-86e5-1e035eea0c6f", "comment": "Malware payload (Herodotus)", "value": "1d93aabeb06032499aacbf6a7704805539aff5c1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776077622, "uuid": "6a47b273-1a3e-4c50-9c1f-734cd7f383ff", "comment": "Malware payload (Herodotus)", "value": "6381eef6349c41bd0a70a71ad60901e20cfab6f5365962ff17113e87becc5e79ba9be073b2621c76e63bc471792957fc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077622, "uuid": "45a786f3-3e77-4af0-ba22-ab2106336ec4", "value": "T17166CF07F6828F65C9BD837B95BA87603335AE45A743870B2509F3B87CA72D45B843C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077622, "uuid": "c412b8d4-04f8-4817-913c-ebc9d0e8aa62", "value": "98304:EE34IpX34IpQvcQLdMbxzTHCcX7ECPydi9rnnm:homo5cAMdzTCYFagm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776077622, "uuid": "0049d5f2-c353-4f15-aefd-572a81cc4ced", "value": 6821664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776077622, "uuid": "a3a99375-e50a-42c9-b8bd-d0db7b985ea8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776077622, "uuid": "4d936718-1f86-4827-875b-88fa38f73384", "value": "out.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f71ad0-36f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776054672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054672, "uuid": "42c8f95a-1d21-470a-996f-f183ab0cc6a4", "comment": "Malware payload (Mirai)", "value": "7b7da9dcda264492c205cebd40974342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054672, "uuid": "bd3e49f8-34d0-4f8a-bab8-9db64cc13354", "comment": "Malware payload (Mirai)", "value": "6d0759189f87c2e5ad7347e03bcabbd3190eb23f1746d78d2efd98228f439da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054672, "uuid": "382ab604-52d9-46bc-b210-d8e648c4f02f", "comment": "Malware payload (Mirai)", "value": "e4d49f6bb342303347bdb61c7570c47d030ecd21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054672, "uuid": "c49ff2cc-86f2-44ff-857d-94cd8b852ab7", "comment": "Malware payload (Mirai)", "value": "54a32c3a74e2e246039d249ecc117c9351a29ec6c6f49ee4f8084cf4ca2305aae0594806f55f108e2a6cb0b5a915741c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054672, "uuid": "453739cb-1b7c-493b-ab01-339a76b09761", "value": "T185A32997F900EF7EF40BE77780A308067634FB7249831A6662377DA7A9790D41926F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054672, "uuid": "b063e2fa-0191-40de-beba-7677492127f0", "value": "3072:9rVLMaP+T4CBZr8AIqyGdybZR/QZ09nIiKKtOJ:RGhnybH/E2ntLtOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776054672, "uuid": "aa03c24e-9e7e-4525-a029-2e724819be90", "value": 104944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776054672, "uuid": "2b8fbf61-8dd6-4740-9c37-b87c010c0aa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054672, "uuid": "711aa0f1-352e-44e3-a9bf-481df456a23d", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618d983b-3709-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776064885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064885, "uuid": "42d678a7-d719-4729-8751-94fbcd2f729f", "comment": "Malware payload (ValleyRAT)", "value": "4c44646b1b3129039108bdb9f25d4b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064885, "uuid": "c8ba8dda-59a0-4b42-97ab-1a0264dbfeb8", "comment": "Malware payload (ValleyRAT)", "value": "6d079502227f8c1153f100647229ebdc6f98173d1e6d96d7820b96b87cddf0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064885, "uuid": "0ed9d9ed-d3ea-4afe-bc85-05d6a39d117d", "comment": "Malware payload (ValleyRAT)", "value": "6331575c0f9f479ba23b01e2f5761432f3e185c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064885, "uuid": "2a226896-6499-400f-9c0b-a1151c9e622e", "comment": "Malware payload (ValleyRAT)", "value": "fef54d47b8182ad013ec21ee91eeaee9c16ec47d30b26c15141f2b5a841189932db1727521a971f691db16d8414063a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064885, "uuid": "d675958c-0aae-45e4-be21-019ab8ebb7a5", "value": "T1787533731927DD60EB1B6CB92A0A36A852A59560B1A49431C813D9CCCCFB5F3EF1E107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064885, "uuid": "c42434cb-def5-4c98-80d7-b77fd37ec776", "value": "8c4c69111630d8599dacdb4710373322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064885, "uuid": "f59607d4-dd7f-4322-b020-15d1ae5563e2", "value": "24576:6VP4iQzePuruuXj/cphZcoy78xW4wxOBw6ejYi8UpgKAe5yA9DUIUchSM9CWMUzO:6WBj/cphZcos2wIeJmKfcA9AzWMUwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776064885, "uuid": "15d8c997-b3b0-424d-a471-61c6a9dafc95", "value": 1615551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776064885, "uuid": "ce3b229d-7d5f-4bd0-838a-ff2a8165cd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064885, "uuid": "d17d7b86-cf58-49e7-9abc-a240be6ed75d", "value": "6d079502227f8c1153f100647229ebdc6f98173d1e6d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564e71dc-371e-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776073886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073886, "uuid": "a11bd34e-ab0e-4ca6-87e7-f1645732b504", "comment": "Malware payload (SantaStealer)", "value": "7353a954cec61f3e25fd5721d21ef103", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073886, "uuid": "c995d274-9a7f-4f30-aec2-dc0b9d8d2185", "comment": "Malware payload (SantaStealer)", "value": "6fb87b8587bcfad6d1ce722a2e4e245789fc4816171015efbee479a30108e2c9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073886, "uuid": "e97cb56d-4dc3-449e-9098-edaee20f88a2", "comment": "Malware payload (SantaStealer)", "value": "dcc5eef439d1f5e3226a6381d3fca21ec816ca9a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073886, "uuid": "f67043f7-87c6-4068-9ef9-ece447a31030", "comment": "Malware payload (SantaStealer)", "value": "3e7178c212cf7fa68859170c9280ac2ea28bbeeac2e75769e1f6dca9e873831064b879ce633fea917f9abc06cfee804f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073886, "uuid": "c28a9a29-b2d8-488d-919a-7ac772d3e236", "value": "T128E61223B28A633EE06A1A3745B2D1304D3B6E51A51B8C5696F03C5FFF3A1601E3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073886, "uuid": "ef6b6af4-c1cb-41e4-9ee4-73f8bfd65af1", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073886, "uuid": "523502d1-fa43-43d9-b425-4a41e8ab2386", "value": "196608:jpGBlSIdZUmNtRwaXpTvxIZ65Y43+BVpuu:jpGjYmNXNvqZ683", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776073886, "uuid": "72740dc1-7489-463e-80a0-e48e74648235", "value": 14780265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776073886, "uuid": "4202c713-2f53-4824-bd87-bf37247d1ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073886, "uuid": "afc28054-fa78-41a4-a825-07a8090a61a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f181d2d1-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048806, "uuid": "306b3e6a-84f3-498f-828c-f3f3a6371b86", "comment": "Malware payload", "value": "ccbfd6364949a09707ac10dcc6e2b5ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048806, "uuid": "bcc4ac06-c759-4389-b508-13fe7454b9c8", "comment": "Malware payload", "value": "6fd31ab9f54c115d69a2a66c8e19b391725b2fb40a764a64cab767b62d0b1eef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048806, "uuid": "e3c78c38-2395-4e7d-b4d1-61c9c7ff771d", "comment": "Malware payload", "value": "be18c0e8dc30455850558d3b8f25ef4056609048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048806, "uuid": "81caacf1-9a44-4207-b644-cf585bf7148b", "comment": "Malware payload", "value": "812f8824cee21d1ecd661b28820fdd843f2be038b209653a063362cb1ee8aad09f5cc571ce251ceb97a66b76d6d0141e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048806, "uuid": "cda7f8df-8f4a-48f0-95cb-4ea26a1b1a13", "value": "T11A85339862B66869D9C2327317DF059FCF87CB29E442FB34B423BE7501218DA6D18E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048806, "uuid": "c9fe3a1d-1997-4ed0-ae37-e6d05caa5ab4", "value": "49152:HUUBveUVHD9iml1DEb4WPSpk88X1d5z6y9x0LL62U:HUUBRD34UWPF8uv6ygLO2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048806, "uuid": "4b043dbd-f3c8-430c-a0da-6147029f2b3e", "value": 1749416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048806, "uuid": "56333356-d13c-44a0-b87e-4aa72cd00322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048806, "uuid": "4197da57-fd0f-487e-9493-5e203467c5ce", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a96f49-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048814, "uuid": "6ca5988b-2fe6-48e9-84b1-fa7cc42f6f14", "comment": "Malware payload", "value": "5a074aef156f613bbd8da0e4a8f7cf00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048814, "uuid": "bac54b0d-b560-4e6f-b892-cab118fbc23e", "comment": "Malware payload", "value": "702a49a6321b360c3813a1ff245e10cc1ae0d8864c6ab49c417c65e02a4b62aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048814, "uuid": "ee117e92-5a5f-4711-bbb6-e27ad76c9717", "comment": "Malware payload", "value": "4fa3d329409c6120eb84960d47f55aab2f6b6e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048814, "uuid": "f42d1fcf-debe-47f7-9b99-381a30f78605", "comment": "Malware payload", "value": "bb8c15cd33513804eb7258eff57458179e35d7e7e97d30a0b1476efa2a1f0ae81edc6cce6f5e043e2da0431e55c84b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048814, "uuid": "a2b57840-36f5-4ec5-b075-f84a256e9547", "value": "T136853387CB4260B654DFA3768C488092626F23C3FD335E35771E2C691E7346A389ADD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048814, "uuid": "ffb23848-ddd6-43fd-8499-83e0a76ed281", "value": "49152:LGVv04oJ+lZQ4f9StRXXYir5Iv/dmqS9dKr7:wMhka4YtFYo+Ub0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048814, "uuid": "6e4dba8c-2d2a-4e95-b2c6-27beb02acb15", "value": 1733400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048814, "uuid": "b89c35bb-d980-4910-bb2c-c738fb3a386b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048814, "uuid": "cd839884-5c6f-4eba-a85f-768355afca3b", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b40a5a-374c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776093858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093858, "uuid": "af861cec-3588-4f01-a060-48de0a916d96", "comment": "Malware payload", "value": "c928d0df517c5f73a6808cbfa11dc653", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093858, "uuid": "76f26a8b-aea9-43fe-8449-a0333b684fda", "comment": "Malware payload", "value": "7258f4a2cca516541ea58fc46c66d4eacc23245635abe4c9b9283bd96c84458f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093858, "uuid": "2189ac29-8d77-49be-9423-dceb04f10306", "comment": "Malware payload", "value": "fe7e88fe02870878dbc4ea377c2897e7f666a2a5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093858, "uuid": "0a78cab5-e468-4ce4-a8e3-3f46db1fcdba", "comment": "Malware payload", "value": "0190eb234965f59ee92e71027de84de4ff123b43bf89002f68a9537632c6d205f18e03b171cb90776cd294b63a9414b9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093858, "uuid": "2f9dd276-1d63-4745-8f0d-50b768438a33", "value": "T1CB35AF4FAB6E94B2F5F884FC707B498456B33D541389626CC749861FAF5D3A06C8F8A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093858, "uuid": "2bd1fb9e-924a-4ea8-8f48-7f2a923529bd", "value": "24a51ca87ab50809548ee38c9af6ab1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093858, "uuid": "f12fb25f-1945-41de-b137-c4848976018c", "value": "12288:/KkRSlShQskNXD8CYE4vKM8sGFgrSfahfNxzcKQIhyviSvTXpVshayfinEoBzDWX:SeiYE4yM8sGyHxzceheiSb5uhFinXdCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776093858, "uuid": "55b08f30-eca8-41ad-826d-f904cca1afb8", "value": 1086936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776093858, "uuid": "af04ab03-cf4a-44be-b035-12751fe600b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093858, "uuid": "a4c0d4ab-741c-4647-ad2d-45ac56a6f921", "value": "d2kyrjff.x2o - Copy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98426b51-3761-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776102773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102773, "uuid": "fcfb71d0-d389-4c68-abaf-e16aef663dbf", "comment": "Malware payload (ConnectWise)", "value": "228e16d25667acb27b6ff3738fa3b89f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102773, "uuid": "10cd861d-d3c0-4ba5-8839-69c99f192112", "comment": "Malware payload (ConnectWise)", "value": "72b0bdc099597ac6bdcd812f2d57ef5066f1b5f4d2f4a8f2a8f9a45a697eb37d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102773, "uuid": "1a889a72-8fb3-4a22-a87b-243b26177f0d", "comment": "Malware payload (ConnectWise)", "value": "009002a88000396c46d0b4dda0b7310836a835a2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102773, "uuid": "36dd5aad-eb4d-441d-9cdf-9a994e6325fa", "comment": "Malware payload (ConnectWise)", "value": "7bc70d3e06dd3c3b1f5bfebf1041e708c72c2155b3c47a5d7a532acca25abffd86c27e338fb0589e88640658bee72f77", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102773, "uuid": "707a7a34-626c-4f70-8482-3e6c616c8667", "value": "T13CD61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102773, "uuid": "65a73b3c-af97-45ab-9786-3652faf0c2bf", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102773, "uuid": "701c0ca1-4bfd-4a68-9126-5b59631e6be2", "value": "393216:GCXvI5MvHxyJkCXvI5MvHx6CXvI5MvHxZCXvI5MvHxC:GZ6HxTZ6Hx6Z6HxZZ6HxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102773, "uuid": "b260cf39-18ad-476a-9c7f-ab633fda52bb", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102773, "uuid": "0113df6b-51f5-482f-9e93-2820638434d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102773, "uuid": "d7f79bd1-567d-4279-a356-7a58ca03d1f4", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d84931-3779-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776113095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113095, "uuid": "0183e90f-6e68-4c01-8c67-2a4eab452988", "comment": "Malware payload (AsyncRAT)", "value": "da74bd457360421112aee00bb8e59ed5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113095, "uuid": "9ca55b30-f321-4456-8292-4fa5fa60dfe0", "comment": "Malware payload (AsyncRAT)", "value": "7354ea6d38bd6f177a858d44de7cfb81a001e2b559b2796ea7681c8e6fc150a6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113095, "uuid": "7126cb64-4170-4713-b5c7-86c20892849e", "comment": "Malware payload (AsyncRAT)", "value": "43e0f364a0d426c52a68539d57525d9fc4bdd0a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776113095, "uuid": "21cff9dc-2576-476b-b368-5161e22c0fb0", "comment": "Malware payload (AsyncRAT)", "value": "e03b21fd22c4b4bedcd0c7ec4899a2b1c6a7ee35e89eca06285a99e6f046cda2931519a28e31833e5e58cea356f8cc5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113095, "uuid": "0375f2b1-4b58-4981-8dba-f1f9485e5b8b", "value": "T140E24C4877E48312D5FEAFF02DF3710A1274E11B9913EF5E0CD48A962B67AC246507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113095, "uuid": "626cc7b3-b3b9-420b-8655-be89edb89588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113095, "uuid": "b2f49190-c2c0-4118-8201-0a42625144e7", "value": "384:OgaJ3qX3Zigm0m5gWKTEiThAKoL7Wxvh0FbOKTCOQSCRApkFTBLTAOZwpGd2v995:a6Rt4BZCxvGFbO75SCVFo9jYKOjh/bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776113095, "uuid": "9bc8c57d-7d65-42cb-96a7-35d114ed860f", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776113095, "uuid": "a8bf4958-0106-42f4-a1a4-ccc55cae04eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776113095, "uuid": "4ad94e86-34bf-48a8-8d90-675c2e55354a", "value": "XWormClient1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe2ff58-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084767, "uuid": "0b0b150b-8247-42a6-a9a5-934572efaf4d", "comment": "Malware payload", "value": "357d6538c0e3eebb9c83f1c71373efe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084767, "uuid": "56bef204-d570-430a-8e8b-05d100cf139f", "comment": "Malware payload", "value": "7361a2d5e2e3280af983341a686791b4ba42eedd0391a45d063ae6cda2b6a488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084767, "uuid": "9fab05c3-abf9-44d5-952f-634c1318df45", "comment": "Malware payload", "value": "e34b82704ce7b1eec8e860ae50f0e3e6ebf8e30e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084767, "uuid": "72a4a02e-465a-4c55-b056-7a64be3fe2da", "comment": "Malware payload", "value": "8f5023c5c48a92af12b42b436a401949e1693c19202583252babaa069a97908e5a148e91520a620a6b3ff813d0072a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084767, "uuid": "2e7364cd-af3b-4200-9f49-f9187721a28e", "value": "T1FFC5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084767, "uuid": "0248bd62-aa3a-4ba1-91c8-b049e0999cd6", "value": "f4ba5888735f8f49bcf1bc06d1716904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084767, "uuid": "153533eb-1bb1-4589-a21c-94cf37287e98", "value": "12288:diwtWm1x9GuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvqfy:dnxoml5c6yiHCPc/5vXL0pCC0gePvqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084767, "uuid": "c59d79a1-21a3-4f46-b6bf-71dd7bff90d9", "value": 2696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084767, "uuid": "0f055acb-d7ad-4396-bf57-1f36cbf8fda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084767, "uuid": "891faadf-1c73-4615-98ec-d2489c400e8c", "value": "clpr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cff473-3736-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1776084387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084387, "uuid": "b5fcf08b-e3e9-40af-a3fc-d8bbe6c1fb72", "comment": "Malware payload (SVCStealer)", "value": "913c9f0738a1c012a326c5111be4c10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084387, "uuid": "9475d098-cbb3-4f90-9fcf-a2a9e38acf92", "comment": "Malware payload (SVCStealer)", "value": "73c1670448ba22107174af5b4852ab30a25147ad05eac3e53bf4cbf0ca6fa896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084387, "uuid": "37060140-b346-4740-aac2-6774604c26ef", "comment": "Malware payload (SVCStealer)", "value": "123522e908c990e28dc3ec83a295f5bbbf967f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084387, "uuid": "2f504540-274b-4ad0-bd1a-4da9dced393c", "comment": "Malware payload (SVCStealer)", "value": "f4c14b4474621480d55c9f3e6aead7d9297f04dcba385c190165a18056cfcf53fb59e458c9e8b3310711c2afb4a2d76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084387, "uuid": "98801164-d870-46f3-a4ae-e12fcac1ffbc", "value": "T15AF36F4A335460F4E17B9279CDA65A46E7B2787A07B1634E437443BA5F333906E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084387, "uuid": "30209654-136c-499f-a4fd-79efaf9681a9", "value": "58e55310d66c611cb140f28166224b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084387, "uuid": "d4c54ed4-8236-418b-9d16-91270dfe419f", "value": "3072:S7nxofwnECrs6TxGrkHYq2KCTj4WIPww+gq9FN+yptH9UE+h4:hfwnECQ6TMrijkHIPb+rxH9UEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084387, "uuid": "eb8b0baf-8ca9-494a-a593-e68108347d15", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084387, "uuid": "0123fc80-7fa4-4fd4-accb-99c82abcab0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084387, "uuid": "80db4796-9730-4730-b6ae-432960f6d8d8", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9d37a5-378f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776122426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122426, "uuid": "ace31cb2-d756-4ab9-a1f6-216dd94ce7bc", "comment": "Malware payload (AgentTesla)", "value": "4c77365493f4dd1b14a31c7556e91146", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122426, "uuid": "2570392b-cc67-4ae7-a01d-fecf6ca46dda", "comment": "Malware payload (AgentTesla)", "value": "78417f6462aba815ff5cdb543950b7a7ec8426e9aa9f89fc9abf2eb884b86995", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122426, "uuid": "28ed7e99-0047-4009-b437-c81073f8a7e6", "comment": "Malware payload (AgentTesla)", "value": "22dae13143f0aaeeb11eddc57fb3399784654ca4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122426, "uuid": "ce39e483-4528-4321-8e8e-4c18f1c9b698", "comment": "Malware payload (AgentTesla)", "value": "8e08cc250d5f6075dd713fa93412282bdd421e411fa00243dc90fa6c0b59459119b8c04385b5bc772a346980b8f7b647", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122426, "uuid": "cd79f2a7-a071-483a-b521-af012a443a5c", "value": "T1DF650216D9C43FB4DFAC261980BE150E93E04D8A902D754AFB33BD4AFFE7A0451271A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122426, "uuid": "00136b94-0851-4b8f-a994-c6b28a53b849", "value": "24576:6W8GlgjPZfbSgIJ39vMTBG5E2MXIE7bLbcP0CKoxdZjO6PLjAi2q0sl:wj8Z3iYnMXIsGKCvp9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122426, "uuid": "cf08b9bc-b6dc-461f-9c74-3c90728bea94", "value": 1466265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122426, "uuid": "49e3b9ed-079d-44fd-a153-e520563520a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122426, "uuid": "43f8c15b-26b0-4e75-8d77-063d71d10bcc", "value": "offlinejs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eacb62a-3757-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776098354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098354, "uuid": "b41dbb0b-3e59-4c38-b896-73459afdad19", "comment": "Malware payload", "value": "6671c8c7359d1d3ed63e6a00aca38f4f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098354, "uuid": "44be14f4-5ce5-48a2-9fe6-31f5a525f5fa", "comment": "Malware payload", "value": "78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098354, "uuid": "8a4c8ee7-9cc7-4985-80e2-639bcf3f192a", "comment": "Malware payload", "value": "4dc60138f7ac7cb9fd71c3eb9c7f641f87ed0f68", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098354, "uuid": "d5f9d61f-f7d9-4914-a021-c323de7bb0e4", "comment": "Malware payload", "value": "1e8350ca4635661a73b3ed6f8a10667bb1d9e6c3ac70e9b0cc0b2212152cb48dfe2a8dbb55d3a1919dfa2ee06cfaf93f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098354, "uuid": "f2fbaec4-b346-4769-b406-bd0ffcb69ccc", "value": "T14E453309B9D727F26C3580673EA6F3B3D52A6E1711FB80171E615DCF4A60A17F882263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098354, "uuid": "6e402bb6-8136-4984-82cf-e947117c8c0c", "value": "24576:+PWnh3ZdW6BqbdftMRrwbUkvuxBIKkoCCPYWiM5463UHeOyfjiyDnlB:oW97WdbdftMg7QIKkGD/OAtOyfJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776098354, "uuid": "4bc4e2bf-cf5e-4804-8da7-05c382644e97", "value": 1212105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776098354, "uuid": "9fd54264-519e-45dd-b966-4ffa22255441", "value": "application/x-ace-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098354, "uuid": "41b407d2-c389-40e9-a9fe-8feb380f043a", "value": "Contract_Documents,_Payment_Receipts,_and_Outstanding_Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a36fdde-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085462, "uuid": "596c0d79-56f1-4d22-bd98-4e05837fbcae", "comment": "Malware payload (PhantomStealer)", "value": "6828911c6b7a027ba3641978f3fc9b26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085462, "uuid": "562aadbd-2b87-43f3-ac6f-b433a2270310", "comment": "Malware payload (PhantomStealer)", "value": "79003e40638d1642c35252b5fb32c4d9ffbb11cead45340144799854fcd47644", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085462, "uuid": "81f9806a-793f-436b-8ec0-27a9feabafd6", "comment": "Malware payload (PhantomStealer)", "value": "e6ef2481a3ee52013b0312129c8c337452181ca1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085462, "uuid": "b2395e99-f783-4b27-a2e8-cf9e588c276c", "comment": "Malware payload (PhantomStealer)", "value": "62e33ecd0a3e5330a850df9e4f3de248ee93505c2f23d9880dd91082bfa34ada135a99f0801cd7c2c41a4d1b41089d85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085462, "uuid": "29033165-1ca1-4a23-a22c-8a1af52d0bf6", "value": "T1AE26021189C42FB9CFEC661C40FE161D93F04E8A9456798AEB33BD4BAFE7A04510B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085462, "uuid": "5d5e0486-4a2d-4a3d-91df-bfea954b2837", "value": "49152:xijQlosPkZW2DrH179JvaodK1+3lnlh+Ql14oUc6d7:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085462, "uuid": "9586426a-8c4a-47a8-ace3-fc5372e68d38", "value": 4701553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085462, "uuid": "2b31bc9e-9d0b-4c64-be1d-64f88d58097f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085462, "uuid": "f4c4a784-c45d-4027-9966-4f25b6efcf4a", "value": "BL8811338581.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559b0563-3702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061859, "uuid": "950181fb-6f1a-45c2-95d5-f6f129501559", "comment": "Malware payload", "value": "17dc4d1ac569f02ed12569f7ca275996", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061859, "uuid": "abe0774d-0397-4438-9b3d-97d93b254776", "comment": "Malware payload", "value": "7905156fd2ad70e54596d0fbfa2b435feffd7245b31c5e27b12dfd022f8c11e2", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061859, "uuid": "4c6d00dd-9556-44ef-9f58-a6e8bab6f8f2", "comment": "Malware payload", "value": "72858fd56f34b3e09b6ba85c2a25538e96325fcc", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061859, "uuid": "55f84f75-88bf-4c37-ad13-a51d4993e287", "comment": "Malware payload", "value": "90531eabb25fef53d4abbaf1d309c86d2644fd8235d1071d1556aa56b55b15b789dab5f7a691b0189c9ebdf8f7edec4e", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061859, "uuid": "30e44d56-4d2a-4be0-b397-fd52c67c7485", "value": "T1CB331BC25EBC864645470C7349C5ED4EF2ACCEE9B32241DB1ABC7C958FE03DA686944B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061859, "uuid": "46d37e66-dc54-4b1f-8c83-5fab5365ce34", "value": "768:/SbN+s/HotMZRHxtfUPD+AW8SE8aPNv/uM83FIhg4Vy5FAHI9PwnvtVa1WKC5CAo:/OHoiRy+Ab1Ph2V3+9swaPwnvEWKGXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061859, "uuid": "45355a9b-2abb-4eef-90e3-22e8d8f6c42e", "value": 53457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061859, "uuid": "db6ab128-af7d-41a3-ae1e-43d84d6e9c25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061859, "uuid": "9cae0e45-31cd-49a0-98e2-5fe236cecc74", "value": "promocalcsotyqs.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2986947c-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066509, "uuid": "b2a301c4-3a87-4d5a-83dd-0472a4438a0f", "comment": "Malware payload", "value": "dacdc8328a5296dfd734f0b7173c1620", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066509, "uuid": "162d1b50-d4f4-4216-9a78-10383a104a38", "comment": "Malware payload", "value": "790bef4e5600628de41967e51bbe809a19b5c1a562fa93c5d67a062e753f442e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066509, "uuid": "636d0e1a-dd69-45b8-b039-318dce48326d", "comment": "Malware payload", "value": "d4a107dcb18e4492d5047e028676d48cfb69a462", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066509, "uuid": "cb8f769c-86e9-408d-96d2-3e6dbb6a237b", "comment": "Malware payload", "value": "40d9e2f0fca3291de606952cc20edf99363dee8846777905ef8255db69d48fc7376bfc8dba467488bba684350c192122", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066509, "uuid": "f2319421-dd38-4b15-bea4-55a4384ba894", "value": "T199C28E627E94F0B857CF321776F4F89659387BB2908E660C60EE508167DCBE0EA3C155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066509, "uuid": "cbfac8a0-0c18-4e45-8c82-4bf2e201638c", "value": "384:D3CNMcC3LAsaQvFviGZLFI93cWuyE/nlq00clDStCX0nl9jzGPT+g6QXq:2md7DFwdcWun/nl70MElhGPMeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066509, "uuid": "fc9c2a4c-9496-4166-882a-81fe90c2a0a1", "value": 27195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066509, "uuid": "61521a6b-be94-44ec-b4f0-43f0ef4d9d3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066509, "uuid": "87eef7b2-f336-4ea3-a4ce-b7486d68a853", "value": "790bef4e5600628de41967e51bbe809a19b5c1a562fa93c5d67a062e753f442e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d8cc6d-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084567, "uuid": "b7b98ac8-d447-4809-97f9-cb0864d640c3", "comment": "Malware payload", "value": "c0d0abbbf5366d990df68ccfae230581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084567, "uuid": "341aad67-ac5b-48fa-9dfc-3b4f3eceb959", "comment": "Malware payload", "value": "796d0876bf7716fb9dde5948724fa3894b6012cced63c861438fe2971e48387a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084567, "uuid": "b1a6e4c0-3302-431b-9dd9-2661bc58b3e8", "comment": "Malware payload", "value": "dc4b8c516caed96571455de5c190cf91ef3a7efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084567, "uuid": "07b0fdd2-a238-40b9-b582-3af30f43f87b", "comment": "Malware payload", "value": "6063e19aaec70601c6c224d529d5b12efcceb3fd5fe562ce0b43960e9d16fcddb3587b23dd8a3313c94c0db612d4ab5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084567, "uuid": "be739803-427f-488d-8d47-e27eeb5cfa18", "value": "T1D3834901F350C439F0F700BECBB54B7A9EB86E10636850DB9BD815AA9B71AC1B6B1357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084567, "uuid": "a9f52df2-3b42-4cc2-9242-1f20fbd0da59", "value": "3326b0ed8ca5d20f5013f8b3c04e7744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084567, "uuid": "b67ccf74-414e-43b7-b288-f27b95cbea52", "value": "768:38hVSXPY88mncMTXiNM8OeEBCPs3OLuhtjBXhEfa0kkZLEDbQnbAiaFi0o3AhRKH:3fP8mnANM8NvweiOZkMJSuAhoB2yVih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084567, "uuid": "6dda6bd3-9327-4eb2-a7c8-20b814bbde86", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084567, "uuid": "676e6889-85bc-498f-bdab-2e730f92ee5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084567, "uuid": "94eb5e90-9d47-4b51-a94a-fd93c55c6474", "value": "c0d0abbbf5366d990df68ccfae230581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5493c2-3767-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105224, "uuid": "a0be7b99-4352-4b2f-a921-02fb4bed2835", "comment": "Malware payload", "value": "03a164b9eb1c46398373be8f28b2deef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105224, "uuid": "49f8d5f1-cd8c-4c16-b43d-db6928e241e4", "comment": "Malware payload", "value": "79e2e9257117573fa0b26cc3ed90bed76088421b2d74c6d2be4559acb726988b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105224, "uuid": "cb0f70e5-12f7-46ba-be6b-18612a8f8daf", "comment": "Malware payload", "value": "a5dc85ec138cf7a25bd06927928a0037c8dba269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105224, "uuid": "f03e7309-a227-4b19-9ab5-b4c19f273b60", "comment": "Malware payload", "value": "d0f7157371a85eea7f97ecdbb5726691fd472f0804e748ca40c44ebdabce8166ba64de53d13973b512cee05b7eaa8fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105224, "uuid": "809184da-454b-443b-a3c5-221c547e30e5", "value": "T1CCF5BF45B3C46AEDD516DE399704E232C2B2B9234B76D0CB1A9AD70A1FB6D514F3EB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105224, "uuid": "4cbc1c9d-9ccb-4c16-872d-1d8809ee1210", "value": "e67641de3309fcaa8960eed45c74a35e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105224, "uuid": "907b0da4-bb06-4523-9965-d940743d1583", "value": "98304:/ic4qqp1/ZlEh8Dr2xpfenBOavde5qoF/0QuKAtVgQFqNm7khVDChx8YR9PfQ3TK:6c5A1zf2xN+FeV1WFum7FFw3TScH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105224, "uuid": "c2f63785-c485-4b22-89a1-a47726816bc8", "value": 3475968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105224, "uuid": "dbd6c3f0-d4a0-4614-8cf8-57fe1844ca83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105224, "uuid": "f43e4043-bb57-4a28-84f2-5ea68f075fb0", "value": "libpsl-5 (2).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72a4f9a-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776086128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086128, "uuid": "535b46f7-62d4-483f-9373-f36a3108822a", "comment": "Malware payload", "value": "a6851e6fc142af5bf2085b7a440a4c16", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086128, "uuid": "762d0ab7-ff69-4102-9b87-0e356ea032b2", "comment": "Malware payload", "value": "79e899486325cc57a6cae3d92b91844052d13bd190ac36fbfa4d942f10aa0ada", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086128, "uuid": "fcdbd717-c0b7-4275-ae65-ae85e690f080", "comment": "Malware payload", "value": "dbd91c1412c00b20e898e8b47372e1cbb0f8c578", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086128, "uuid": "b1cee6a3-545b-4a83-b672-a01f7558049a", "comment": "Malware payload", "value": "d568e15f9d69cca403eea96b0631f63c763f22351c6e1e33aefa9d061a3301c5d69a0a5548233d176ad0a1ed92ed0cb4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086128, "uuid": "8e43207a-83de-4ce1-98cd-62129d2b5f1c", "value": "T112C19C8027FC4613E5B28EB56A759784CBEA7C0099B2D2CC4632675C2C32B58DD15F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086128, "uuid": "eadc88cf-f049-4f0c-88b4-b37fac03111a", "value": "24:8d/BMwKDvJ51fSYg10gJFI1GRzwLSJ8+98+:8lBMVDG1HFI1wJV9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086128, "uuid": "7137e8f5-ea9b-4ee7-8f49-4d7533514819", "value": 5923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086128, "uuid": "14e2d369-080d-482a-a0e4-66206b5d793e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086128, "uuid": "f9559329-b4b2-476c-927b-df80f068d05a", "value": "Onovlenyi_dokument.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70976f26-3709-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776064910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064910, "uuid": "3d46f17b-23f5-4f85-84ed-6b4da92fb2fa", "comment": "Malware payload (ValleyRAT)", "value": "2ba4c76579a8810f4c91e95e0f493776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064910, "uuid": "6a1429ff-4016-4ce8-ba0c-3311712a57a8", "comment": "Malware payload (ValleyRAT)", "value": "7b378fa1b7ef38701aefa1fec1640403122c0c9602fa7e955965f76f85a65642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064910, "uuid": "5e9e1dda-bf20-4d98-bb17-8944135869dd", "comment": "Malware payload (ValleyRAT)", "value": "093d4ad31cf3cc07ecebf8798726fadb2e4f89d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064910, "uuid": "b7afb673-95a4-4726-bb74-94f0195c78e0", "comment": "Malware payload (ValleyRAT)", "value": "ddf83ad1881363da6cac8cedfe9b1c20f1a6bfd0311b1d43fe54417e036b4faee58775a8cd533d381b7c529de1568fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064910, "uuid": "6584a467-81f0-44b9-a017-60a4455dc098", "value": "T1A995F133B5E28933DAB640F01E181A566FBFE6320038CD5B97D86D486764DD3E61A363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064910, "uuid": "2f8fb3d2-babd-4ebf-9f9f-3fc4a9442666", "value": "1a4d4d785c58913f559c569cd4cb3c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064910, "uuid": "4a95568f-01e5-49cf-b6e8-3ce65aa53438", "value": "49152:pAR6pHImCXi45lSevpEie7zoD849aXZmMAvKfcA9AzWMUwt:pwI7Wl5Yei1oY49unRfZ+WMUwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776064910, "uuid": "e402861f-f0d0-4aa2-8fa2-f4b0138f6e78", "value": 2030271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776064910, "uuid": "890bb85f-79d5-452d-92ef-59ba118f9455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064910, "uuid": "4da7f198-535b-4896-b4a2-eb1c164b1d73", "value": "6d079502227f8c1153f100647229ebdc6f98173d1e6d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee989d0-373e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776087832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087832, "uuid": "794e190d-dbb0-4d9c-a9de-2b1bd18f3538", "comment": "Malware payload", "value": "52779a070f5c3559bd4fe9fb6bf9589e", "object_relation": "md5", "Tag": [ { "name": "DRM", "colour": "#87254E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DRM", "colour": "#D0DE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087832, "uuid": "b7d43172-53a9-44a2-9e05-b187c3df7fbc", "comment": "Malware payload", "value": "7bef20308aa9c462faaf6baf088af0d2540ad67cd2181c5e221e5d7df84cf8de", "object_relation": "sha256", "Tag": [ { "name": "DRM", "colour": "#87254E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DRM", "colour": "#D0DE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087832, "uuid": "9a4826c7-378a-49d7-8d66-46ebadba57fe", "comment": "Malware payload", "value": "21df53212815cceb4f1b52e9c3a1d28c8a0f2a85", "object_relation": "sha1", "Tag": [ { "name": "DRM", "colour": "#87254E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DRM", "colour": "#D0DE80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087832, "uuid": "b0c7b555-dd34-4cc0-9b25-a269014cf73b", "comment": "Malware payload", "value": "5957d59637985303b4601b552678c4ffea76b1a8b4af088c789c2eee1bd6765a64f0b378702dc3d4ef5d0d3e13847fd1", "object_relation": "sha3-384", "Tag": [ { "name": "DRM", "colour": "#87254E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DRM", "colour": "#D0DE80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087832, "uuid": "72e2c49f-c746-4a08-ac3b-d2759a27ffaa", "value": "T1B80833A3B9C24178C2A70A7F9C3B670BE229AE26871451CB77F87E095A352D3717D143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087832, "uuid": "9c249a4b-c548-4c20-8f59-f06178fdbf5a", "value": "0c89c5473c82ba419db4deb4bf96dfd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087832, "uuid": "22f7fb1e-7809-4b3c-92eb-ab2b245626c1", "value": "1572864:tO3j/Og7AuBjPN/tTnU7gTpjUGSkAHX0CyIkI6urOqIguzsTtn90I9n0HM4rC4P/:tOjO+Pll/27ZGSkAHXcI9xrbIfzs59vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087832, "uuid": "0b027188-d1c5-4914-bd37-acc9b0a65fe6", "value": 82824332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087832, "uuid": "2ead40d6-cd39-4069-b42e-10113de08ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087832, "uuid": "70048dcc-26d5-44ad-a9da-526a96eade4c", "value": "2014\u54a8\u8be2-\u9879\u76ee\u51b3\u7b56\u5206\u6790\u4e0e\u8bc4\u4ef7-\u51b2\u523a\u73ed \u7b2c1\u8bb2\uff1a\u7b2c\u4e00\u7ae0\u6982\u8bba(\u4e00)\uff082014\u5e74\u65b0\u7248\uff09.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ab7f7f-3758-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099060, "uuid": "30337631-e1b0-4fbf-bffc-1cdd4a03f5c4", "comment": "Malware payload (Mirai)", "value": "152f02dc47aeb9a811ceab156bbd4c69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099060, "uuid": "fca92687-f5ff-4648-bb93-c4276179eb5f", "comment": "Malware payload (Mirai)", "value": "7dccdf258cbb57cea1b152bd977bb577077a074f1ead88f40b6ebb47da08806c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099060, "uuid": "80483500-4a3e-42a7-8c53-11f3625963b8", "comment": "Malware payload (Mirai)", "value": "724190168a91f103c0547e49723a642def418eac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099060, "uuid": "c3982963-f24d-406c-bb16-df1e044b4961", "comment": "Malware payload (Mirai)", "value": "2b358e68aee9fd16824029c3015c836cfb8b61de36a1bfa39ce149eb9665d4a9f40355e170356b13da32002387a9722b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099060, "uuid": "6f387ca1-059b-4d31-85a3-6aaf0aac26b7", "value": "T1A8E30A46B8819B12D5D111BEFE1E128E33231B7CE2DE72029D246F657B8A97F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099060, "uuid": "12ca2c34-73a2-424a-9f3e-d619c669d046", "value": "3072:vCfECwUu0jbPXiFU5qXa0em+tcmDY8ij:vCsCw5yPXOU5waAkDY8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099060, "uuid": "7d27176f-5472-4ee7-892d-8f296f0ccc8e", "value": 143708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099060, "uuid": "867e6b54-f29a-4431-bf4a-75852b35f7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099060, "uuid": "b24c5fb3-f61b-4688-918a-b1c5d8648815", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c8c283-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085857, "uuid": "26418ae5-a828-4ee1-9897-87593dbda58e", "comment": "Malware payload", "value": "e5a1b79493da38e8c073db1bfe210527", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085857, "uuid": "b99a0167-a209-48dd-8074-39a405580c43", "comment": "Malware payload", "value": "7e2bcec1b56352e0925ab7a60607dffed158c6f059d76482f1dcd800f9728f12", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085857, "uuid": "839a05e8-1e70-4b00-aad7-a9b5617aaf48", "comment": "Malware payload", "value": "c460cb7a3bdb53d306b002652e7bbc9649f0061a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085857, "uuid": "3077ac84-4299-4e5d-8f18-4e7e46d96c4e", "comment": "Malware payload", "value": "765c5d5a50b3514666c56d6795d3e2759ea8878df498537d4446cb75122d75db9239a342ca25d442e338b443d89d8143", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085857, "uuid": "89690bf3-215c-4344-a229-dcb596ef2559", "value": "T1EC7333F2CE2D5ED7BAFACD9090313F4B96BB11A30F1A6906AD11D17056BA1B8C0D47B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085857, "uuid": "3ab041fe-6482-40ed-acef-192300d61dcc", "value": "1536:TqJTNFxXZEybma19vpbokSIo6Kwt1h8hIWWhZXFXiLYevF1nxnNTSLZI:UCm19va6o6K2Z8xnNTYZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085857, "uuid": "67981491-a6fc-4b9e-8ef9-5f9751d7591b", "value": 77958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085857, "uuid": "ff4de9bd-febd-4e15-a02d-5911a4e1287f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085857, "uuid": "1f264396-1731-487f-bf9f-d10ea1006f43", "value": "factura_G205857645Q.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848b17d8-373d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776087278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087278, "uuid": "9c60671f-7f82-4fdc-bd32-5f6fa8a10ab6", "comment": "Malware payload", "value": "9209c56b5766d04048291464b5a1081f", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21513", "colour": "#9DA8F6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087278, "uuid": "d93b09a8-717d-4a23-8424-18d64cb539c8", "comment": "Malware payload", "value": "7f9b6612138b7b47598669e6e57b417854d921b1557a4f28139cc948907cace8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21513", "colour": "#9DA8F6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087278, "uuid": "3689b057-f04a-475f-bcd5-38fd3d21e525", "comment": "Malware payload", "value": "dfdca1d7110a42f02cedb568578beba01c01e3a9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21513", "colour": "#9DA8F6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087278, "uuid": "3c3b653e-7dde-41fb-9fd2-5a945b62b21f", "comment": "Malware payload", "value": "1741b372f2b35dfb91736baea1deb63b8a66800b5b6149601e4db37caf9079510bf2cb1627bec70a776211c63732630c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21513", "colour": "#9DA8F6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087278, "uuid": "ca5e6758-3dc8-4e3c-a9fb-44f993740eb5", "value": "T1263110D4B402974DC70212BE88F98565C8FACB51430EDFD2B2E012E385746188F5F6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087278, "uuid": "cbb78a1d-c46e-457b-ae94-c51d2ab1b5f0", "value": "48:8H+cVTBeEmp0fh30Aix9BVEjzdvI5Za4tBRoKpGMK:8ecze5CfB0bfV+dvCZa0Fwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087278, "uuid": "2129b410-8a17-40f5-a2c4-25fefae0185d", "value": 1664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087278, "uuid": "c058b785-e23e-4395-a12d-a90987769bc5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087278, "uuid": "13a27a9f-5344-4172-8d67-2cf477245c23", "value": "R.LNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419a9e0d-370c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776066120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066120, "uuid": "a96da144-e038-4ef6-b951-a8f16f4a6deb", "comment": "Malware payload (RemcosRAT)", "value": "62bd1f1acc0481f683983307cb3c453a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066120, "uuid": "4c7839bc-2d7d-49e6-a2d4-ca444a8ac16c", "comment": "Malware payload (RemcosRAT)", "value": "7fc74aa31dd8efffc1ea7bf27af20fbd76f30ee09f7b821e8b0d761f4ae641c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066120, "uuid": "939c8ab6-8c70-4a62-9433-0059aeca79b8", "comment": "Malware payload (RemcosRAT)", "value": "e6b2c228d76ba897b2b36f3c872e8345e00c0b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066120, "uuid": "ac6f0fd0-5187-4506-89e8-fea1e2a9c8b1", "comment": "Malware payload (RemcosRAT)", "value": "ef191ccb94c8162a5c214cc3e804d902a38cc69e6a44222ef06c8feac68684c40f1c850ea9c110bf25d8bb4f11085bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066120, "uuid": "e653da9e-d7a7-4991-9388-8058329b76ea", "value": "T1E3F4F1897B409BB7C22547364FC787A1173DEC606B929B2B3296F35E2F7226156433C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066120, "uuid": "cb43f075-2865-41eb-bb59-ddfed9041663", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066120, "uuid": "730dcc64-75a3-47c1-a590-9139371e896b", "value": "12288:EXyWmdPEZJ7SyplVheVyeEjYmSagwO8EqLq31bwixW:EXrmdPud3VheVOYb2D5ixW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066120, "uuid": "cf83a640-5eeb-4c04-a6b0-1256cdd8282c", "value": 752616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066120, "uuid": "10532645-938a-47ca-acca-df73be9ac611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066120, "uuid": "a0711f3c-510e-42ca-9a6e-82c0f16e24c7", "value": "Jeblikkets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1622f6ee-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776085804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085804, "uuid": "a13038f0-e342-4d64-8e84-dd7faadbf21a", "comment": "Malware payload (XWorm)", "value": "1342d6eab2b43d6f496dc59ea0bf2787", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085804, "uuid": "66f89d36-397d-4eea-a8ea-66813010ed5c", "comment": "Malware payload (XWorm)", "value": "812785810e37fc1db3f026203f805e7dc79284e860b6d90412af57a9df23e521", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085804, "uuid": "068805de-197a-4fae-a9b0-444dbe3126ce", "comment": "Malware payload (XWorm)", "value": "6edefa3dc77794d17cf4b538c0fe18fee69c2fdf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085804, "uuid": "3ae5e450-94af-4454-964d-7bdb5e178484", "comment": "Malware payload (XWorm)", "value": "52a779dc2ac99fa184359857102d9c49345d813be478a203bd86fb43ef57b432a5e12c2ce9b1ed895752d54a443c21a9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085804, "uuid": "36044110-99a9-4517-af58-c50bd1a23080", "value": "T1F6D5D422B2A213E8FFD761C25991CEE8D89331523BBD3972015A9E1D7312AE5F572C34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085804, "uuid": "fceb95d8-d598-4bb2-a3f5-04e2334695bc", "value": "384:1K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K2/K25:+VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085804, "uuid": "346fe8c6-0c7d-48ff-883d-d833fcf2af45", "value": 3013659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085804, "uuid": "5f777612-330d-441c-a001-a0956e775b46", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085804, "uuid": "5c5ab365-7532-408a-a301-3e45abb72ff4", "value": "RAKBANK Inward Remittance Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b1c7a5-36e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048242, "uuid": "2aa6c4eb-f657-4939-bfad-8cad1d4b43ae", "comment": "Malware payload", "value": "73f5212225fae000f9cdb331f63b847c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048242, "uuid": "2b1440a5-51ba-41a6-aa7a-619f499a68b5", "comment": "Malware payload", "value": "816aeeb87ff5d80be69f457b0b6e350651d0dbd99857fa61dca18fbb4894f612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048242, "uuid": "facffe54-cda2-40ab-b407-13e3d7e2f989", "comment": "Malware payload", "value": "43bbeb92cf3ce017d30adef7dc4ddf937786d840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048242, "uuid": "06ae0b01-c2c5-46f3-874a-80835c01f6d9", "comment": "Malware payload", "value": "cf35c7b18247cf363404ff1e3ebb8c69bb1dcc7f11a6df692ec1849f9a4765c4756e5b14ea31af0f9fbc909b4baa572f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048242, "uuid": "f7c79928-aeca-4321-9b58-6a85263582a7", "value": "T17D730949E9516B19C6E232FFFB8E128E33535FA8E3F931118D315F6123C5A9B0A75122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048242, "uuid": "e7b54199-c93f-401a-98a5-8d441c127db8", "value": "1536:PFn2k84AVSCFniU3aXT+biuXrLVl0y9M/iRrv812gYe5uG23:Ek8XV/iU3aXT+biE/MMv812g9uG23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048242, "uuid": "fe381a2a-61a9-4945-991f-97c03defd75b", "value": 78180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048242, "uuid": "ead5b8ca-eb3c-499c-8394-efce087991da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048242, "uuid": "8421239e-dae3-49c0-801b-f7f9831ecb3d", "value": "ultron.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbc7d20-36ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776053604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053604, "uuid": "cc77dd61-6d7c-469a-9156-cf104f7dbdd5", "comment": "Malware payload", "value": "d5078770422cf79522dc932cf4c4f240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053604, "uuid": "9de7c00b-7851-441d-a4f3-8f1770951ed9", "comment": "Malware payload", "value": "820e84c81f0eadd168961c4764749ff68ba7de2aa4971a3012c87ffa9f2e8ae2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053604, "uuid": "791fa451-d993-42f1-bfa7-034321868570", "comment": "Malware payload", "value": "94e898deb7457185fc80c9f0c5cac18ebd60a524", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053604, "uuid": "adc4c7b5-2d70-4236-a5f8-9c9e7e0036a7", "comment": "Malware payload", "value": "ce0759af59a801a51497420e3b6f319d6ed02a28e6a808c23e2c89b6d0cb7aed1dfac11eb5f095f280b282e5c68e4607", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053604, "uuid": "a7c42719-91ef-49ca-93cf-f273dd23f8be", "value": "T1FAC39CABB24F1451C82607F41BCB5B9D2E3325019D2B9AE77C6E323E2A369DF58053D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053604, "uuid": "6d833d2c-f63f-4a06-9365-79c85c46200a", "value": "3072:jXGmgEjHTV5LdRlU9+WODKJDdqobEbgiC9AJDiXYPwqF:jXGNkvdRlM+9q0oInC9Axi3qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053604, "uuid": "47e0a3d7-0010-4720-9d84-b0d727c8e398", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053604, "uuid": "e840e6e0-4798-4fb0-a07a-938f3221e2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053604, "uuid": "30157e75-cbbc-4fba-8dec-573a39bdd255", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd45e446-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085682, "uuid": "1295d3d0-0310-4f47-840b-5b62260e2663", "comment": "Malware payload (PhantomStealer)", "value": "d07cd0ba8464c2b300095599313d19f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085682, "uuid": "f2707798-a648-4f55-97a4-2324b2d53391", "comment": "Malware payload (PhantomStealer)", "value": "82dc810ee6a3f5f0ed0e221f1f029e3ff4854cb138432c6d82440f4ccfe1a512", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085682, "uuid": "eec3eb68-d3d1-4bb9-bd5a-81d3c46f06cd", "comment": "Malware payload (PhantomStealer)", "value": "b9e6816d1137d4f57d07dadf6c37a9dd49f6241d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085682, "uuid": "b223940b-824c-47d6-8bd6-ac2708e0f62d", "comment": "Malware payload (PhantomStealer)", "value": "f66d37e24caf163672c562f264725da3c86e54220a05b1e89614fe6a55772067444a6afde50d6befc2fb1020a0d7e839", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085682, "uuid": "63179610-da56-4aca-8537-763272f37d6b", "value": "T19586E948D0A4A10C5CD2CF9AAA72E4F1488F796B5DCD8E73642B947C2DA7FD3941188F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085682, "uuid": "344c5866-9dad-4f8e-bfab-b91fb2b44151", "value": "196608:Hw3PhDBJV6lUMPKc0adIiXg7S/nX0flt+udNr0hVZqKEMER7FW/NBAD1sPqwGw2i:HwdBDfXatn/nX0flT+VAMERw/e1sPqwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085682, "uuid": "b6017fc0-6606-4624-9153-cac2a6c0d28e", "value": 8211114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085682, "uuid": "70f4e4d7-93ac-493e-92d7-91fd844e2501", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085682, "uuid": "811a88e7-a353-461f-81ab-731bffd6e2a6", "value": "Cost Inquiry.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c626d5-3761-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776102609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102609, "uuid": "7cd1b1d9-8f95-4a86-85a7-f5bf16de86d7", "comment": "Malware payload (RustyStealer)", "value": "68626e1100b4f42f9c1f35868a19a46b", "object_relation": "md5", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102609, "uuid": "c2c07fc8-28dd-4fad-b080-0a933196151a", "comment": "Malware payload (RustyStealer)", "value": "838edf67ce87d02e6f743b5de6a2993a9fea65de92dc8f149027c0b759932259", "object_relation": "sha256", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102609, "uuid": "c7f7f569-8912-4492-8a73-98711bb1834e", "comment": "Malware payload (RustyStealer)", "value": "ec34bda6cb6885ef31fcb1a36535c4daf72f332c", "object_relation": "sha1", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102609, "uuid": "b697732d-a608-46d2-b3e3-d563e0f513ef", "comment": "Malware payload (RustyStealer)", "value": "aa6b07bd68c722ecc85dcef78759f7330f5cbe394794b65556d4e19d0a77f727704918124cb4260e2c284af9acc830ba", "object_relation": "sha3-384", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102609, "uuid": "e524be89-b01e-4306-8d6f-3fac86041b9d", "value": "T1C9083313F79541E8C06AC179861A5232E772B8890730BBEF67D886253F52EE01F7D798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102609, "uuid": "56567346-9a48-4140-832e-64ac585b6bb4", "value": "24b22487b5efa03e0a75d4fdf858274f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102609, "uuid": "bf1a002a-22cb-4465-983d-db69da42a3c5", "value": "1572864:nM/ad1HVXvQ4PD52vBAddG3NqM8FPAUDmIpdDD6+RXkosIm93+nw7mENykdH2R:ka3V/Q4PDAv13AMKikNXO+w72ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102609, "uuid": "9dc89bf5-40fa-491f-afa1-280388783e6b", "value": 83893480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102609, "uuid": "0249c489-5fd8-40f5-8ee5-048858f7550b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102609, "uuid": "5f9c1db1-5b57-4a10-9ad1-1594a3202164", "value": "nvsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e562be4-3722-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776075537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075537, "uuid": "217c620f-1f1a-43f6-9114-9459235b3c6c", "comment": "Malware payload", "value": "de5c74bfa0f325eb12e17b44129c89fa", "object_relation": "md5", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075537, "uuid": "f8335106-6205-4a5f-a699-27e426231fe5", "comment": "Malware payload", "value": "83d6a6306e7f1d36cd8bfc9087621133e799aa19b9672fa5661ea55100d8115e", "object_relation": "sha256", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075537, "uuid": "6936461b-2ca7-4df0-955c-f0986ffd787c", "comment": "Malware payload", "value": "a6f717d920bb23ab2d49323a53a1fee72877fa58", "object_relation": "sha1", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075537, "uuid": "8c77e6fc-7c6f-4234-b64b-0bcf35653926", "comment": "Malware payload", "value": "54e95d99db5bb0746cd65d4258d14251aa434387e93717e087c11240161ae998c9b101b9b139d55521c036bd5d00032f", "object_relation": "sha3-384", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075537, "uuid": "11130b73-e317-4b80-ac78-dcb4ab3f0810", "value": "T1B5D2EFE483E3AF8BD259A2D4401E2A26C0F47653FA33163894EE1F506D2D783E7645F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075537, "uuid": "22133ddc-5308-4c67-9c94-eefad08d32f1", "value": "768:IpiYvTZ9YqSqr9plNAWw1I5Ywahc7rO3hyFqPFkOCg:Ipi2TZ9YqSqPlNmsZrrS6qPFBCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776075537, "uuid": "e3040708-3785-4c30-850f-5224d02c0adc", "value": 30919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776075537, "uuid": "106f0389-e10f-42b6-ab15-4c42164893e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075537, "uuid": "d344da8e-2a54-4c8e-8e86-7fb03660aaee", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6f59ef-3703-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776062539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062539, "uuid": "84c1a043-1f20-4d18-9a69-e95482c41f97", "comment": "Malware payload", "value": "848e0a5953bf1ee39db0cac0ca455909", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062539, "uuid": "44cc9181-e1af-4810-a8e3-b5b632e22da6", "comment": "Malware payload", "value": "84f9ba7eedfae796b187a2d55e525f7735c00353da93825e290a9270721620a0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062539, "uuid": "8f55fe09-8ea3-4eb6-b285-70290c34561f", "comment": "Malware payload", "value": "5cfe212b1cda44d6b7ebbea7ecb0b8262632f4d8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062539, "uuid": "25ccf54f-d869-4cdf-885b-f02d5613208e", "comment": "Malware payload", "value": "7cc8c5546554ee31c4e9735329aac818c56b9ddf8b38adcb94e8ca6d1867b1655c30fffc93ee0af00fb0173e39f2d573", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062539, "uuid": "ab80c98d-b7d5-40d7-bd90-bcb339f89748", "value": "T11B210845AAFC5245B6F35F1AC2BE94A1547BB92DAE31C70C0025D24C06F2A44C8B6F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062539, "uuid": "ce6065bb-6c36-4f73-adfd-7ddd0cb25108", "value": "24:QQMlGTrl75UIyXbTZVMegjPmpiOMuZJV3wAt5eovdlA5AL:FkGHAQ7LmIJl95AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776062539, "uuid": "df8804d1-569b-450f-b252-22665bb6f8ef", "value": 1112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776062539, "uuid": "84a96f6e-12b9-4d10-9aea-e2d35e6e9f3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062539, "uuid": "26bcd976-2b9c-4f05-be8a-a3df90309da8", "value": "nAvER.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b1baee-371f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776074586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074586, "uuid": "28ba9de8-be1f-4fe1-a473-c01187b0ac09", "comment": "Malware payload", "value": "f2b30c86ae7995223fe376fbdb6341b0", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orio-js", "colour": "#612D2D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074586, "uuid": "d01d206d-3bf6-4707-b610-0c76d365d281", "comment": "Malware payload", "value": "85f32eb745bb3e290d7a4721fbef005574d02dedc2c25d0b958a379c5cf9dec8", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orio-js", "colour": "#612D2D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074586, "uuid": "b9247125-02c4-4703-9561-d61500bb0891", "comment": "Malware payload", "value": "b0e7c48c7ef3bd54d00f6e76e6b917d1862b0f02", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orio-js", "colour": "#612D2D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776074586, "uuid": "6e49990d-5877-416d-abca-79ca4f420f2e", "comment": "Malware payload", "value": "6b9be768e5661e8767b9b1d934dc258767e994de5bbabc3f91986ce24d632f90d38ac85451d112cb9d404fb5d56bc625", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orio-js", "colour": "#612D2D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074586, "uuid": "b2782046-253a-4f88-895a-d6bdd7e07d72", "value": "T10DA533006D746EBE4679273C30BB3E1C0E865FDCFC5CA467C2949C8B8E6B75116AB096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074586, "uuid": "8193300a-cfa6-4327-aea8-2e0b9671b63e", "value": "24576:23Hfpa1x1rz4zJiq+NPSaNGMWX/Z73YRW6RMgHdeXN29FpZ2AwmT8Io26021m4R9:EeEJkSVbsmIoFXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776074586, "uuid": "94015709-4b99-4936-b8c5-7beafb030b16", "value": 2064512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776074586, "uuid": "d5d7c8c6-8b07-4aed-93b5-bcf6ee86b0c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776074586, "uuid": "70ab6a85-4f2c-4117-96ea-f98153eeaecd", "value": "Orio.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8637d7-372b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079505, "uuid": "42c7429b-fb38-4864-b2d8-2faa6d5f3aaa", "comment": "Malware payload", "value": "8354223cd6198b05904337b5dff7772b", "object_relation": "md5", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079505, "uuid": "90daafa6-ba8d-41d2-ac96-745f7017c4cc", "comment": "Malware payload", "value": "8753ee2c666dd05532d1a87cab942317b143d69f1ea92345df30e5b83485ef3b", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079505, "uuid": "16c15c08-7c26-40a9-8a77-9e6067947341", "comment": "Malware payload", "value": "4876adb47f26e3614e138856746caec156e31f94", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079505, "uuid": "471ee779-09d1-451b-8f4e-a2693a1a3be0", "comment": "Malware payload", "value": "5c7d3ff2b9afc2110f33b9b37a5d815c039de18a6b1f8c9879f7dfcd8b55d2eb24c1ce56497f746ac9a5afb3d7faabd6", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079505, "uuid": "a5d898b2-89e7-4e01-b1ca-9c477026da83", "value": "T14AE4291BE6928AFDC46BC234C3969772BA30F45A5128B70F1EA8C7127E25D608F5F354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079505, "uuid": "98d4dd95-04fd-4796-af64-a70096479317", "value": "a5d37f77665986a642378fe387894223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079505, "uuid": "4568198a-59f4-4678-b70d-267ff5692957", "value": "12288:H2odGmZ9oMGyDAM8ZnA/jz5R4W3XkUrO6m0EnHRf:HTgmZ9o9yMM4NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079505, "uuid": "1e094c5b-9962-4890-8cdf-4968f35f55cb", "value": 707232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079505, "uuid": "cd238ad0-d30a-49d4-9f95-7111324da92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079505, "uuid": "bc5507d3-d691-40c9-9620-5d4b10c0e4d1", "value": "8753ee2c666dd05532d1a87cab942317b143d69f1ea92345df30e5b83485ef3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52491868-373d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776087193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087193, "uuid": "fd98f98b-af81-42de-9857-f8e354f9c049", "comment": "Malware payload (Mirai)", "value": "5e8205a52683e22fdae8a16f332e0112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087193, "uuid": "2be7ab34-5f4e-4c81-9006-a8c12efd3bd3", "comment": "Malware payload (Mirai)", "value": "883bb05d52d71a8e7cf50aa19760c8f9766aa5f5386b01b31708581138a313de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087193, "uuid": "8b288da7-4580-4278-a9bf-26e4c409f5e8", "comment": "Malware payload (Mirai)", "value": "b37c857eb4281b70937ffe884333dffcc88ebfe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087193, "uuid": "f9157273-d22a-4ee4-8c54-41e16ef1e555", "comment": "Malware payload (Mirai)", "value": "337f8da4b67eec60b13f8f65216a1d85877b950193554974a48100f878fd5078d98442d1027c06369f250dfa9135019c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087193, "uuid": "59889cff-251b-4efd-985d-1d143aa12de9", "value": "T1F6C32C45FC404B23CAD612BBFB5E428D772A17A9D3EE720399256F25378785B0E37202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087193, "uuid": "e532b1aa-0a00-47ea-bf57-171337d444b9", "value": "1536:p6POsPG51alMEu9ZOJXWnA8q44VX1uTJm/l/UsqVAO3dI1yfxWdI9cTlnDwywyYj:gPOdhrvOFWnd4nuFal/UhvRZWG9XWyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087193, "uuid": "205fda70-4d27-4289-99ae-24d8b5b6b03d", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087193, "uuid": "7ccd7636-3532-4246-b9e9-5a64d11c8032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087193, "uuid": "438b2f65-a620-4737-b2cf-e879897af473", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb36860-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "e09ec322-df07-4350-b92e-372c9ba49c0a", "comment": "Malware payload (AgentTesla)", "value": "3db8a62a930efde573401e60109ddad7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "6e6bc0c7-adb5-4ae3-9e06-beabdef3c53f", "comment": "Malware payload (AgentTesla)", "value": "8a115a360f3bd26e771f3510eb29a05772fcc78685f6167d9ae6392e79e9565c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "71def459-070c-4bfd-99d7-a3a15e1c4c17", "comment": "Malware payload (AgentTesla)", "value": "3443c3ca6e18da6cf09ccf79732c6b0eeb428310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085842, "uuid": "b0b3adf1-4623-493d-8e75-7ad98aeb524e", "comment": "Malware payload (AgentTesla)", "value": "3351ad2313cca7919172432c0733abf8e8e52b33106a9c4bccb0a70ae3f5aef1f5765f5a489df0e1856510e52c848541", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "e852a7c9-6a4b-474d-8fb7-71b6c7da5f07", "value": "T15E82B91A8A05DFF00A7F3261B95BA816AA110363A538384DBD8FC59D3F39A50CFD15ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "1446f16b-f54e-410e-8afb-a79e44ee4656", "value": "384:KeTTDSJ2wZohEyUO/IjZaChlZrBbMy5DAjEM6g2tr2A0FTrc:KeDK2wZvLPoYpZb5tKA0FTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085842, "uuid": "93bf9fa9-59a3-42cd-84e7-175fb4ab63ea", "value": 17669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085842, "uuid": "ab40135a-c1f9-40f1-934c-6347bcafb690", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085842, "uuid": "65cd72cc-c035-4e78-a952-d0430c7953f2", "value": "Bookings_134.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d3d5e7-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084543, "uuid": "e50fb84a-bcb4-4499-9fad-56e4397f4123", "comment": "Malware payload", "value": "bcf130a7614b35db3996e7ef20c2ac4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084543, "uuid": "d2a615f1-c70d-4e4f-a0be-0895186bc7b4", "comment": "Malware payload", "value": "8a16b650ef90564d4f895c1e39a1b124a86e8d0d9203558507951b6b2ecdef65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084543, "uuid": "75013193-6d09-4f7b-a5c1-1255382a1c9c", "comment": "Malware payload", "value": "6853fffc5565a80651c1736ea62d2bee59763b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084543, "uuid": "58fe2e2a-9736-401d-ad1f-82068b949b01", "comment": "Malware payload", "value": "6e67213c9420b09af841a0eceb564f0f94e0533c3c77931980816397290a74c2ab932b445ffc296013bbde19dc751291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084543, "uuid": "9b6aa895-cb09-4aee-9464-39021c803d85", "value": "T17E835A01F250C035F0F700BACBB54B7A9EB86F115B6860DB53D815EA9B71AD1BA3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084543, "uuid": "2449ab39-a229-449d-b388-8ceec5d969fd", "value": "3326b0ed8ca5d20f5013f8b3c04e7744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084543, "uuid": "a8e3800f-7e15-48ac-8137-da1277dcd579", "value": "1536:vpG8aHiINM8GQBBhKbwkTCyxuAhoB2ygRV:vph5vQ/Ub2YsB2ygRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084543, "uuid": "71a5459d-2691-4fc2-a6b5-a75d2b546b10", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084543, "uuid": "58c4cdfc-de17-4827-8f39-b64b86faa745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084543, "uuid": "9cc311d4-d5fd-4e37-896d-83f7c4b55b78", "value": "bcf130a7614b35db3996e7ef20c2ac4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed4de11-36ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776053606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053606, "uuid": "a9490844-bca9-4d9c-bdd3-3a52761b931d", "comment": "Malware payload (Mirai)", "value": "8e633a883b4f82ab51e91f8040287d29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053606, "uuid": "95c3ef86-0f9d-40b7-896a-b688ad8f5fae", "comment": "Malware payload (Mirai)", "value": "8b6fd1c8b2d3f289ee3589630ac87896a4377ce4e018cfc936dea57373df33ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053606, "uuid": "67351743-ad40-49a7-952a-2faebd5cdbd1", "comment": "Malware payload (Mirai)", "value": "cb91d201790d792a73895e8e0bbb0590c57b7664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053606, "uuid": "ea979583-9f34-4b45-b14e-c6f7fda53680", "comment": "Malware payload (Mirai)", "value": "f8d11268f49880659e7acc1665465928851d532876d44bf35c6e73e828650ee3bfec4dd46aaa3e0e080c5373ea05a3ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053606, "uuid": "c4bbfd37-97ee-466c-9329-f02afc04110a", "value": "T188447C13BF094EFEC16D8AB94ADB53208B23F4390B26A78F7754BCA42F465D45CD5A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053606, "uuid": "219672ff-9e58-48d1-a08f-3a55563962bd", "value": "6144:yxfcExsnB81zv0uz2Kp/dG8jLMVZVhePVrp:yiB81Muz2UTjLMVZVhePVrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053606, "uuid": "23d921de-0d4d-4a0b-9383-18fc32fa63c3", "value": 256121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053606, "uuid": "3c67c3e1-a69b-4c1b-91d0-6e1747229a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053606, "uuid": "3868a734-a36b-41f5-bd42-cc7c6592d0f0", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea0c5f8-36d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776041312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776041312, "uuid": "4b12dfa3-adbc-43a8-a90a-93a6c82fdeb3", "comment": "Malware payload", "value": "b26707c129e221c22aafbd951048283f", "object_relation": "md5", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776041312, "uuid": "f8a30886-d3cf-407b-9b11-c6ae1f04d9c4", "comment": "Malware payload", "value": "8b70eb599bcf04bfc858b79f6e3977a7829fa3cce80367a7eec1597c8e34aad4", "object_relation": "sha256", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776041312, "uuid": "3da4429d-af00-43e2-bb52-f29f6aff8d19", "comment": "Malware payload", "value": "3ad04b3ffb5e145983b1617e40247b1bd5c97278", "object_relation": "sha1", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776041312, "uuid": "44a0f584-4e91-4dff-867a-fa5b3ca388a7", "comment": "Malware payload", "value": "0edc639c91ceae5c1bbe97a70662e8d675333e0cbd1e83dd7a44330522c94c5f3774f6379f63e7d01e8c4dc95a3060dc", "object_relation": "sha3-384", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776041312, "uuid": "48f0007b-378a-4cf4-8aa8-73e96114b7c3", "value": "T1B3256C22B200A63DD59D093DD27E6B715D7EA7A224D1DC48AFF44A4DEF79181223E20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776041312, "uuid": "2830b75e-670b-4789-a004-e975b193828b", "value": "210b4db7b6c066ddf11bc4b7a4fc6f80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776041312, "uuid": "34daaf80-6f0e-4495-a4e9-26ee9b1e055c", "value": "12288:JtJB/OkUDWvOEgq2Zc0+z5sJi4TlqJOiZc/R:tB/wqrIZc0+yJXlqqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776041312, "uuid": "7507e273-2edd-46c9-8d3a-4a5ea21ca141", "value": 1034804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776041312, "uuid": "9b4e4f1c-5d95-44e4-b874-4779e917fa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776041312, "uuid": "7d0f9bc8-aaee-49ca-b91c-ef7572b2a61f", "value": "avutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c12090-3719-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776071798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776071798, "uuid": "b84d45eb-bb52-47b6-ad24-9337b56ed372", "comment": "Malware payload", "value": "356ea867f54203c4e477e199bbeaf4f8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776071798, "uuid": "b4bf9583-282e-4af0-bf62-d259e8762d5a", "comment": "Malware payload", "value": "8c3dd9b25610f4b910ec4c89fb51f7f5aaceadf36556ba7e8376c2c16f6aa364", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776071798, "uuid": "92090daf-21c2-4133-8f00-7049edfd9a43", "comment": "Malware payload", "value": "2d45ed371825c41c2edaa9cb5bad976da40d8e29", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776071798, "uuid": "0a4f575f-cb23-4140-ad60-e5cba6319655", "comment": "Malware payload", "value": "39a6d36eaf2ce088a6dd855a3a48206c075e331695d015b7235ac4da2bcc284114fb487715402214da79acf89ad9567d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776071798, "uuid": "53b918cf-515c-4c85-a3fa-c71adfda2c29", "value": "T123D50A016380B364B96CEE9F1ADF3AA74C00D79C9487CFDACA574B91359B3AD604ADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776071798, "uuid": "be1e07aa-775a-417c-8a05-03865ad1a35d", "value": "96:/P+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+8+0:bd1xXGIcVvPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776071798, "uuid": "a72cb32d-a7f5-4772-b824-a24a4e3766c0", "value": 2793063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776071798, "uuid": "128f93a9-17ce-4b8d-8663-0159104ec5e8", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776071798, "uuid": "ee8d6f98-4932-49c8-9bb5-6f173555ca3a", "value": "purchase_order_xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92da7a0-378d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776121699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121699, "uuid": "5864a11e-320b-415d-b45a-5d15d0e06704", "comment": "Malware payload", "value": "a0c946fefa3d7dace9334d587241b07b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121699, "uuid": "6a14c63b-bede-474a-9b7f-99f48c8f2375", "comment": "Malware payload", "value": "8c4ca84ad85c9c8e381959ca69c9d828a8c5e3980dd94a6be9e6d6139ef4ce04", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121699, "uuid": "49b53c8d-64eb-46e1-985d-233a0818e94d", "comment": "Malware payload", "value": "f92c2fad7e37eac1440e82c9f6e1be433087c812", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121699, "uuid": "78000518-fbe7-4653-8e20-e9539ccdc913", "comment": "Malware payload", "value": "6cf52124385ade2a8234d18b7df6496a494c07beb0396bd1874b3f7292843479f7c46b809da487920201bb6066726471", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121699, "uuid": "62f260fe-dfa5-4091-a9c5-c8c72e5ad04f", "value": "T19F136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121699, "uuid": "2566a3ca-31ae-45ec-9d47-5fa3ef1e9d9a", "value": "768:bSNs9NyXsZztCh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bSSHusZfcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776121699, "uuid": "942bb31e-9db0-4e24-af8f-5dea04bbfac5", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776121699, "uuid": "4d67019f-5404-4b1f-aead-aba82ba47186", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121699, "uuid": "f78cbf61-65cf-45ae-a350-5c794b54602c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e362b15-3761-11f1-a769-42010a9c0008", "comment": "Malware payload (AteraAgent)", "timestamp": 1776102783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102783, "uuid": "68bda462-755f-4e12-b617-d41cc4fdaa86", "comment": "Malware payload (AteraAgent)", "value": "e3390145d852943cf76be1bdee19524f", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102783, "uuid": "079415bf-4fdd-42ec-b71e-30e5c3b1dbb7", "comment": "Malware payload (AteraAgent)", "value": "8c586cec56193cd231e57fbf33318636012bbb3d1c10614b31dede27a4d075e4", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102783, "uuid": "1c60e932-1b63-427a-8504-b0294df58739", "comment": "Malware payload (AteraAgent)", "value": "3a3a19f0dc83403278850436960433490123447b", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102783, "uuid": "08bf3b79-e9ba-4a29-9d02-ad96749dd3e9", "comment": "Malware payload (AteraAgent)", "value": "5c975117f0509f280d1069c49829dea1e437141663bf9b1cb9736dc215fbe2493d2b6e1b3717f17dd7cd67b691900bc6", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102783, "uuid": "bff3e5ab-70f2-4ad0-8825-5276b7b33f2a", "value": "T183862329B7E008BAE9778332C5678626EFB6BC5A3320D59E0764711E4F3B71025BB701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102783, "uuid": "5ab81216-be0b-4b14-b746-b0f1f0b29a2a", "value": "196608:SW3VtmpoYvM7BG6qySBhtBv/SrDTv1XuYdcVA7:nHmpb07BuBlKrDBXuUV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102783, "uuid": "a10cd1a1-8e6e-469b-a87c-963bcc7bc9ca", "value": 8601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102783, "uuid": "7d69b5bd-431f-4470-b910-a4bd25a8ac57", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102783, "uuid": "69a12208-bdca-4449-8ee1-3ffaa2ff8a3e", "value": "EVENT_RSVP_Unassigned.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c2057-376b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776106885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776106885, "uuid": "16b70546-de28-4be0-be8f-13b3b29dd2ea", "comment": "Malware payload", "value": "ff4f83c07f438e7bca5ae2edebfc330f", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776106885, "uuid": "9490ee2c-7b77-4551-a174-73a8e79aca61", "comment": "Malware payload", "value": "8c9bd82cd489bb95827d3653ae3cfa3ab9879a35e16ef47855265c333198d09f", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776106885, "uuid": "7012e18d-93eb-45dc-8de0-861b695c1b6b", "comment": "Malware payload", "value": "913bf35953a9b5c6f2deb318eb843efc8a82f981", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776106885, "uuid": "e21cf88b-656d-40f2-b8f4-a0add50adceb", "comment": "Malware payload", "value": "7aeab8addb90a000297960593db52c2d09e599e8d946176109916c5a1d9602e5f25add414ba6f8309442434b2746df01", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776106885, "uuid": "052eaeed-440b-4011-89d7-0db69a5991ba", "value": "T119823510B2FC5225E1B3DE7999205754DBB77912AAB2C3CC0762357C2D71F948E12B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776106885, "uuid": "314a8cf9-1438-4486-91f9-6040a01108d0", "value": "96:Pz3t10Uy2x/5qw1QHmHcKLs1pVAtWw+L5xT:7cUjx2GJ+8qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776106885, "uuid": "3eeb3be6-0e61-4496-b595-329f7a4992c0", "value": 18691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776106885, "uuid": "dd753d99-02fc-40c4-a778-fd4cf8e56ac3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776106885, "uuid": "cb3035ea-8d65-4474-a250-d1979e81e998", "value": "Dodatok.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f41233f-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043460, "uuid": "eb33b8a0-6096-472e-9b7e-2d2240c59c67", "comment": "Malware payload (Mirai)", "value": "108720f8faad0e13c4e13cdc78ef246e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043460, "uuid": "f64ff66e-71cb-4767-87cd-b41b365e1831", "comment": "Malware payload (Mirai)", "value": "8d40dbcb96e39caa76882ec4a890f5a1184c18faf3f802ba45834dbe674ebb6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043460, "uuid": "fa258829-a226-4be6-9b57-bb4328f61f0d", "comment": "Malware payload (Mirai)", "value": "2975882b05d3c1e094f7a261310f482a4702447a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043460, "uuid": "58c1e58b-cee8-476d-91a3-bbc9990035ac", "comment": "Malware payload (Mirai)", "value": "23dc8178a789cff94f11d28190d9cbc57b758ba0029c573242df10d48eaa39baca80bdc65c9a62e8657c8b033ddd6308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043460, "uuid": "0e2b11bd-52a6-4a5a-9205-1cc7fdf814fa", "value": "T1AC931A45B393C8B0D84315B201BBFB3A9A34FD320134EA6AD764FEF299229D5614273D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043460, "uuid": "8ac2db38-fcb7-48e3-ae90-d8e0eec61dec", "value": "1536:wYgade5tYASqzDd5t1iC1SbYlDYIhfdpa/Uu31ZXzVyDdXr:dA7FtExYlDYo+rXxcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043460, "uuid": "54a49ac7-8aac-4474-bad5-392be48fdb3f", "value": 91516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043460, "uuid": "92c314d6-d492-4989-be4e-953a91a92e0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043460, "uuid": "b3556a65-e23f-42fe-ad31-1bb5e26f1f47", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1ac6d-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085481, "uuid": "bb9dcaf9-a1d3-4b79-9e94-8a085633501d", "comment": "Malware payload", "value": "07e78d05790b66c2b2506d3915c233e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085481, "uuid": "73c4c4c7-35f1-43b8-8e75-2cd15f00b220", "comment": "Malware payload", "value": "8d9d7d9f49cd51e8046b39da4185559dbc5c4b5474ff1387c8150d1c5b23aabe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085481, "uuid": "b630c00d-d28e-41fa-b426-2f9bb2dbdb1e", "comment": "Malware payload", "value": "d51f05a4aa8287b700a161cb20450cc2771b6007", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085481, "uuid": "b23c1f1d-d2f3-4a52-9bfa-9018001303d3", "comment": "Malware payload", "value": "0fd59273a2f3928c42e74389b9e7aee3ca285622a83d69285e3c2d0d961b64a05b9ee3f5bf76473d281759b96c101f26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085481, "uuid": "c11fecb2-93f4-4991-8e93-2b4e823a756e", "value": "T1AEB42D38ADEA001AB173EE54AFD47497E92FB773370E585D1081038A4723949EED963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085481, "uuid": "6de6742f-5649-4c17-be2b-4006a64cfdca", "value": "12288:pD/p8NYLgik/6Dm5imUx4Gdq+sJ0Mk+wDBR5wa8ul2mz:Mo9h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085481, "uuid": "ea768a70-6491-4157-8296-bebac1b374a7", "value": 505330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085481, "uuid": "8cb9da10-a46f-49c3-90ab-e4497125f627", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085481, "uuid": "cd484f13-914e-45fc-bf57-9574a048dc9d", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0424d37-3742-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776089525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089525, "uuid": "96c7b34c-1974-4e95-ab4a-41bbb4bfb7db", "comment": "Malware payload", "value": "fef30d8d09c89df11af02e6ba4d0b796", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FileRepMalware", "colour": "#38A1A6", "exportable": true, "hide_tag": false }, { "name": "pdfplugout.com", "colour": "#375130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089525, "uuid": "0b231049-f9ac-43c6-a629-c6f98bb660cd", "comment": "Malware payload", "value": "9035cfd2ef199dbec556dcefe468f4a901fd4c9c1777febf582b5a140c3113e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FileRepMalware", "colour": "#38A1A6", "exportable": true, "hide_tag": false }, { "name": "pdfplugout.com", "colour": "#375130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089525, "uuid": "613b98e2-4a1e-46a0-9e33-c1f31e8d4fe6", "comment": "Malware payload", "value": "cf19a56afebb50d5a838ee1e5d1109ee604e2b6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FileRepMalware", "colour": "#38A1A6", "exportable": true, "hide_tag": false }, { "name": "pdfplugout.com", "colour": "#375130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089525, "uuid": "163e0090-e1df-4846-b5dd-6f7197c9971e", "comment": "Malware payload", "value": "47390820c75b67e10b8c5282d7c8c893b41e07daeb7550c6762d97fafecd886aabf69c0b89d304bd758f31cd4b521302", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FileRepMalware", "colour": "#38A1A6", "exportable": true, "hide_tag": false }, { "name": "pdfplugout.com", "colour": "#375130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089525, "uuid": "435ccf81-d57a-4730-829a-811180b5bd07", "value": "T17C934900B1D1C175D9BE18351828DAB59B3EB910DFE0EDEB379506AE4F302C1EE35A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089525, "uuid": "80f43fe8-b7b3-4d1b-98b4-77d570105927", "value": "240bf396dc08fdac0351a3dbd1d9b0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089525, "uuid": "d9270950-1671-4771-af43-2903cd7ea63b", "value": "1536:NIkKpaMrH+D0UWs3mhzE2kN/M+r6NDQQOPCb0C2jxgDkF7sWscdw19YF07W:NypaM5Ud3mGN/ZuEQOPCuFmkhw19YF06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776089525, "uuid": "634a5167-390f-4523-a4e6-92ec6edb251f", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776089525, "uuid": "0278e33f-8573-441c-9da1-2a98597f6022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089525, "uuid": "d66d27c8-4c52-4ef1-bfc6-6d1fd9e87c92", "value": "t.G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c236cfd4-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776085663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085663, "uuid": "3bddf6d7-8fbd-4221-8c1f-cd82ff7f0e97", "comment": "Malware payload (Formbook)", "value": "6544b7612dda18ed7a166dd1cb19afae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085663, "uuid": "1e9bf6ea-5ae8-41b6-ac67-e1b37c6471ad", "comment": "Malware payload (Formbook)", "value": "9297af5f66486d11540f15b44d4b6beec6ff89dbc4dcdee898db9a7daaa76085", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085663, "uuid": "b46aa431-5277-478a-bb38-0a94a4a102c4", "comment": "Malware payload (Formbook)", "value": "0bf8ad181ea323f87972c4d6e70baf0ef2f743e0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085663, "uuid": "b005bfe6-3a38-4840-827b-750d8f16f97e", "comment": "Malware payload (Formbook)", "value": "50135b659932d02a5e9ea1c0885f64d7b4b8dafb23fd1b6a1f0690bc743c351bb8167294cdacd49f141bb5204db2f3db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085663, "uuid": "6fb13817-e4de-4081-8dfd-caf8112969d3", "value": "T10BA502119AC43FB5CFAC671980FE1A0EA3E00A8A5016798DFB73BD46BF9B604511B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085663, "uuid": "d739c908-3f8b-44ac-8598-afe17d1fef06", "value": "24576:BMnX+tsSjS6UFsQbf2Z+2UZZvBMdcMVRPEro4Er8LplgxKbSj5Tgh2zgjhdedFs3:fS9yU6+ZBk3RPkykpVbS9Tgge663", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085663, "uuid": "33344e09-64fa-4f43-88b7-6246a02529b3", "value": 2064350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085663, "uuid": "8f1358e9-d188-4dbc-90ce-d61776c71a79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085663, "uuid": "d14b4d65-833c-4769-82d2-ab64f7c34459", "value": "RQ-401-26-000033_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b42a561-3737-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1776084712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084712, "uuid": "462d45ae-4942-41be-b7bc-d19f24c99d8d", "comment": "Malware payload (SVCStealer)", "value": "a73290853171bdd1abf58ed5a27024dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084712, "uuid": "34b6f350-6142-463a-8914-f009533d0c0d", "comment": "Malware payload (SVCStealer)", "value": "9372b977f945b3024129c560096bf216c573dd673cd3564ada3f814a903146a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084712, "uuid": "5a9d4749-80f0-4f7d-9d36-c8761bb03b3a", "comment": "Malware payload (SVCStealer)", "value": "4c3e7260280e81c94babe2d9dbe4d932490238d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084712, "uuid": "e3f8bf61-a97f-4845-b868-84facb154432", "comment": "Malware payload (SVCStealer)", "value": "b1d6c4e9d02c2d34c2a4c52c6d17a4b1ba83118c43d7db3d761bd2c28494c9bdfb164ddf2ec28b7fddb1c86e9d786853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084712, "uuid": "8cddf392-2beb-4b73-8655-a1021c880c6b", "value": "T11A96339502E145E7F4B7F23E1AA26196D273B8102722C5DF1BA483AE2E5B3F14D36F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084712, "uuid": "b0b73589-1261-4cf5-bb36-5e888ddd82f2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084712, "uuid": "37f25116-8924-44a1-bd6b-14b46f57551e", "value": "196608:GrGtbW897G+x7eovq5XMP6PzFcx97WZHsoqEbRjMFb:N1Fdq1B7wgZHsoqEbpib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084712, "uuid": "ec5486d9-11f3-4d7c-989b-26e9fce9b719", "value": 9388313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084712, "uuid": "4b99df4f-f26f-41ca-bc95-7a4a443b80e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084712, "uuid": "009a4a77-2818-44b2-82ca-1d781174c3d9", "value": "zx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8ac88b-36f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776054674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054674, "uuid": "df7694e1-0429-4092-ba37-5713b7dec2e1", "comment": "Malware payload (Mirai)", "value": "f69220d3128245fa542e2a1382fc057f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054674, "uuid": "e0e43f6b-9aca-422c-b793-9a639dd8cc8e", "comment": "Malware payload (Mirai)", "value": "93ceb6a107f83af0d2b252640e41369c1aee5bd4f93c18ba246e9d365dcb4081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054674, "uuid": "d10e71de-1590-41c1-bbc8-2c95362bd80e", "comment": "Malware payload (Mirai)", "value": "4865c4fb1b48cd393736619bff5bd1f9d59ca7f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776054674, "uuid": "4c2a4b69-c75d-485c-a181-96ceb3ad3fae", "comment": "Malware payload (Mirai)", "value": "14071ce14dcb98df6d7a03461096a0bea81630c33ce0cfbc3aa349bc959752743e416623b3a33cec29d2b53e967deda8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054674, "uuid": "8c68bdef-bd3b-4741-9f68-37245328a81f", "value": "T159C30956F8819B12D5D151BAFE0E124E77131B3CE2DE7312AD246B307B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054674, "uuid": "83bc9780-a875-4434-9070-727caca809c1", "value": "3072:tIkKYKu/fXKqhawotDDVThSYV3ppZctiYjjlC:tI1pEXVaRtDrSYVfciYvlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776054674, "uuid": "728492da-d663-4ae7-94b9-e5ca7bd277c0", "value": 129308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776054674, "uuid": "b8bf13af-a5fd-4b44-9f9a-aaeaac795a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776054674, "uuid": "8733bd92-722d-430e-b289-c6ba4e99b5d4", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5ee3d9-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043482, "uuid": "5d78255e-b73d-488a-9249-7096e1b0ed8d", "comment": "Malware payload (Mirai)", "value": "f95670f0c7bf2866cf4443446a6378ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043482, "uuid": "bbcdccee-a0bd-43dc-8bbe-f72d9419632e", "comment": "Malware payload (Mirai)", "value": "947572a2e349ce55b942d8c2e6fabd1ca208a1893d7c718d2193b72917b8db76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043482, "uuid": "81a7979e-7467-47ea-87af-774775975688", "comment": "Malware payload (Mirai)", "value": "c75b0df9dd1f55292200780be387d4fafc4c0f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043482, "uuid": "25f9fa7f-1f8b-4dfe-bbcf-35bac750e456", "comment": "Malware payload (Mirai)", "value": "15fee94c2a00bd5799f343b583d0e7d4d6507b5182ea433c0abf776a18a1c9848a42ce1f5e61afb947eabc039a3c7cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043482, "uuid": "cdfc5e8a-ccf7-4e61-b818-726166ea3dbe", "value": "T1FF8308B5FA878AF6D40754B001FAB63F9B31F92E4431C16AFF64AEA5CB135C12106768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043482, "uuid": "5e9859f0-335d-42fd-bc18-fb212992508e", "value": "1536:C6f8NGeJNAHLiBxfrS4Lr6HW1WS6ZhFT6mSjTMNXMQ/dg:WMejArUxfheJVT6mSvMNtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043482, "uuid": "1a87a940-e7e6-4499-a87c-b185a6bd0fc4", "value": 86296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043482, "uuid": "dbb47ebf-132a-4e3f-abd8-d85eb0a8b864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043482, "uuid": "b99b7afc-2590-4fc8-9424-3d1c59f2e937", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08986d9e-3764-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776103820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103820, "uuid": "73692a68-6904-4f37-a505-fec8357e64eb", "comment": "Malware payload", "value": "2520f9a1c31d3e0db66d13bc1e827e73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103820, "uuid": "c6c6c1a8-cc60-4e70-b10f-1752dcbf10ba", "comment": "Malware payload", "value": "94d3834175adc7704516dbbf3a0baaf89ab4d07f656a55111bcfb0fb73768f9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103820, "uuid": "126761bc-1faf-44b0-9417-d01c40eb738b", "comment": "Malware payload", "value": "33f4a8049ab0c990465df7430b1e4ba91bafeb78", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776103820, "uuid": "1cc95923-9c0a-420e-b879-047b162ff593", "comment": "Malware payload", "value": "4773040522fa57b788644d2dc0f2ebcd15f5274a1b223ae79120d0c4177f1ceb5634b3779688776fb348b303d55f0518", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103820, "uuid": "4beedff9-9125-45ed-834b-8d11e1bdf037", "value": "T139729F52DE5D2D9CEC92C84B88763ADF582972229DCC6C8204788F45F88CE19AB51FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103820, "uuid": "16f97897-33bd-43d2-9d43-d51f57312cd5", "value": "384:EVAC87UQKP/Q6izZR+26jkaslCUq+WVisnUzhptymVTGYKs:EVa7UxIXZwfxn+MisnUzPtymd5Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776103820, "uuid": "4f33af95-4ddb-4a3a-ba46-d7b48556eb31", "value": 16302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776103820, "uuid": "e0d4dda6-c5c9-4c71-9c8c-1d4071b29e97", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776103820, "uuid": "e662c334-c9d2-40dc-8794-bd36f0328cf5", "value": "security-overview (1).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ef6aac-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066532, "uuid": "581c629f-cc63-47d8-ab3f-97d11a31f8d9", "comment": "Malware payload", "value": "1cd5e339f30ffd76dba7b0c395bf2490", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066532, "uuid": "116a533b-7bbc-426a-aea4-4606d60a816c", "comment": "Malware payload", "value": "951d031c4d80a636a4689e7bef328184f12139e248512623c34bdee5e9ec2025", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066532, "uuid": "1f736e8a-d016-4812-a949-35091aa523dc", "comment": "Malware payload", "value": "df226497caf4340474ad29a469575a2e6e57bc2e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066532, "uuid": "1fbf4da4-60e8-43d5-b05b-21e767f7a361", "comment": "Malware payload", "value": "e04dd82f12a4fb46693d901007982e24e39bd56e4448df2b59d91b3c35a612ac2156175c5dc954b95973f5db45287e4d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066532, "uuid": "6fa1ff84-34c2-4711-a49b-6566d0b3731b", "value": "T14BC27C617E94E1B85BCF731B77B4F8924538BBB2908D690C61DE84D227DCAD0B63C192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066532, "uuid": "7c79830f-fa0a-4015-b91b-16cfa9d9e6d5", "value": "384:73ClEXYLh2iexnsHXk8kE89OGQR1izmOHfYuB/44a1qQf29spdG5ddbIy0Y:OCod2iYdROJA/Dg4shoXdbp0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066532, "uuid": "69e150a7-15d7-475c-acc4-7889ba2e528f", "value": 27195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066532, "uuid": "60b0bfb0-1e98-4280-8b6e-45dcb44232dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066532, "uuid": "783edf3a-66a7-43c2-854e-3b08088eb296", "value": "951d031c4d80a636a4689e7bef328184f12139e248512623c34bdee5e9ec2025.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9677c6-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085652, "uuid": "7ca82c4a-bede-4c5e-a8de-be257fde0882", "comment": "Malware payload (PhantomStealer)", "value": "25badf653746d5b3ba5ae93ebe9a226b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085652, "uuid": "57d0d132-dd58-42b9-9957-666c94de12a7", "comment": "Malware payload (PhantomStealer)", "value": "956d5427493be9155d5728c6294e5ee0a58cb2dce468b0187eae44722242aadf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085652, "uuid": "f6d0b538-a879-45f6-bd21-6dc9d49dafb2", "comment": "Malware payload (PhantomStealer)", "value": "111a1538e3f28ee4923c670974efda76632bf74d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085652, "uuid": "21c5a391-69d6-4ffd-93f1-db23a5f2a1a2", "comment": "Malware payload (PhantomStealer)", "value": "ed9cf54f4776837595ba2e76e323d37ae18343251f638242077e7b22636c90c40d1166bd66fb74c0c11325e66bb94392", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085652, "uuid": "de75faa8-b7a7-443e-a55d-b692c82ef8a8", "value": "T1A986C64CD074621D5CC2EF9FA576C4F0888E26ABAE4DC9B3A42F94791C9DF93842119F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085652, "uuid": "bcadbf4e-85b4-4419-bf68-a2fe7be822de", "value": "196608:7d0CCvaKLD71+cJuGymHZ9SQQGi1ItjEhSLcQcG+fWM3xWQeC3DdxYky9Mh1ku6:xMvaKr1+ouGymHZ95LiytjLLcFWuxWY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085652, "uuid": "43e0871b-419b-4bf7-9fad-df32c7d27ea0", "value": 8211114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085652, "uuid": "f678a3e9-41ba-4028-a5f6-69f08c99e5ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085652, "uuid": "e5b17feb-caf3-4d59-ad87-151de637b0e6", "value": "Specs_QU140426.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a01c697-371c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776073113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073113, "uuid": "c3dc1e9b-7978-45f2-a958-c069808f7fa1", "comment": "Malware payload (Formbook)", "value": "675a9f9cc365e1c272d73cb576da6016", "object_relation": "md5", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073113, "uuid": "09e57474-3f38-43fd-8fc5-8d18b3735984", "comment": "Malware payload (Formbook)", "value": "96a45b785e542792ca0e6050e847e5d3eb291734828631fe29981b12a229964e", "object_relation": "sha256", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073113, "uuid": "b8d97771-4f8d-48b7-a001-0c1833667f02", "comment": "Malware payload (Formbook)", "value": "059c2d9b14bf0ba799cbeb77923dfe34729fda1a", "object_relation": "sha1", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073113, "uuid": "88a8bb27-deb5-48a3-bddf-315c8a30383c", "comment": "Malware payload (Formbook)", "value": "5d3ce934c77a3656a6f6c94c8fe51fd81edae0f5eca6e85f40dbc8afda6eeabb80e6d7408cf1472e3015b4bc30c3e268", "object_relation": "sha3-384", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073113, "uuid": "b3b77ecf-c4c5-4123-b484-2c0dfdac0614", "value": "T15FC61B44C169943D45CFDF4DD07AC4E0988E316AAA8E9B6E14AFDA783D0AF43D6460CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073113, "uuid": "2169a553-45e5-4844-88b4-4d80a2831ddf", "value": "196608:Ipp/JMux+bEOoIAuvAmFQPIgcNa04gXlVmxGhS+KTjafSG62rtdXOYzQAOiBsBXP:4Dz+bE2AzmFuIgqa0lVm0hSjafC2rtdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776073113, "uuid": "fa283c1f-b352-4033-aeac-54a2c904152c", "value": 12452347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776073113, "uuid": "08a0a273-d5d5-409f-b4bf-8464941bee4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073113, "uuid": "a6267f57-6384-447f-96ef-8492e14a2852", "value": "Contract DT4784994.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aef44a-3759-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099225, "uuid": "bac8f4a4-045c-4bcd-81a8-ec918060dc9a", "comment": "Malware payload (Mirai)", "value": "c41b32e4dde7cafadf0674f545b8c3cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099225, "uuid": "88a5ffd5-93a7-4553-830b-31c52eddfa62", "comment": "Malware payload (Mirai)", "value": "971cbcda22b3bbf2e105b3da8f6ba57585f745faae9d7010daf471fe614af34b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099225, "uuid": "6cea532c-ca65-49cf-84fc-592aa194c216", "comment": "Malware payload (Mirai)", "value": "62eb4cb6231bce3832736196c80177dff76ce46c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099225, "uuid": "98827be0-bd7f-4842-a0bb-f4ad6fd6f16b", "comment": "Malware payload (Mirai)", "value": "994005ba3c0537853467b73fb330055166556d64dfc84ba6a93ca8d68239207066eff0a579ca1e167e02c58c4251c50c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099225, "uuid": "44124dd4-90b2-4d84-8433-a5d4f4762b5a", "value": "T1DBB43A45FC808F62CAD53ABAFB5E42A873574B79D3E671059A140B3437CB95A0F3AB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099225, "uuid": "559809d2-7f70-4b50-ac07-f376e41db03e", "value": "12288:E320mgI2wO48meYrZEm6SgxtRtATkgZVscJ8ORnZbIctObP+MdaloexMZ7Qp79BB:E320mgWehiXloeSZEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099225, "uuid": "57abe020-043d-4a05-b7ab-b51ab82f130f", "value": 541768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099225, "uuid": "56e5ea6a-ed70-4a5f-8876-c1b254332e2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099225, "uuid": "255e6c95-a4c8-40f9-bf89-72ced8b481f4", "value": "cloud.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9064c601-3728-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776078278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776078278, "uuid": "297b57b6-d208-447c-adae-31fdbf86e85d", "comment": "Malware payload (Smoke Loader)", "value": "e8730f4ba08f840d109d0c1b2d6f9c37", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776078278, "uuid": "75c384ce-4377-47a1-8d10-5579d6675dd0", "comment": "Malware payload (Smoke Loader)", "value": "9946613bf8b5973073027a285b46b9e85d91a60574574440233d33f1becc9474", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776078278, "uuid": "bd547676-8070-4365-a164-b06c67a1b2b1", "comment": "Malware payload (Smoke Loader)", "value": "16a55a5b9a0510b8f1cd21c6d4c028c9a5617ec7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776078278, "uuid": "479a7452-7100-4d47-8fdc-f18876667ee1", "comment": "Malware payload (Smoke Loader)", "value": "5fde6e59eedb12c50adba3b7d53a2027bf2b259aaf5742c83a82bf1be116575ab459e655fd8e5fdc5f8451081786801e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776078278, "uuid": "4bd7f434-34a0-41a2-99dc-9b55b9275d2f", "value": "T1E5A56B0B7C9545FBC4A9A7358CB65692BB70B8080B3237D31E90B6782F767E09E39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776078278, "uuid": "6f7576e1-d1af-44e1-89c8-c9e80dde261e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776078278, "uuid": "f65baa36-16c7-4f8a-9add-f53ee5b2447d", "value": "24576:/eJjmVr5q5501SM0sDKsepayUxMI66KgIsHeVzheleh29m9qYw0:/ijmrq/090sDmaxKg/bU/w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776078278, "uuid": "0095c783-eae8-4b5f-addd-4db2794d3e5a", "value": 2122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776078278, "uuid": "cba12633-6879-4eb7-ad34-5f41b7560142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776078278, "uuid": "823ab85f-2a9d-411e-a9d2-1cf6d008c6bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b456c79-376e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776108146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108146, "uuid": "24bd1cb4-0a91-4ff8-b271-2c05e380090d", "comment": "Malware payload", "value": "d8027aca914c2bcafb55e23d3f53e8cd", "object_relation": "md5", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108146, "uuid": "95e301f6-26a9-4b4b-bb16-9fa227169cde", "comment": "Malware payload", "value": "996db74a739c17a3d0ecd2f50cf523dfcbed497c27c1cb9f622f02519db2d6d5", "object_relation": "sha256", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108146, "uuid": "a5dd3360-eadd-4b15-bd6a-3d55bde696b7", "comment": "Malware payload", "value": "9d464663f84456d3d220a7b8be4dc58bddbaba2f", "object_relation": "sha1", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776108146, "uuid": "089ebf0d-a85d-41bc-9753-4b01e471cd13", "comment": "Malware payload", "value": "e28a8d8ade36d405104f82668848bf83293e7cfa3b00d43b46e0febcb122f9b7133f990f902a116b895085cbe641d67c", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-255-66", "colour": "#1A0BD5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108146, "uuid": "b1ee7e6b-9201-45a7-8b84-a76ffb5d007f", "value": "T113B2088CB3C58A38D4BEC73854B3A7318675FD1B5822EB1F4D81189D2D733909A26E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108146, "uuid": "5a5f78e4-d034-4051-92b8-77430db6eb1c", "value": "69188daf6313eafe37e2e06dda9bc941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108146, "uuid": "fab91d17-d7ee-474e-8b57-98db451a87e9", "value": "384:fqWLhbV2h6CYtJJ9aFnwxG34FYbIs8xpOzSFSmD:CUV2hHEJAFwL5TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776108146, "uuid": "ec3f4a61-6177-44fe-9b65-1fe95c029887", "value": 23428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776108146, "uuid": "b5a503d7-46c2-407b-ad19-a5627501f951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776108146, "uuid": "6654080b-47ef-485e-bc2d-54fd69a0c1ab", "value": "CitrixConnx64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6434b0b-3761-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776102903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102903, "uuid": "51f7bf72-e6f3-48e4-8027-d65c26e1c183", "comment": "Malware payload", "value": "da7355520ea935ce454cbd3412dad74b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102903, "uuid": "aa4b86a1-21d8-4a64-9767-9b6dbb9d0bbb", "comment": "Malware payload", "value": "99b428e56326d0445cccdf18ec7dc7a58f18ff2fa9e9462843e42767b7329a8f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102903, "uuid": "ae737ca1-928b-4cb2-becf-7a4aedf810ca", "comment": "Malware payload", "value": "eeea0c380ed5d68eba4613158a5e9f7b760c502a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102903, "uuid": "9ed9809d-57b9-41d4-b544-078834f492a3", "comment": "Malware payload", "value": "95fcaa75cf33739dd1804b637c49f24191a8fcb729d8232ef3d6fdef898620f9b123a46d04bcc2561246438816d199dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102903, "uuid": "3f4aac34-cb97-48b2-843e-fd5dfd6b38a6", "value": "T1C932DFBC028E9456874386F5F6138DA880050C435B2C37AA9C7C3DAFEDD07C9978AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102903, "uuid": "1cc18a92-33ef-442b-b418-49d3042b3a5c", "value": "192:WjbgYwhXfGZz3NDMs3HZkeEv7R0f4hwHhAVAuIvsNWu7LVL/M5PP3nn3Bxt:IkXfGNdAcHm6ghwiVAuIvsNVPG/3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102903, "uuid": "624d6122-0de8-4831-9aad-dad1a41fda3d", "value": 11209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102903, "uuid": "0745784b-7224-4336-8719-b7929f258214", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102903, "uuid": "55cadd1d-2827-46fb-bf38-aa9f51711282", "value": "photo-221557616.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac73d71-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084604, "uuid": "de8ab714-579d-4d65-b911-7787e15b17cf", "comment": "Malware payload", "value": "e2ddfa203acfee2317a8e1e1c4ed4596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084604, "uuid": "72fea958-b257-4838-ad2a-be5a65c4b3ed", "comment": "Malware payload", "value": "9a5a2908774e50172bc391391901fff2d951b574d7f07cee74501ffc5d33f7f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084604, "uuid": "f2777208-d5d8-47f6-aa91-a4e3a1c15bfd", "comment": "Malware payload", "value": "2f86697d0a2701bab5e9cd029404ad3b4dd087cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084604, "uuid": "c024ee9d-e388-4264-b1a9-9309e6b64acd", "comment": "Malware payload", "value": "6820b0529e6af0b4c4ddfdecac487833583962ec622c17ecfea080ef016accc78900445c90f9852597821c6eee5f5092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084604, "uuid": "37926221-7233-474d-bfe8-b730ec94c09a", "value": "T180E6338553D14AA2F6E7E23D46A6E056D2B2F44057228ACF4BF4476A3F1B2F14F39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084604, "uuid": "e6ac4054-79ee-4a21-8413-ee23c75ba7db", "value": "74f4f918cc15caa2178da4a8adcd29a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084604, "uuid": "0a36709b-a6c7-48ab-a8be-47243d0df7db", "value": "196608:hTApNbotbW897GDr/x7eovq5XMP6PzFcPVz097WpHskNqSPrGuZRjMFqbH4Mir47:Ko1yNdq1B7iR0gpHskqSPjZpiqbH4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084604, "uuid": "1573592a-d68d-48bd-a0bc-2e7ec0f3c480", "value": 14060544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084604, "uuid": "901c15af-50ad-4eda-8759-ef5622713299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084604, "uuid": "fefb4fc4-c360-4420-9f1c-940958deee52", "value": "e2ddfa203acfee2317a8e1e1c4ed4596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42651245-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085449, "uuid": "4e92ace6-f7c3-4ee0-84c0-b2611942d5ba", "comment": "Malware payload (AgentTesla)", "value": "311f5e4fe042e230c70d5f9be1f7e23b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085449, "uuid": "b4b60eb3-b5aa-4954-a612-5b1eba8164f0", "comment": "Malware payload (AgentTesla)", "value": "9a787f39692d131a83c6b0c60143b51ad1a45ad058bf12f59421e42352bb8958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085449, "uuid": "d8651139-ad1c-4bf4-a34f-fe7343cba692", "comment": "Malware payload (AgentTesla)", "value": "15202fc9402d28ffbb6b6e32ad98ca306aafde50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085449, "uuid": "18cf0dd1-85dc-4ec1-b265-a21efcbee5a1", "comment": "Malware payload (AgentTesla)", "value": "da8e136c99d89f1ba836b0edc97663314821902300601f3443d995e2f03129e610f233641cf3df74e68092f3d4ce104b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085449, "uuid": "40f61593-4810-4c7f-9406-f52beedcf0f7", "value": "T1BF568108C0A4B21E58C2CF5ED53694B14D8E2E6E6E4DAEB2B42F907D5C56FD3991028F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085449, "uuid": "3099f465-5d2e-4b11-8358-4335a7f11940", "value": "98304:BaDXIcdUOCU2d01CiujHinNLuu3tEEOLsrRyhm7N85WB8/KJIRNr/AfgWOpLHhiT:BaT72d09AiNLu0tEEO49yhm7N85WB8Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085449, "uuid": "d9afbaca-efc4-4ec5-9766-799483bfd256", "value": 6193830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085449, "uuid": "3d6f710e-ab78-4b3e-81db-4eb49b5ee4b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085449, "uuid": "88fcb5f4-b29c-4c0a-9d4f-f3a66ecfb14d", "value": "Telex swift copy.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeb1d8e-377e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776115045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115045, "uuid": "feaa3961-707d-4f70-a4cd-db095b1029e0", "comment": "Malware payload", "value": "535d8a2f4cfa76d24b938c84d0d2ee8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115045, "uuid": "13de5eee-1033-4e73-a5f0-4f163e6bf622", "comment": "Malware payload", "value": "9bdae650c8014b8bb5b2dbc8e77256c7d176feff890944261a32a9b0377767e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115045, "uuid": "210d784f-a27c-4f6b-b284-9dcf4812ad49", "comment": "Malware payload", "value": "c8851756f673215100a213f97d920dfe6fdc7c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776115045, "uuid": "3dc246e6-514f-488d-96b0-93aa6380a190", "comment": "Malware payload", "value": "232032a6093769b380fd7089b51cc4cc8e36e57677def2055728564d64e4bda9d74b80fe473a2907d3f0e300d3d4684e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115045, "uuid": "eb812187-41de-44c4-ac3b-3cb99abf27ea", "value": "T1F9D57D03AD9148BAD459A3319CB61292B731FC88473237D32E63A6782FF77E05A79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115045, "uuid": "98ccb240-d6b8-4327-ac2f-5f87e9d00c39", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115045, "uuid": "7ace2175-16bf-4eb1-9ef3-5c3ef71b7af5", "value": "24576:iX1jkI4iRt/Lw/Kd2DT21erDnS+epEOwIGISBxDgx5aHbgCDBgz8GgWZChhelehS:iX14/iRlLw/OqTNrDSFpfwd5bdMp24OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776115045, "uuid": "61fdde60-b34f-4226-9b36-1eb8a3a64ef6", "value": 2995168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776115045, "uuid": "c09fbe7a-ef5a-48d0-b6d0-bb66522bfaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776115045, "uuid": "74879ff4-5fdd-4d31-860d-638bacdd8dcc", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921e9772-36ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776053370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053370, "uuid": "905c5166-43ad-40d5-95ef-5b9603af4b26", "comment": "Malware payload (Mirai)", "value": "633d1b5e7954371e02f2e639e342f7e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053370, "uuid": "b21a2138-0852-496e-8af5-0534cb3d6e07", "comment": "Malware payload (Mirai)", "value": "9c979ff36b9092368ef5973cb4ba5dc30a3fbdaf07814ed6d8e760c0bb0aa98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053370, "uuid": "0ff7d2e0-d2fc-4e20-9caa-0023d2b10703", "comment": "Malware payload (Mirai)", "value": "a0f9bda1b67e7dd79a4bd28181b5e7639384e19e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053370, "uuid": "9fcf398b-0e29-405f-af18-69c9c43569fa", "comment": "Malware payload (Mirai)", "value": "e246196197b26db10cf9ea4491857951e73a6b25f39c05bec049f9dcd2981456d2fc8bc090bcdf0079b1167c8b4cb961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053370, "uuid": "ec504790-a3e9-4b27-961c-37ff42a32b6f", "value": "T179C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B11E27C86A671F4DE205F6D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053370, "uuid": "79222157-e901-43be-ba04-ec398bdd6645", "value": "1536:UP1FmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3W:UNFmSmviqS1Bs0+Nd6lAqktNMxSNbmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053370, "uuid": "8e6bad1d-d689-49fc-8e0d-864574b92ec7", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053370, "uuid": "8c00649a-5e17-4a19-8f24-f4abf155048f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053370, "uuid": "f789c276-ce4e-4af0-9d66-2bea927af11c", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cfa0d8-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776086131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086131, "uuid": "4953b776-6600-47f4-a58f-6cf7bea7ac78", "comment": "Malware payload (Vidar)", "value": "5b9ecdf56487f51a656b4202c81c60d8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086131, "uuid": "dd76605a-b8ef-4538-a5a4-501633f4ae7f", "comment": "Malware payload (Vidar)", "value": "9cc8c1ae2c107c3d0cde9f4d9c295c2cf19ae025f374a6b8c9b178ec6ad5bbe7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086131, "uuid": "f85feed9-c0f8-47aa-bf93-c2dcc25b704f", "comment": "Malware payload (Vidar)", "value": "05e3fb7fc664a5c49f446e0e6a31d50f6aa0255c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086131, "uuid": "fda2d4da-ed98-45b6-9ba8-08ec8a166929", "comment": "Malware payload (Vidar)", "value": "b080441254dfba55c11d01cf25fb571b492acd7cfd45603119297d4d45ba6bc59d0e0229911cb66bcdf933d64c512620", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086131, "uuid": "256475e7-c157-4988-a6be-c1018d021fe6", "value": "T13731BF101BF21229EBB78F3A98B9721296217D06EF259F5F02D4529C48B4521F866F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086131, "uuid": "d74d566e-e6b4-475c-be6a-3048ad2d599a", "value": "24:8RnrpdmGjMDvSwjKUaWU3AcPWkp+/CWppjdgIfSBUJcfO4wZZr4I0WK6c/6Cab7k:8RvmeKpUQRNdgQSO4wHUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086131, "uuid": "6a99bb26-f9a7-4515-819c-1aa012348160", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086131, "uuid": "1e62901c-7958-415c-95be-c21f02a7bfd5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086131, "uuid": "724190bc-cc13-433c-bc7c-0c1fdbecbdf1", "value": "IMG-368331179.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4d1688-3784-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776117867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117867, "uuid": "5b62b291-44ee-4cb8-a9cb-faef2d4168ea", "comment": "Malware payload", "value": "ace319a6212d37265b86968b764d835e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117867, "uuid": "87486f58-040f-4a26-843a-85ccd84da5a3", "comment": "Malware payload", "value": "9eb087907901201235571b5d6bf04c18260c6f219f33dde1a64faa6169db478f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117867, "uuid": "4f87f3b1-369b-4d9a-9681-f1326a482964", "comment": "Malware payload", "value": "d8ca0a9ae6765387a8ce9a4906c1726998974026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117867, "uuid": "c8d69334-cf66-45e9-bf76-f08d7c00c438", "comment": "Malware payload", "value": "e12fd5d9d79e92327a0588862202fc7239257913185a927ec484b415f1672f0e2da39f6a2de9fdb39f15abdf2c1bbcc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117867, "uuid": "2d8f0865-0fa4-4c3d-84b8-59696729d4b8", "value": "T132D55B9F77B841E4D1668175C8468A8BD3F2B4921B3183DF10A1879F1FB76E24C3A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117867, "uuid": "33f52a3d-7cb8-4f2a-abec-22d7da7fa602", "value": "48251428bbf8085cc52686e104f31d73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117867, "uuid": "88bca226-0065-48c1-9a37-835356f843c4", "value": "49152:QshaBzZ9C4sch4JMv+Stlo2OZPcYRgMWHlMClYK8mtU37cARRFlPM723U8UC6gCa:5a2rdMYAHBx+7cARt3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776117867, "uuid": "170e1d5b-95b9-4c1e-a4dc-a11580c3a0d5", "value": 2931200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776117867, "uuid": "0f3c43d6-33ac-4d75-80c4-d112ef27b90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117867, "uuid": "70cdcfb0-9ba1-488e-8bdb-cc0798a239c4", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u97f3\u5305.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7150bb4-36f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776055553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055553, "uuid": "2b46cde5-9eea-427a-81a7-a465d1e9e55a", "comment": "Malware payload (ValleyRAT)", "value": "0961c74b98ac5c12e64a1c5c0275031f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055553, "uuid": "a331c098-1340-4e3d-a5ec-10f5686aedca", "comment": "Malware payload (ValleyRAT)", "value": "9f00e426d184153f44efcf0aedd5a09547ef957f6077bc6cf05c63706a22fb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055553, "uuid": "2e63322a-df33-4b47-b965-fba1ded7d519", "comment": "Malware payload (ValleyRAT)", "value": "bb6e5214df8c78989744495061b598953bdb25d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055553, "uuid": "ef0f7231-2889-40d4-a0cc-386932355b46", "comment": "Malware payload (ValleyRAT)", "value": "ec256e418e04d3f20c4907c86a6f15d99a35e717dbc56685d88a4e95da9ca352d694eadc0c3846d72c329e865bbe2b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055553, "uuid": "d342e6ee-bafe-4ad2-a1ad-211cd92fb4d9", "value": "T137950173B9E29433E4A6907046581B476FBBF9300938CC6B97C85E4D7764EC2E61A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055553, "uuid": "c7c5278f-80d3-4313-95e1-3fb5590f54a4", "value": "ceda77f6f3d955ea8a19ec38b0b890bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055553, "uuid": "2106f871-d4a1-471b-a8a4-3fb5db0aeb90", "value": "49152:Li39+084E6W4W8Vm/hP49aXZmMA1gPrQBvmTz37:e+HVb4W8QN49unaKQBan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055553, "uuid": "8c0a6170-7bd3-4f38-87ec-9ea0743e77dc", "value": 1887445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055553, "uuid": "e48f90ae-3d15-47e7-bbd8-778ec2bcb6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055553, "uuid": "652db69b-fba3-4ff6-b961-b56eaa62df7e", "value": "tod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2f6ad4-374d-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776093998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093998, "uuid": "17f6171e-7e41-4d0b-9744-7f0cf87a9e56", "comment": "Malware payload (RatonRAT)", "value": "5bdca154877c274f2c4ca7623b04c52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093998, "uuid": "5c77a570-ceb1-4b37-bca0-085cf876cb0c", "comment": "Malware payload (RatonRAT)", "value": "a162c3543152cd9c254fa0895e950c3b5c8e8b902fb0c02749f2d0f58cf255e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093998, "uuid": "2887fe15-0282-4918-acc9-1b04422bc287", "comment": "Malware payload (RatonRAT)", "value": "3547058ef258a9ca337278ab9a2c85209a684436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776093998, "uuid": "a04e7f57-61a8-4b1c-8dea-f410cd47b614", "comment": "Malware payload (RatonRAT)", "value": "07c58d2b8586b00d3dec13c7d2b77791b43c7dd62ac4c7d39fa039cd0387d310215b6c7e83490ad058d10f72c2fc2824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093998, "uuid": "5bfc0846-a895-4019-9f0a-3e09e990cc2c", "value": "T1B695F11C33F98A08F2AF0BF4E97185564771FE178C62DB6D59E579DE00B2F48A610B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093998, "uuid": "f04fa0f5-c18f-409d-8488-badbd4bf03c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093998, "uuid": "62985e96-16a1-47e0-9720-e24acdf38225", "value": "24576:YGD8CrmiaunV5vQ2ue52wWLt3QA2cWAnOEvSrtv94TP0lRRkxYcxMNnyFoBOkA6M:xiGWU5+5WD1sclR0BxMsaRw4QyOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776093998, "uuid": "514f7544-560c-44f0-825a-6556ef2cf7fa", "value": 1933824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776093998, "uuid": "2b2d3733-9ddf-49b5-9df4-38f6c1048297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776093998, "uuid": "0a627d30-7b8b-4245-9b8d-2ec5861e268f", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212d804a-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066495, "uuid": "3b6a46df-8dc3-4e60-99ba-de3a75a12fbd", "comment": "Malware payload", "value": "1009fac37240f16e01e552cf87e61dde", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066495, "uuid": "5dccaa33-69e3-4d94-891b-b95abe96e3ef", "comment": "Malware payload", "value": "a23bd8eab005a0c7759ffa344b55a3e1fd83a871817d51621c97eee0b511b3da", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066495, "uuid": "06a451bb-7012-4e3e-8519-8f496353e90f", "comment": "Malware payload", "value": "5fe202ed78618d14675cbdac6fd176848f74cc30", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066495, "uuid": "14c61109-24e0-462c-9d01-c41bca8ddd8c", "comment": "Malware payload", "value": "645dbfb5ee399892b0644f1446bf89bc96f6fb297198b4342f5958a5e2adafedfb71aff3992ba5c85bac8d8b73bf9551", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066495, "uuid": "93bdcc16-2184-440e-a329-e29d887eaf1a", "value": "T180F2D62D275DDC9CE81AC590C23BB69D5F0EF0A29FD8240A143E5261314DD8ABECB6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066495, "uuid": "e64a939d-1219-498f-8a66-9a73d3638021", "value": "768:5AUTIkUeSiLBLwMdA9twUuvJZBw9xwdgs5nNjII3jsR0HPUtQqp4wRquFg3Ku4Cy:6UT+5AeIABxwqQNcI3jsR0vU+S4wRquj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066495, "uuid": "94fc7c93-9558-4b7c-9c58-414665add880", "value": 37438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066495, "uuid": "badfc6ed-d611-47e8-8439-b17f34b29c10", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066495, "uuid": "ddda90d5-5df5-4419-b2a5-f777e0f782dc", "value": "a23bd8eab005a0c7759ffa344b55a3e1fd83a871817d51621c97eee0b511b3da.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bf2555-372b-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776079500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079500, "uuid": "4c5dd50f-cabb-43a3-a97d-7413acd3c99e", "comment": "Malware payload (Smoke Loader)", "value": "6294df4e2a4d2c0640cc4c69ad9dc8e9", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079500, "uuid": "14d6456a-2d92-4119-af1a-28ca7bc006d5", "comment": "Malware payload (Smoke Loader)", "value": "a278d109acc60b978afe86476f246e86b0bf9f4c0ab82a9e149bf4b52e69fbf8", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079500, "uuid": "29a3e659-3f1b-4156-ba79-9505f197ee96", "comment": "Malware payload (Smoke Loader)", "value": "ae9595ae36ef22ef4c18e2dd8989ff78198ea210", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079500, "uuid": "a5c61c02-d586-4a26-b9bd-134920a9ec76", "comment": "Malware payload (Smoke Loader)", "value": "304fc60b219884ede4dbd9278310fa72872c317d0a1403102483f61210b8a1bc3f380f9f8e0b148213b1a65de95fa033", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079500, "uuid": "cb0559cf-cf97-40e4-aace-5bcc0163db73", "value": "T1CFA55B0B6C9185FAC8AEA7318CB65291BB74BC090B3233D32E9076742FB67E05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079500, "uuid": "8f678ff5-d4b8-4bf4-aca5-d69b34639b36", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079500, "uuid": "477f3190-b480-4224-b4f2-a63243ce5caf", "value": "24576:0WEJfO5X0PxZNOPRRsDY/CbvlM3465O3k2ioCDKJOhheleh2KmVU1JnQjm:0WEwl0tOPROPNM30CeljPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079500, "uuid": "8bcdab70-6c18-4f4f-9731-f524e9718e57", "value": 2223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079500, "uuid": "e7c2013c-f7c5-405a-82e3-7fdb9202d91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079500, "uuid": "214d5c7a-11c6-42f2-8777-cc041b595b96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612df57b-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084641, "uuid": "ade29b87-6ab1-4c7c-8d0a-f6a10cb0dab2", "comment": "Malware payload", "value": "ac6e18360227fa0b88dc03944a8c8d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084641, "uuid": "afb6854e-4afb-4abc-bea0-f19932ea8d98", "comment": "Malware payload", "value": "a2a03fa7e8a259cdee122a1a908c2e6dd72aa714e1f2802780b4fdac5cc7809e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084641, "uuid": "a287640b-1c63-4fa8-8f38-b9668747a4f8", "comment": "Malware payload", "value": "42586c74a934626d2e7f1fc4c1ef850699614475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084641, "uuid": "f839b682-aa99-4317-bba1-76ed587e2091", "comment": "Malware payload", "value": "7fbb92bfa19fe4f67d283955fc685548c90c32a4f790c1bd4448d3d02b95f3aa12b927c90a9817f6531781bc9a0db05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084641, "uuid": "1b5081aa-41b2-4609-87f5-e73df87c64b5", "value": "T192835A12F241C435F0F700BACBB94B7A9EBCAF11536490DB57D815AA9B31AC1BA31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084641, "uuid": "ada465af-b756-4398-9ce5-2fefc3caa635", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084641, "uuid": "0f4c9839-0339-448d-b1ad-1ae8afc50267", "value": "768:1LA9fYR8/KXMnNN+B341z+CcMKaHhBwE+u3kkiLEDdEnDAixFi0o3AhRKBBRHSya:1Oy8/KMN+B6zNBUu3kTTLuAhoB2ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084641, "uuid": "f89eacf3-c779-4616-8bff-e5dc146fc825", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084641, "uuid": "ff358156-3e1c-4583-9b62-012412f3add7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084641, "uuid": "8e9fc1ca-feea-4adc-8f21-7d633159db98", "value": "ac6e18360227fa0b88dc03944a8c8d7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d500224-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043457, "uuid": "9cabaaa9-1b70-49a2-b37e-88ece7f40b4a", "comment": "Malware payload (Mirai)", "value": "63ea1c47fdabb1144b04784712f834ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043457, "uuid": "235d638a-70cb-4643-ac70-1129045ec00a", "comment": "Malware payload (Mirai)", "value": "a2b6ebf7edbb12bfdc545868ae60459f51c6e805a08894d651c027d558363980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043457, "uuid": "741e3c1c-de10-4665-b3d8-8ec7ce57e0fa", "comment": "Malware payload (Mirai)", "value": "17a2699ceef265235c83e98a65627bb5c6f4c1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043457, "uuid": "7951ae3d-0b88-4fe3-a527-252438ec0cae", "comment": "Malware payload (Mirai)", "value": "e33ce6f7ee0925e585503bf11865e4dfd1b669ed19f00bfeae89e673e4e630e88187a1159d25fda7116c1bc0b1be3162", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043457, "uuid": "1b5a8375-9d30-4d47-938d-fcfb27e1db58", "value": "T11DA3F786BD428B13C5D221F7BBAF019C371657B9D2E73142DD26AFA0274B5D70A3B260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043457, "uuid": "2ea7bb5a-9bcc-4d39-8b29-1ece16a5afca", "value": "1536:HcJLNRFpdoGHjptbAFOZbz9O2AFh7FcuOBE62zKuC4fqRbimZH5MPFzRSmIGxGBJ:HcMJpxNM7ZU9IyGrcLJq0jlmRSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043457, "uuid": "ab3afc0b-a1ea-4bd8-a7f6-6eb14d4aa577", "value": 98964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043457, "uuid": "309ffe16-6aac-48a3-a410-02a6c72108fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043457, "uuid": "5d65bb25-693a-4c40-a18a-48fbf6312d89", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cc4f9e-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085694, "uuid": "a5dd5c57-506a-4565-95a4-8bf08ffef31b", "comment": "Malware payload", "value": "9808b29d8913bf8ce6572275e05ea991", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085694, "uuid": "481050fe-8bb2-4ab1-bd62-9d6674aca61e", "comment": "Malware payload", "value": "a3ec7f521e98d722dadbee6a161897b0de880f573ea760856319e426132da198", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085694, "uuid": "dccdff32-d14c-420e-9071-51760306c951", "comment": "Malware payload", "value": "2d7ccc33040f5befa19619bfb8a24f71026c7b99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085694, "uuid": "2e765149-07db-4786-896f-01cc1241390e", "comment": "Malware payload", "value": "14f244a300c4782f4d9c7b33b1f29febb37444fd7dad2c49bee23245b8a55f9affeb140d21792a03b344645f771f4caa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085694, "uuid": "3a29ca5a-26a8-41f5-acc5-bc2605ee1900", "value": "T1D4944B3EC6D80016A1B6D614FEA50423E6777B63273D8C4C12C5124D47B394EBAADBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085694, "uuid": "80400004-0c90-4605-8249-a38c8c63bf24", "value": "12288:7PUd5iSTuLuvj3gu5+g93EvxFIX/AMlCgePZSCSSX2Ktp0AD:D6fhv5h93EmAdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085694, "uuid": "35701dcf-cc43-48b5-ba4d-2774092194b1", "value": 410738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085694, "uuid": "d205d0b0-038b-4e94-95b9-5d9395f442d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085694, "uuid": "4380d8d2-7ff3-4350-8b9f-917292268bd7", "value": "Payment Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f204dcb-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776085873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085873, "uuid": "14ab3807-8197-4cb6-9a94-ba3f8988b12d", "comment": "Malware payload (Vidar)", "value": "7a1f01bb8b19c2f9167b8bd120240455", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085873, "uuid": "b5831b01-f85e-442b-aa86-b1ab0a49eaef", "comment": "Malware payload (Vidar)", "value": "a4468bf9496338f4718c6a1064b7d9dd760c5e86b663ba5e14f340ecada7270d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085873, "uuid": "28f137f4-660a-43d3-a39d-7bc51a8105ee", "comment": "Malware payload (Vidar)", "value": "5c6f64da685a49ab85e952291aa7c440533f4375", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085873, "uuid": "72806c4b-9e87-43af-9ae0-076d96ad0d13", "comment": "Malware payload (Vidar)", "value": "949c58154f48ba1f49b4bf7abc257cf331c481a37999ead5e9e70a0b36ed95416da1ce239fbf1e96df9282e0b2cec542", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085873, "uuid": "82318f2f-75c0-48d3-827c-b2c446f355ce", "value": "T1894113241BB10225EAF78F39D8B97213A9317D06EB218F5F11D0525888B5611F8A6F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085873, "uuid": "f80bf0b2-d732-4f0c-883b-7a67d8134e88", "value": "24:8VWjdmGjMDvSwjKUaWU3AcPWkp+/CWTpZJ14W1s3XrX4wZrQr4I0WK6c/6Cab7Ov:88BmeKpUQrZ1F1sj4wqUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085873, "uuid": "f531ce1b-8dd4-4a35-bd9f-24343015e6b0", "value": 1881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085873, "uuid": "7963cbc9-ab46-4200-a7a2-9305c76ff532", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085873, "uuid": "a6f030a1-7062-4179-b8f7-73d2bfa06f33", "value": "IMG-257980788.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34743ef-36e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776049668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776049668, "uuid": "f12cd7b5-4331-4133-a0f7-5be675394c2d", "comment": "Malware payload", "value": "a3c555f2c93bba6b74e4bb9fc595fd55", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Suspicious File", "colour": "#A68655", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776049668, "uuid": "65243871-8403-4e92-bb00-92154f058409", "comment": "Malware payload", "value": "a485287440bf7222bd2452e171970aaea42eb2eb2242ddb4c7ce1722100360e3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Suspicious File", "colour": "#A68655", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776049668, "uuid": "7a45be07-c6d0-456b-b352-3fc0e1fa9042", "comment": "Malware payload", "value": "9ea9f5debe42295e0da52dd5b70722a6d1d7897c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Suspicious File", "colour": "#A68655", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776049668, "uuid": "4866e6d5-9fc5-46f5-9269-b87494cd13f8", "comment": "Malware payload", "value": "4cd1805a2cca18a968c50dcf769f890ace7ce2211cc8f46c38cfcc1bbaa4eda44982aaa55dc0f3b91c23bc41e47f0373", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Suspicious File", "colour": "#A68655", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776049668, "uuid": "ae9d5089-5eb0-4a7c-bdc1-ee90fcc603a4", "value": "T18A06F173D5DECA29FE7B59B391C21693243F11A8AC0B607D12E85D83CB3294B53A1B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776049668, "uuid": "cd650ab1-ae64-4a79-aca0-20e6240b5ddf", "value": "98304:13T4eOFieD1+nZeR46+V/+5haJLPFIl6W02Cvoj9Zcl7mx:RJnk4r+CLmO2CgjsQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776049668, "uuid": "0071141a-5eeb-464f-8855-8e2116c88710", "value": 3859752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776049668, "uuid": "8c56facb-bd49-48c1-b8a9-4a9f84019f21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776049668, "uuid": "9360b1c5-a0b2-4a80-8bb0-c3f65c1eabe9", "value": "agent_new.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380cbdcf-36e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776051072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051072, "uuid": "a80699b2-ef64-4629-9b3b-315c5a27ed15", "comment": "Malware payload (Joker)", "value": "e88939592adc151be66319b229cd4df1", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051072, "uuid": "7dc20c5d-435a-4b92-a30f-2c2fc1b90cdd", "comment": "Malware payload (Joker)", "value": "a4e1a63b220791fe79c738636f0e709725e8d101c2c1409ea076abaefcc22d80", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051072, "uuid": "0b1a22a2-e6fc-44fc-971d-214b6730f175", "comment": "Malware payload (Joker)", "value": "5cdd1a296d48b1cf5f84d3425d0615d9903c0222", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051072, "uuid": "77b780dc-0e1b-40a5-8a91-4e292f64f6cb", "comment": "Malware payload (Joker)", "value": "ff5262ef100a6923b58bc99f5b87bad60b7f8a1c36643fcc5d353f4f352d262135105da049a88207d453ec77d0b1b78d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051072, "uuid": "f27bd4c4-63f1-4c93-ad48-b3429aa14f64", "value": "T10837D049F61CD92BDDF6B0BC8D8E17A3B4656D540610C2873822B20DFAB3BD49B15BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051072, "uuid": "f9a4c51f-a9ef-43e7-931b-d227b29fd2c1", "value": "393216:FUdCsgxznXfIeUMpQ+Mc2skIhT/WD1urQxCuKrW701QCFx:FUhsPsdZlsFDcFv4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776051072, "uuid": "5d05565b-d2e4-4ad4-8969-d488bb3714e6", "value": 23150018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776051072, "uuid": "0cef9033-4d8c-4d96-9807-683ed734260a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051072, "uuid": "9514b70a-3d9a-42e1-b69b-911069fb31d7", "value": "Secure+Messages+Pro_1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce166d9-36e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048234, "uuid": "1c315397-becb-49b9-9e04-34b5b8f8faff", "comment": "Malware payload", "value": "78f701b252e945bdeaa180cb9ecdebfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048234, "uuid": "955e48d9-318e-4c48-8c6b-39a4601df378", "comment": "Malware payload", "value": "a5b1aa2f57ad0b184fa69a54ac579bfc4417004e74bdb8bfdce500ea930c8827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048234, "uuid": "d2dc118b-016d-44f6-89f6-87ea9e731ead", "comment": "Malware payload", "value": "d0c184f6c13304faa816b37e3e053c77363637ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048234, "uuid": "c11c84f3-1d90-43e2-b20f-e3dae85f6adc", "comment": "Malware payload", "value": "71228803aaed39cab97981d17e0f482feef6fa565df08df7f698d6ef28cf32e4e0a61f88372b17ee5dad4939ce25e575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048234, "uuid": "3134a3ab-ea45-4ebe-a672-904d581dac78", "value": "T1F673732AAB21DFBBDC5FCD7305E94502208DA55A02D92B6FB1B0D95CE38AC4F44E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048234, "uuid": "412fb24e-a9e8-4c9a-9035-ee2e3c8d7c4a", "value": "768:ASOGbJ51oZqeso+/eQDGsxTXawKuF85BXi/wBcaeSeXT34ENIBpz0:vv1vesoORD7Z7ypcanAT3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048234, "uuid": "2e2865e4-7e11-4d48-baff-636a3e8f0de9", "value": 76092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048234, "uuid": "99ba8b5a-96ac-41eb-a4a4-dc3c04d447af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048234, "uuid": "00f3b069-a576-4cd2-8902-f02d0b6e24e7", "value": "ultron.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10034e08-3789-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776119724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119724, "uuid": "60af1d13-87c7-4713-a45a-e129ec749419", "comment": "Malware payload", "value": "c4c76486d9306758efee0bcd12332e38", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kk-land", "colour": "#295D94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119724, "uuid": "23c83efd-2797-4741-901c-c24b7d8e550a", "comment": "Malware payload", "value": "a6d089791afb6b86126d8e5fcb35d49362c7cad49520e80a3e0a60a8f12fca39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kk-land", "colour": "#295D94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119724, "uuid": "3fa77a17-8bba-4ea9-b990-1ddcbc58e05d", "comment": "Malware payload", "value": "84b4c4edabea9f9948601d8040865416ddbf6e9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kk-land", "colour": "#295D94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776119724, "uuid": "8f1ee935-e452-4c68-9bad-1ee07ebf5044", "comment": "Malware payload", "value": "e3dfc2b8bc698beb683af3ed02672ca25d6ceab16d0f34b994daede3bdf0819b415c23accd083a5e9c9433df72c86790", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "kk-land", "colour": "#295D94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119724, "uuid": "254d0602-5dc1-4866-bda7-6e466bb6f492", "value": "T194B10246399158A05AF7BB7AE19B96D4FA7601A31552C447782CB0808FF0D05CCBBDFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119724, "uuid": "5d315ce3-6748-4543-8ba0-87788b48c3de", "value": "96:6yskdRARy2Tqpya8+jplQCE87S8yxEcom3hf2HBOTsfn+p+duCV+pP6fWdoK:6ysgRWyabslBE8VyxEczoBOTqnzoCgj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776119724, "uuid": "2c521f01-96c1-4311-9519-18d8e4f27a0d", "value": 5510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776119724, "uuid": "7504b074-8c73-4fd9-b078-a79ab57e08cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776119724, "uuid": "7c71a469-cbf8-4550-aea8-eba6d8997677", "value": "magecart.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026a30e8-3767-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776105098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105098, "uuid": "d62bf9d9-7c3e-4dd5-9103-f50b7d9a8bf4", "comment": "Malware payload", "value": "fd26d2ef65f248319f13e157bec027ba", "object_relation": "md5", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105098, "uuid": "312c5cfa-50ab-4f50-9b72-535904556bb3", "comment": "Malware payload", "value": "a8897e97b9bfad7e7912b8e50afbe9d2d76bde5162a434ebd678d3a857f9e7ee", "object_relation": "sha256", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105098, "uuid": "69904066-cec0-4627-9569-61918be36286", "comment": "Malware payload", "value": "9e376b21b204a30d727825ced8d2fbda2018cad6", "object_relation": "sha1", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105098, "uuid": "a378d5b4-dd24-47e5-bc97-7db9ef143f9b", "comment": "Malware payload", "value": "aaa5afa9c55a5212490571e29d04bc8465905d5bc7a894f5092bc331b868def2d42eaf4386ace0f92f18d009e515b8da", "object_relation": "sha3-384", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "strombapylre-com", "colour": "#B6EF09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105098, "uuid": "f57dc2d5-24fe-4b5f-8096-dc36ada7efa1", "value": "T195900210485014AA5B654134D210540444713505856262D63901C81604815A8C674805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105098, "uuid": "283d71f2-2235-4707-8585-61d1a3632be4", "value": "3:VSJJFIqF1F65IFWDkVOTM:s8qF1FEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105098, "uuid": "eebe2478-c68f-4d57-887c-29d5e28190ee", "value": 50, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105098, "uuid": "2c983f7b-2bfc-4b02-8866-bc55b7d071d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105098, "uuid": "f0d118d8-860b-4653-ac9e-d6fbeea957fa", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c63eea2-36ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776053334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053334, "uuid": "a544193d-1627-4cbf-bac6-13daecd28413", "comment": "Malware payload (Mirai)", "value": "0ed2e18dccd04e0e3567d305748f6508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053334, "uuid": "39996871-dd45-44a6-983f-c0cecd988b8a", "comment": "Malware payload (Mirai)", "value": "a8bdc657e98cd6b84ec1185ff178313179b72e13ac8d950c7b00451bf5a6712d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053334, "uuid": "ab03ead7-3204-4e56-aed9-0c25c406ca43", "comment": "Malware payload (Mirai)", "value": "78693b7910f7a4aa33f00e8c38c0271589511dac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053334, "uuid": "b2ce11e9-5827-4e23-a79b-63c025600d4e", "comment": "Malware payload (Mirai)", "value": "ea28bf2b607bdfbd0856ea574f1d5d6cc06ed6a876988fe7fd78d0852346d73068b5b8ae124a737a5cacc147a7f0c120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053334, "uuid": "0402c7ef-1ada-4027-b3d7-360e03b49d01", "value": "T179333B4DF783E0F0ED4B0571115BF77E97349E024124DE6EDB98BE62AD32A02B11B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053334, "uuid": "31d28bda-c6e8-42ea-83b0-5fe0fe473ded", "value": "768:vwheNrlqWC9wIhpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98SN+Er:vwQ96FpOzwLMU431ANA0BLBCGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053334, "uuid": "4866de08-ebdb-4474-9d70-46921c167fc4", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053334, "uuid": "f5f96c57-68e6-4a1b-958b-ece92b23ace9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053334, "uuid": "45c2b87d-d4f8-4995-b359-ddd42af28e25", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5fb5d2-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776060014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060014, "uuid": "1f75468d-bf2a-4aef-be01-08fb7c3948a0", "comment": "Malware payload (QuasarRAT)", "value": "771c31943b093ac46b296f13950a2a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060014, "uuid": "4686ec13-c1cc-42cc-977a-2dd441e02645", "comment": "Malware payload (QuasarRAT)", "value": "a8db212713ae89c65692675a67f7ed7a9309b714d62f22f78286a075ff8bc52a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060014, "uuid": "e1923bbb-f903-4e2f-a0c9-78d9d73100dc", "comment": "Malware payload (QuasarRAT)", "value": "6c85b4edf6314d3ee97f10ca0b62b56886a0844c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060014, "uuid": "2a8e8c30-7978-4240-8949-1b1e9007d4ad", "comment": "Malware payload (QuasarRAT)", "value": "f4ba858982c79e5bb56773844579e272bb62324486f36d5f7574f5ed1b122a97efcd616714073c6161817900b47101e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060014, "uuid": "4b897d1e-4ed4-4582-babe-5c7e82c66d03", "value": "T1E4761237B28A633EE06E5B374AB2D6105D3B7A21A55F8C52D6E40C4CDF290A01E7F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060014, "uuid": "212b1bfe-5ee0-4163-b59c-1796340b6874", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060014, "uuid": "9fe52337-a856-414e-a7c2-0040fcd91aa8", "value": "98304:bN66afZNwtZ+/tieRA6zYlk9Hdin05TzAtS17IFQHlqzVVFf6jm:7+ZNwD+/tiqRqeHw05Tz2W7IFXz32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060014, "uuid": "fd4c5e47-8059-4105-b479-31a8b305af7c", "value": 7497291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060014, "uuid": "3e39a5b6-a3a1-48e4-8103-5c53e206b32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060014, "uuid": "f80086d9-b9b0-467d-855d-e6cfb74a6162", "value": "a8db212713ae89c65692675a67f7ed7a9309b714d62f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9a1aae-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048821, "uuid": "2c232ed4-8909-49e1-ba34-d4860a8ead66", "comment": "Malware payload", "value": "dc14369e5bf5743438377931128f3e93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048821, "uuid": "470ccb88-9d15-4b03-a1be-fbe18e0e39bd", "comment": "Malware payload", "value": "a8fbfc293d846bc54921e5034b6f11142219f71c2e9d424571e31e622fb4801c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048821, "uuid": "58e2065d-830d-454b-bc9b-3816b413147e", "comment": "Malware payload", "value": "412e296b98bc3d644b04a599bbaaf0876c3cc2d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048821, "uuid": "a2ad99ea-b8ac-40c9-9ae4-70ae9f5003a0", "comment": "Malware payload", "value": "f9faa9f9f14a18e881295433d2c9cffb82de328930d302547e851c32af1dc2d668371263b2c4c0550351c9d2c68718c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048821, "uuid": "f7b1ba97-fc5f-4041-a49d-36fcc50e9be5", "value": "T1708533DDCD900A1F7F093D3922CCDD8EA225FA35549C2E2CB5A9940BE117E5B32256BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048821, "uuid": "66469deb-d42c-4eb8-9ae7-e1c8167aac84", "value": "49152:9a5A0Dav4xbZVsroD8hLSPbWcNNYhwi0bMSx:9au0Dav4VHsroDHVNc4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048821, "uuid": "9eb8c283-e5b2-49a7-ad24-e8b2f11d121a", "value": 1804288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048821, "uuid": "10a724ca-9d4f-4f51-90ce-9923fd98ddc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048821, "uuid": "e68d97bb-f4ff-4268-af27-062921d53be1", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847217e3-36d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776040892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040892, "uuid": "ed1aae9d-4fe1-4333-9458-bb66a5573d1f", "comment": "Malware payload", "value": "b4e885bb94ea68145039bed228b3c24a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040892, "uuid": "1699b683-b086-4694-b964-653a9d2fed21", "comment": "Malware payload", "value": "a93ccd5c79fa273f67ba4a9740ec43abd61e0a105c09628e792766409ca0189a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040892, "uuid": "fb8bc4a9-d7a1-4890-8f9a-364ca4864bab", "comment": "Malware payload", "value": "b26c8f31408dd2de987bf351bc23a8258bdd8314", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776040892, "uuid": "a59f0d6b-49c1-415c-b906-7f29e9139f0e", "comment": "Malware payload", "value": "48a80c6aba727bea722508593d9ed0bdb3fbac4b4f7d1573425138a1c57666512806917adf52acd197ffd084fa297ec6", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040892, "uuid": "680bbdf2-fc38-4158-9ecc-6478f7564438", "value": "T116665B07EC9555E9C0ADE2348A729253BB717C885B3123D32B90F7782F76BD0AA79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040892, "uuid": "efb5823b-d459-4821-990c-28790e6976f7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040892, "uuid": "a6b16000-41ff-4656-9ed7-ba0b50ac8437", "value": "49152:6gXUBrjuhWnk3fdkxzVh00pRZdhsRS+lOPiy3FxBpqAEYP6qoA1V6tW22wDiMwKi:6KVKR3x0OayfB16fxtWWPsaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776040892, "uuid": "4a91eb89-f206-4e6b-95fb-881924fd9ef1", "value": 6850560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776040892, "uuid": "5d84f1e9-75aa-4c18-9b86-728db38396a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776040892, "uuid": "64a0aaa9-93ea-41e3-962c-277ce71f878e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1e5b80-370b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776066000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066000, "uuid": "2d617d67-c832-4b87-a7a5-00ce7e4b0dbf", "comment": "Malware payload (RemcosRAT)", "value": "f8b4e7e53d6312481a7a55a061bcd518", "object_relation": "md5", "Tag": [ { "name": "FXassistant-4nmn-com", "colour": "#8D270C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066000, "uuid": "b0a917ff-a04a-4176-a28b-9b3825a67079", "comment": "Malware payload (RemcosRAT)", "value": "a9fff657717fc3bcfb1033ee50bc3d13e2dda381e90440f01b2f15b988ec0613", "object_relation": "sha256", "Tag": [ { "name": "FXassistant-4nmn-com", "colour": "#8D270C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066000, "uuid": "9c0edd4f-c8ee-4a17-aa11-d4bc35f1c02d", "comment": "Malware payload (RemcosRAT)", "value": "e31d61e5eb44054a847b5eb531831116c5853058", "object_relation": "sha1", "Tag": [ { "name": "FXassistant-4nmn-com", "colour": "#8D270C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066000, "uuid": "66afd047-98e0-4dc8-b7af-7f8f7fb4d18e", "comment": "Malware payload (RemcosRAT)", "value": "e1e62fc533608921c113ad5c52c09f6490d84bf616a4127d34fdf3095af0895f1f4f0065a73d1eb0dd262a707eb21ef5", "object_relation": "sha3-384", "Tag": [ { "name": "FXassistant-4nmn-com", "colour": "#8D270C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066000, "uuid": "a6dd4896-f734-45bf-a58a-729d1d87f2fa", "value": "T1D3C41C6D5B56D458725ED8E947EF812F44E322EB7B8CACA3A036DF000A5C5C3D692F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066000, "uuid": "e81b0869-2182-467a-87ba-1b44fec28da3", "value": "192:kE+yUBbID+JzF0C2Fu5rxvdK0PvfrOxf4YIQBeFU4lQV1yUBbID+JzF0C2Fu5rx2:ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066000, "uuid": "14cddfc8-4896-4e2b-a46c-0b67c60b7789", "value": 588608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066000, "uuid": "f675c968-bfc2-4fd1-bc05-770a8f384072", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066000, "uuid": "429ff54d-168a-4a55-b997-ea377ec5210e", "value": "Purchase Order 1015117914.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218493c3-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776060053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060053, "uuid": "de208ae2-9355-43e8-a6eb-76a66a72ccca", "comment": "Malware payload (DCRat)", "value": "4cc2d74b311dab0fedc411434602c3a3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060053, "uuid": "720863a6-4ef4-466d-ac24-1617036d0daf", "comment": "Malware payload (DCRat)", "value": "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060053, "uuid": "ceb9be9f-8a71-42e0-a9b8-9486aeeedec3", "comment": "Malware payload (DCRat)", "value": "0ab9702cefac8d97fe041d10e2e5050f1e3060c8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060053, "uuid": "1551ec35-1cc4-475c-a16f-c98cc15cca01", "comment": "Malware payload (DCRat)", "value": "e33d8f0a13686d8fdeb0517902345a351381af8979fe1abc7916f4e85b665d13f64e857ac39109057bcb1216e1314264", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060053, "uuid": "1c7f6efb-cf1f-46a3-a147-121b8721102d", "value": "T148E49D203BE94635F1BB6F75C4F66151977DBD627B2ACB4F1A90028E0A22380DD50B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060053, "uuid": "74dbec4c-455a-4fe9-bc1a-8c5d145e4513", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060053, "uuid": "a7f9f8a2-bdc1-448d-84b1-2f103cf4e5be", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbdJ2N7jqFM9iEbx9x/9vdxeTdiUX4xaIxs:U2G/nvxW3Ww0tdJ2EFMjbLxuc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060053, "uuid": "7dc20bc1-b2bc-4bd3-8545-d3b6eff90159", "value": 708781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060053, "uuid": "e89a7fac-6e30-4d0f-aa15-eec3356357de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060053, "uuid": "71844364-a34c-4dba-9d80-876e78c6847e", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7952085a-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043450, "uuid": "17b975cb-eedf-482e-8392-db3f66ed0c88", "comment": "Malware payload (Mirai)", "value": "42533799bb445c31b327beb3148e7e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043450, "uuid": "1f8e689e-04b6-4509-b070-85ee16725f10", "comment": "Malware payload (Mirai)", "value": "ae13f900f733a84a564e914891a4d1affb5ac290ee20b2b8208e8c20d5ca99a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043450, "uuid": "90c52086-ccad-4a92-ae9d-df5f4f00cfa7", "comment": "Malware payload (Mirai)", "value": "246305ec5c2ab60140bfbf25981aeacf215a80ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043450, "uuid": "7318b33a-9fbb-411f-b11a-423ce75e9cc2", "comment": "Malware payload (Mirai)", "value": "3ae9b10a36e1031d48bb96c0252d91dfb255a950cc1c7e7eeb13e7e74ae4651a1917807a7990c5f0ece90cb5defeacac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043450, "uuid": "f9b5ee20-1576-4cc3-8adf-4f8ac5e31f2f", "value": "T104933A4377090F83D2971EF03B7B1BE5879ABE5124F1E6847909BE8693709B26502FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043450, "uuid": "f03890e8-0a57-4efc-8a14-d90c14bc0409", "value": "1536:DJ5BNp9ouatBRT6lTzoiw4MLLv8dxuKW3Ce2I7a5qnJEr5R+s3D4Y3NtM:bHou4RZ54HI7a6JErTFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043450, "uuid": "f7195a44-60c4-412f-87de-0f58153bd2d9", "value": 94680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043450, "uuid": "309e8970-7a83-4ea1-bf49-0b17957bfdd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043450, "uuid": "fe04158d-601f-42d5-bfc4-340bc425e8aa", "value": "zyre.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e3ed3d-3707-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776064147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064147, "uuid": "472d3e84-be24-4f48-b4a4-2dfe183869fe", "comment": "Malware payload (NetSupport)", "value": "51065d1dacfb9d00df9c6913de0eeebc", "object_relation": "md5", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "pw-falos", "colour": "#3B5774", "exportable": true, "hide_tag": false }, { "name": "pwn-falos", "colour": "#0AEC0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064147, "uuid": "a02b7616-20db-4287-9c13-d1cfe5b6caeb", "comment": "Malware payload (NetSupport)", "value": "afe6bc8f12b08c0d52a20a4ef96c00c2187711348d5a4419ed96edff16fd4d15", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "pw-falos", "colour": "#3B5774", "exportable": true, "hide_tag": false }, { "name": "pwn-falos", "colour": "#0AEC0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064147, "uuid": "e5abecbd-df08-4204-9bf0-fd9d982fad1e", "comment": "Malware payload (NetSupport)", "value": "f6e97fe071af884e84f8189c98e1a06bcd3b9c0e", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "pw-falos", "colour": "#3B5774", "exportable": true, "hide_tag": false }, { "name": "pwn-falos", "colour": "#0AEC0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776064147, "uuid": "136d4cb5-aa6c-4079-8755-e877352438ba", "comment": "Malware payload (NetSupport)", "value": "914cd80ba4d1af591189dd64a7173c735cd690f8fc2a5b5ba0be47d435be6efe1aa8bc5444176d80287a77bb2e283ece", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "pw-falos", "colour": "#3B5774", "exportable": true, "hide_tag": false }, { "name": "pwn-falos", "colour": "#0AEC0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064147, "uuid": "f6aa12eb-b704-4e5b-b433-51667219c57d", "value": "T1F565338091456FBAD9C668ED19809B35C011F27A751F38B08B7057624BCF2EDA2B7BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064147, "uuid": "86f55110-620c-4fd6-a470-6598a5147500", "value": "24576:sqs0RYqN6SXEJPsVTAVi8mOsnE04j2PdJJtA681QCp8dYY2yDL29lSGgsD8:c0Rd8S5AVi8mjOidb6LQCp8V2vrV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776064147, "uuid": "9cef9e19-4776-4bd0-b085-8ebcac5e4b39", "value": 1506268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776064147, "uuid": "17583f77-21ea-4d4e-95f1-156b8584ca78", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776064147, "uuid": "7956b376-ff44-4f12-997d-5f3e495909f8", "value": "ggg.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a4c1a7-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085810, "uuid": "d286817c-5909-41b8-9877-202af4e0b73f", "comment": "Malware payload", "value": "685bff168820964d612a267bd3eea03b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085810, "uuid": "544ceb40-adc3-437a-8870-c002d0626aeb", "comment": "Malware payload", "value": "b00241cf8fb8990223b89e1d48dc0fe1d60ccce05706e817cef08a7a9591dc20", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085810, "uuid": "7fd6d004-0918-4d1b-9b02-ecac0e7c04b2", "comment": "Malware payload", "value": "af6ed04313f658c2a632ed53cb08e12ef21ff531", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085810, "uuid": "42b3fbe9-630d-4b4f-ac8f-ff6b27c902f6", "comment": "Malware payload", "value": "86e374b8dda4a6c247576371b72bd942ace6ef5cfa002637f7f48bd1d1060c08e03c77adb2be4cef88c5b7a53d866483", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085810, "uuid": "8d9ce188-9427-4435-a14b-47331087836e", "value": "T193D54EA0810343247DAAFC15E836AF5A9B050925F4C9EDB7ED5B1F58C80B4B5B8BC793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085810, "uuid": "f65e2fd5-64ae-4af5-9b8f-f6fa2983f2bf", "value": "96:JAWPSTA3ny9MSneZ4LR8BHSpOeXT3uSEnXZh+SX9iq/llEvLAgFxss5HrNPMA6wJ:iHcRCqOfD2E5prNAUvVONy0fFYaObAFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085810, "uuid": "5c074592-cb2e-4089-a000-46cbc83a0a21", "value": 2962645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085810, "uuid": "f8720e6e-890d-4a21-8f4d-ca3cdc46eccc", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085810, "uuid": "31b068de-2788-4301-9689-64890a71574d", "value": "TEKL\u0130F \u0130STEM\u0130 13-04-2026 PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e4da6a-377c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776114425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114425, "uuid": "bcb479e1-7ddb-4d05-92b5-d5b247b6b0ac", "comment": "Malware payload", "value": "5004ca0c607c6a6b1d82dc4c82423085", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114425, "uuid": "86bb8013-1497-4d73-aabb-bc0296ff147f", "comment": "Malware payload", "value": "b010baf97cd5c6eaf9151edb39cd68ce589f8da77c85fcc08412bd278962f69b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114425, "uuid": "667184c6-1266-4822-ae3f-daf0a3b17978", "comment": "Malware payload", "value": "54f333902a7781bcd9e4b70f5874f59cbb007330", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114425, "uuid": "bc203ad8-2d72-40ac-afbe-a49c2cfd0c86", "comment": "Malware payload", "value": "18c53a5955af696b68b844677f20b6e2fd694a01cb5df866418b2aa7beba3cba78a5deb93f9741fb68d41e66f9051704", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114425, "uuid": "9db1e8bd-942e-4946-8262-79fb8ce3d41c", "value": "T14CF0C9CA55707EA68024CF14E1760DD0530981DAB0E2F7E9A9F6042F8E98721F91CF97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114425, "uuid": "b9a91281-b5d7-4d51-9a29-7689a0db5144", "value": "6:SonH5fS87hnH5xQxpEWZnH5SFGNIMSF+5cinH5qX7K6h7hnHaa84nHLkLBLlnHhc:xD7xjM6WJPNIO5UrKsxJaBBD78n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114425, "uuid": "83e107e6-c72c-4f81-86a1-4348ba7cd860", "value": 640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114425, "uuid": "0b265d8e-d1bd-484a-a3fd-447c8cf36ec6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114425, "uuid": "e5a586e2-c072-401e-8565-2a03c4444926", "value": "w2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2f2c3-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046884, "uuid": "0f3a9412-67c0-4c1b-9240-af3eb1d1086c", "comment": "Malware payload (Mirai)", "value": "458ae0ccaf2dab0a740f47edc91bcf4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046884, "uuid": "5e84e810-e62c-48bd-86cd-58202ee3ee9e", "comment": "Malware payload (Mirai)", "value": "b0d2cd05dffb75f4a454d02cd65b96509ae3fe346d32d2695678c13815927074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046884, "uuid": "98cdc155-7747-48dd-a887-2950e8439097", "comment": "Malware payload (Mirai)", "value": "4ea1022a350d0facb35d88e6647ef5e139d0ffb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046884, "uuid": "7976baf3-24c9-482d-b842-00c9d65b95dc", "comment": "Malware payload (Mirai)", "value": "c6dc692d644ab117c797c86a3d5831c84eb48b7142da51a24d393a7ddb952d87d55c6ebe1c4794164007a632d12a95fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046884, "uuid": "c3622421-7a96-477a-baf7-ad7913f7dd18", "value": "T107931846BD428B13C5E220F6BB5E0199372657B9E2FB3246DD25AFA0274A4D70E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046884, "uuid": "f4ded775-084d-4209-a325-bddf7bf6b06b", "value": "1536:ecUgn7NBVpE4wD3zdyRNQl5K0US1t20YFQ3Hl4JqKBkcsp0kVC7/b9cqzRSmPMXd:ehgnNZdpb9PMXmbF8W5igOvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046884, "uuid": "43f88a38-7ce2-41eb-952f-3db884c6bbe8", "value": 96152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046884, "uuid": "d0d26f59-5e72-4b7a-a93a-39b51b83a256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046884, "uuid": "6d24c6fc-f123-4d3b-9fe0-0ec31d4936e2", "value": "SecuriteInfo.com.Linux.Mirai.10456.29695.27502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdf4545-375d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100982, "uuid": "87d1b34d-ede5-49f1-bb2c-d5671373533a", "comment": "Malware payload", "value": "2236690a1607054bcdabe7799c444708", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100982, "uuid": "fa71e3a8-8512-4892-9de2-a2927eb8603f", "comment": "Malware payload", "value": "b1f0984ab7e133d942f624e0b9eee13c11aae984ab386a265f46f3684c5b2028", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100982, "uuid": "6ae67098-2907-4a58-bff2-0dd1f710bd44", "comment": "Malware payload", "value": "2bc13a33781fc34877d92372dfd5d5032478d4e0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100982, "uuid": "41c80018-a4cd-413c-8878-df32d8acfe5c", "comment": "Malware payload", "value": "cc7c19cd562595f773e75e0e0fdc2e84252a4495d2b128de439854ba31440564b0ea19f5e3a220ef9d32c2e79210678c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100982, "uuid": "7a8766b0-a4b5-4720-941d-ef162662fcc0", "value": "T1BBE023D4CF55FF35C0700439C136F3100F5579250544B1E100D054D2D47018D3E3A255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100982, "uuid": "3a86bb37-8a90-4c85-bbc1-9df0df5b38e2", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWX/PpFFyC6w5fJWXfPHGPebRJ:4xtJCUOblw7BJYXHpQtXHFkUebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100982, "uuid": "fbbe5114-e8f3-465b-adb7-fb2a13b67254", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100982, "uuid": "fef0c4e4-0cf2-4ee4-a384-ff3b0c3a5c51", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100982, "uuid": "f7e4dec1-870d-450a-acbe-2574100003f2", "value": "form_96939.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e6723-3735-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776083969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083969, "uuid": "0ede1571-6814-499b-9895-79ca4e632835", "comment": "Malware payload (AgentTesla)", "value": "2c692c7a176a293adfcd5f635af6c425", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083969, "uuid": "060d936a-3e1a-4184-a55f-aa1025b18dbe", "comment": "Malware payload (AgentTesla)", "value": "b22c56c0c809bda92b3a5d1eb81c035235263e3bd2d126841345bcf1ee43b458", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083969, "uuid": "fe87f5b5-d631-4231-8f15-7a4a5629796f", "comment": "Malware payload (AgentTesla)", "value": "431f7fe68db86f4ac2612e2ac39ad735853532b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083969, "uuid": "958f4388-3677-4732-a2cf-7b9e4a7b78e4", "comment": "Malware payload (AgentTesla)", "value": "004b8d17d09dbaef2e6618b2747fde729ee75242f2d1470df6fc02ce36c1a92d5d8283ea63d93f89e7e76dc64b595918", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083969, "uuid": "fe52c263-f607-4f8f-8516-cb8ddc2f713b", "value": "T184568304C0F5B10D58C3CF5E967BD4B0488E796B5E4ECAA3A82FA87C1D5AF93691058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083969, "uuid": "39fad180-24fb-4525-9a91-9e8b33f489e6", "value": "98304:y06c3Lzgp2OyozbYNcqlg/bKS+PRHUfkB+pvrA8z8uQelbQ1hUvEjgC3V8oCxJCk:y06CY5Tqlg/hqqkBkU8wuQehQTrgMYQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083969, "uuid": "ea30835f-ff84-4c88-8b9d-eb3d13d1e517", "value": 6195882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083969, "uuid": "41a2725a-6451-478c-9990-c42abaf5f514", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083969, "uuid": "18cbf1e6-5613-49d7-9a2a-34c0544f608c", "value": "Quotation_Request_Documents_SERWIS_KOP.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e54aee7-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043485, "uuid": "ee48285e-ed23-424e-98e5-88a15c46412c", "comment": "Malware payload (Mirai)", "value": "72660afc1d93f452884fdb9b69c56797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043485, "uuid": "546f281e-7d1e-4105-b5ac-0461871d9a54", "comment": "Malware payload (Mirai)", "value": "b28e741586e1bc214833496a3dc54139a2d9517e78f2d4c3b94720a6bee66a42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043485, "uuid": "15fce77f-dd94-4cb0-961f-b84973bee2de", "comment": "Malware payload (Mirai)", "value": "19d6c3d9f6c8b390b15737d64cdd4958a7db9c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043485, "uuid": "3a01867f-e23b-484d-867e-7b06f5e26395", "comment": "Malware payload (Mirai)", "value": "5400751170a786258080fcd1b437c46eecbd3abd49f37a49a53a9a81e987755618aa4d6ba3f27c5c35f9fb67ad341293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043485, "uuid": "00196514-ac43-4c31-9565-096a95820dfe", "value": "T1F1A34C26BD764E17C4C2B1F712F30B34E5B2AB9A1C78860A7D712DCC6F642D032567A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043485, "uuid": "885da2e2-8121-4143-8e2d-f4bead9914f8", "value": "1536:6+e3biM51lhy9pTM2obveejJgntMC4oD5//tK9OHfM:o3biM5LhwpTM201JgnKC4o98eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043485, "uuid": "1e7de3f3-8b97-45cc-93d9-66d4e2e5df16", "value": 100356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043485, "uuid": "7b6c4fb4-ddef-433a-b510-ddc59a6e068e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043485, "uuid": "39c0816e-126b-4d0a-b6fb-45393661e839", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e33829-3757-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776098574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098574, "uuid": "ce97e1b5-f58f-4a88-814f-0c1b45b24d72", "comment": "Malware payload (Mirai)", "value": "663ef6d3481f90518b190723f6df4d35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098574, "uuid": "f69a7b90-4982-4044-87e9-ac52585a2023", "comment": "Malware payload (Mirai)", "value": "b2a4fa3b504c51d02c6f7235f46109a1ed161b80a3e1201077e076f34b05c353", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098574, "uuid": "ff5ae513-b047-4a10-baee-bd016048ad80", "comment": "Malware payload (Mirai)", "value": "6ac95460e9f78ef049beae2eed96c58227877deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098574, "uuid": "bc20816d-f167-4d48-8055-1a3093584cf3", "comment": "Malware payload (Mirai)", "value": "c62c258dfe0079227c83497441053e56b87330176864f6421ebd7b8f6e96bc428bc3534c0d04f3fb1951485ee82835e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098574, "uuid": "b10c6807-a9f4-4ed6-b503-83ac59dc0c6c", "value": "T15F9349C5F683D4F5EC5645B19137E3328732F03A602EEB57C3689D26EC91A50DA0A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098574, "uuid": "9b545635-a088-43e3-85d8-c22b2cef989d", "value": "1536:RlSYM51ovLZ2K28h/PXvvFlLUn1eQKvLvIytfmEUYsGOB6o3AJS6fl1:Kl51ozZ2K1X3nIn1eQKDvF7UUO4bA6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776098574, "uuid": "1f364179-49ad-4027-8d27-50e7519d84fd", "value": 90796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776098574, "uuid": "2012e871-a636-430a-b84a-82cea4707348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098574, "uuid": "b1a25b2b-22bf-4f2b-aee0-5669ea22d31e", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba035f7-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085518, "uuid": "f82e0e50-1062-49e7-9629-c314a385a0a0", "comment": "Malware payload (AgentTesla)", "value": "471c9df0a0f537ef6085ed3dd5fc4297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085518, "uuid": "a8b1a832-744e-4272-ae21-1513abf5123a", "comment": "Malware payload (AgentTesla)", "value": "b4b2def9b20e63ab8c71ebc8dbae6d3bfd330aeb5121ae36fc2195c21317d59e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085518, "uuid": "3a20bea0-2989-4cc6-97d0-5e944a6fdc46", "comment": "Malware payload (AgentTesla)", "value": "9cbc242920586ed0754b3affee986652bf849335", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085518, "uuid": "354e8fa1-62ab-40a2-9e28-502fc473818e", "comment": "Malware payload (AgentTesla)", "value": "fab675f35d976a80c3047c6feae3892371d962e87e358f946e2e24793c9e0f8baf0ec733d1bf6718fbe702a3be1feeb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085518, "uuid": "ce4d3efa-31c5-42db-ac22-a2de1be00d9c", "value": "T1B965025189C43FB8DFAC261D40FE251EA3F04EC95156A58AEB73BD4AFFA7604011B1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085518, "uuid": "e37fc487-7921-4b45-9594-36ab409db9f8", "value": "24576:uc3ksasZU/WDdIU0XNQDTzNSO3QGhYIrECM6rVcyPJK8:xl4m/0XNQLpQIJECWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085518, "uuid": "75daad41-1b23-418c-a81e-9a80c30c7177", "value": 1434913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085518, "uuid": "43eca806-6dd5-40ff-8545-8c31ae0be3d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085518, "uuid": "3410aa44-e54f-4405-bb7e-5cc87810bc03", "value": "Transaction_Payment_Confirmation_4-13-26.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b613fb8-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043454, "uuid": "d3f40171-3d76-46f0-a75b-ba2a708075f7", "comment": "Malware payload (Mirai)", "value": "4bc1d3c7b9994b1828daf0741d392a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043454, "uuid": "7c2e7ece-322c-4160-880c-e1354a75c184", "comment": "Malware payload (Mirai)", "value": "b55214bcf633f44838bf18240f1fa8f7ec31ba91b54fe778f7fb0a0da4dc4140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043454, "uuid": "0fa27f60-ed80-4f6e-adb6-20a2eba205fb", "comment": "Malware payload (Mirai)", "value": "025a95928a7d7f0b2db9bdd78d6b0414571ca53a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043454, "uuid": "3d441404-4257-4dd1-beb1-5fd1cdc62c10", "comment": "Malware payload (Mirai)", "value": "e38a7cd39d807416ed7fe8a4846ddee76d3a4eac6686415fd9f3a3633b1e2f7b45173a8a340091ffbd3b840cb3f80d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043454, "uuid": "28114908-1a97-40eb-8a96-77a22c63129f", "value": "T173933A037A4199EEC49AD2F417FB6230E932FC3E0A7672DD6794FD912B19E902E19710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043454, "uuid": "df91b08c-558a-4efe-beda-a3e3bc18ac46", "value": "1536:MDngHuaOG8kuVBNIkhQNu/qoTojBnymo38WHgZut:MDsusC5hbSokjBpc8Hct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043454, "uuid": "796a2c2e-cc03-4c11-a71e-0aedcac661fa", "value": 90888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043454, "uuid": "7535616b-9517-4870-a11f-661f9b9485bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043454, "uuid": "3c901f3a-09f3-4189-a3cc-51f3b29f0376", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369a88e8-374e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776094448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094448, "uuid": "83484a41-7a38-45e7-9264-556f16cdfcc2", "comment": "Malware payload (ValleyRAT)", "value": "44c8a070e0539e13656f271a10ccaa95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094448, "uuid": "ef74b21d-8678-416e-ade9-e1508311a1b8", "comment": "Malware payload (ValleyRAT)", "value": "b7002aa3750f1558f84702faf82416d3dbb5cd3b77c26bd577d14778c5acdb9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094448, "uuid": "48775746-f804-44c4-9816-d403a32973a6", "comment": "Malware payload (ValleyRAT)", "value": "3e2ea7a3938a3f4fc3313df15da207e16ee3caa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094448, "uuid": "9cfc3e15-fa42-4e82-a37f-b81dad1b278f", "comment": "Malware payload (ValleyRAT)", "value": "e21c692f21f225ab50afc831a3f38b84aaae54b4e8a8e48c333bc2e7ba6ad81a533ff80c4a1065fce08538e8756ac1ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094448, "uuid": "4b43f16b-3dc2-49d2-9079-9d9d0524d206", "value": "T1B3C56C11BB880627D56F6BFAA8F296068371F0072113E74F36D8A1AA1FD37814E157E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094448, "uuid": "d59d9639-c328-45f7-b413-8b97b17e84a4", "value": "8541289ad805913417662883d15a837d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094448, "uuid": "c7fd50eb-2f5c-481c-b97e-b718f3c59007", "value": "49152:qYjPReeO9mkInCJZ8gSJJQRjMpDLqRLhTWCJh2:qO8TIjDLaTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776094448, "uuid": "55417614-3ed9-4a06-93f4-ee93980d5073", "value": 2532195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776094448, "uuid": "08e40568-3a88-419f-b565-cd0581d7f05d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094448, "uuid": "0eadc723-aeea-40cf-a34d-de564d0d251a", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bbbc2f-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085478, "uuid": "504e9ec8-23bc-405c-80e3-4b373ad80abc", "comment": "Malware payload", "value": "0859981f9b8103b63bb10f27a37f538a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085478, "uuid": "e7e75384-e0df-4815-8159-67c76924e440", "comment": "Malware payload", "value": "b72a50e2eafd04169eb50da7276e462b666b6af6df24bb67003d3afe54c96776", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085478, "uuid": "08012fd6-f625-4148-8f9d-791ec490cba4", "comment": "Malware payload", "value": "2d2fe2e8ccb788cffc2d612e948ac37344817a4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085478, "uuid": "b967e700-4cc7-4db2-819a-634b06399f70", "comment": "Malware payload", "value": "1e7933c663b4ffae515af6c73af8154bbf502b14ee0a2ea5d38c41edb8877ef253b88e7fb8b8273c1c7fac1df77d4f80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085478, "uuid": "3bf6fd24-77f5-450b-9d31-8d0c7eb30f91", "value": "T17BA42D38ADEA401A7073EF54AEE47597E92FB773370E584D2081038A4723949EDD9A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085478, "uuid": "426f3a09-d275-4af5-8cab-a6cefd063451", "value": "12288:79OWY3Mrae7NvMOcwM9QhBaLbB14sOUUurzcEWCeLDFBstRaPQzQ1:tJps3vF81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085478, "uuid": "9a82410c-664a-4561-8b05-fd1c63af5325", "value": 473864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085478, "uuid": "fab4a1ec-344f-49f7-bf88-d6f6d8efbd37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085478, "uuid": "ca89bc9e-daef-4916-86b0-04cb875fbc9b", "value": "Q88_Navigator Libra.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fbdbf5-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776085458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085458, "uuid": "b8803650-26b0-43f3-ae63-f5b5ea8ada4b", "comment": "Malware payload (Formbook)", "value": "398c3ad00b40ea5d74f011c09a35ea2d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085458, "uuid": "dece84f9-4621-48ef-8e33-312be00eb150", "comment": "Malware payload (Formbook)", "value": "b7e00e5c34f300735f81e4d3ad3a1631795d91f731a469e3a018301806e46ec5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085458, "uuid": "7946fdaf-e388-4270-be2e-2c1dc96c0f06", "comment": "Malware payload (Formbook)", "value": "104a63ecc21a04ae454abd9e77f3613cc7889a5c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085458, "uuid": "37f6a1c2-467a-4685-b8b7-872ff0601ca3", "comment": "Malware payload (Formbook)", "value": "dadc8de7f2792e36592f9fc37d61be0cd16e15dbcbc61331f53c2294c37e6d9cd65be2f5798e8b19401d23443ed213ca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085458, "uuid": "fc5bbd3e-049c-4f81-b0b6-1ee3132657f1", "value": "T17D95021589C42FB5CFAC561C80FE150EA3F04E8A906AB98AFB73BD47AFE7500511B19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085458, "uuid": "be33a656-4ab0-4728-8d2e-575677346c78", "value": "24576:GtBtNZmDwyWqVgyqjCu+NzS6dDjDlVs+rwgsuyJNMpdX3FOgT+u+YJvCovK1:MBtZMVX+eOY3Dsdgnlack", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085458, "uuid": "1a690d92-4186-4f08-bc47-32848772f89f", "value": 2061417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085458, "uuid": "ec8e7f19-ef25-47fa-8989-1215c660f043", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085458, "uuid": "c08caecd-ac41-442e-9e90-d1f80a02e26b", "value": "8948-09987-1243-457-Aviso TT SWIFT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede7cd65-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048800, "uuid": "99f6e353-3c74-4e06-b7e1-c063528949a7", "comment": "Malware payload", "value": "81f15dd9d2a733da8f6d6503e41b9bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048800, "uuid": "d69a9717-b9b9-44e4-85f4-af70e79aa0c7", "comment": "Malware payload", "value": "b93c618ad50e352fb0af396beacb05064ddced1f932924a6f13aca387145a4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048800, "uuid": "00811fb1-9753-410b-bf0b-3ed603c7c105", "comment": "Malware payload", "value": "07f11063040e023e9f75f623e7ae94fc0f8c6a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048800, "uuid": "13bae155-6c02-4710-a40c-2cbcb1f6d91f", "comment": "Malware payload", "value": "230e1898d99eeb2a1dc341161635a5e5a33cb1514181db998c108482c437f52f605b884edcbd16c0337999eec126382c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048800, "uuid": "a953d95b-a5a9-411a-8d66-c7b3e66ad842", "value": "T1937533C065F4F12AE9086E7D8F43886D26BEF1FF35D18E1050D192EB29721E86D475CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048800, "uuid": "561d50ad-9e0d-45b7-8bab-d16824f5039d", "value": "24576:LtXhU0uQJLUDbKc1haqAqrSJq//H7Tlg7CbGQdVxMor2UzScxY+ethu7vM3N:BBzJ+eqNrSJq/vbXUU2Ex6Gk3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048800, "uuid": "2fbe86b0-e550-4a71-ba08-95e31a4a2d14", "value": 1681924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048800, "uuid": "6389e3df-6a83-41d2-9c58-ea7d55414d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048800, "uuid": "a5254336-862d-4b88-9e3a-6f04ed79f057", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6598ce3b-3702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061885, "uuid": "4997c31c-8137-4942-bd6d-616d46d241fe", "comment": "Malware payload", "value": "c722618b11b0ef6b35d6cd9f01dc051a", "object_relation": "md5", "Tag": [ { "name": "extranetpanepartner-com", "colour": "#8968F5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061885, "uuid": "f95cfccf-81ae-4e3f-8d5f-62d047e257b3", "comment": "Malware payload", "value": "b942e7a9277d82678e3d0ffec58b5d030a403e234da2117312beacd6640e9c10", "object_relation": "sha256", "Tag": [ { "name": "extranetpanepartner-com", "colour": "#8968F5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061885, "uuid": "c3a85fc5-7eb8-4925-aa15-ed41980bb810", "comment": "Malware payload", "value": "d13263ad33df524435b1483c27ace06d44bebaf1", "object_relation": "sha1", "Tag": [ { "name": "extranetpanepartner-com", "colour": "#8968F5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061885, "uuid": "23ef46a6-9f5b-482b-89b6-8b35ac69d04d", "comment": "Malware payload", "value": "d64c2162259dda9d0485d4143b28db79fdda3b30767cebadf69a467db54b818910a64bce50da910e5ee0b40d02cbc1d9", "object_relation": "sha3-384", "Tag": [ { "name": "extranetpanepartner-com", "colour": "#8968F5", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "promocalcsotyqs-com", "colour": "#439952", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061885, "uuid": "fd446634-a341-48f9-8d2c-b05ca4dcbcb6", "value": "T1F892B7566AB300226917C0BC67A79746333180079645CE2E3FAC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061885, "uuid": "bb35e8c8-e982-4679-81a2-3eb9277c1c86", "value": "384:XHFTAsXe7FUF6/+9MAUksb7ROsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xl8sXe7FUF+3EsafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061885, "uuid": "6c64046b-2756-49b1-8f28-181066a1a368", "value": 19799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061885, "uuid": "32672952-455e-4c37-aea1-d54f6f76528d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061885, "uuid": "7ede34eb-8d07-4f68-b253-b9be46fcfb1e", "value": "vp32ssdaq.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1e8157-3791-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776123480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776123480, "uuid": "37653860-4a18-47ee-bcc0-80534acb1490", "comment": "Malware payload", "value": "31ea3a2be4cb00127dc6dc2feaf5266f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776123480, "uuid": "e1e927ce-3006-437b-91f2-e545b89f8fc5", "comment": "Malware payload", "value": "bae6102a2c61c78fc15295464ea0aec0c565bf2763fb804451cfbaf8a0a4fcad", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776123480, "uuid": "55ef6989-32a9-413c-b62d-b961246a1afa", "comment": "Malware payload", "value": "d312eef678b0d2aa3c7b0a0f241b8ff78029561d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776123480, "uuid": "02454fb9-eeaa-4066-bc1b-fffeb4c5abb4", "comment": "Malware payload", "value": "35e976ccc1ae26b905c292b3be90df4a2e704cf58a437436421a23baf01c3102a95b3e51fa6dc3ff7f8d7c6331066a67", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776123480, "uuid": "6d614f0f-aadb-439f-b46b-ab6faee7221b", "value": "T15BE364A94B4A06EF37AB651CA11F1402CFD0652A031DE48CFBCDE2E95F59B41D1CAAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776123480, "uuid": "e0c6a981-646c-4cc0-b53a-d471f507e35a", "value": "1536:j+ijT2hmFUfcKvE/EAWnWbpk4a8y6aLtUTQq:ZFpWnWbpo6aLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776123480, "uuid": "83b38edd-31a1-48ee-b186-9b0a8f61290d", "value": 152894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776123480, "uuid": "158eb77a-ac1b-4236-bd78-e0e068e4e437", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776123480, "uuid": "4749a564-6060-4942-84e0-98d59d154696", "value": "Audio_UK__82.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250a10e8-3738-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776084970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084970, "uuid": "33011bd2-3fe3-44b6-9f34-30fa9cd9c455", "comment": "Malware payload (PhantomStealer)", "value": "0382015813d30c0cbe4b528ba2b1dcf6", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084970, "uuid": "0575fca9-2c0e-40ce-87dd-c35af36e7672", "comment": "Malware payload (PhantomStealer)", "value": "bb7714c2aeba066621f1f7606f95e8103336b4147ff2ec6b0bc3bffc9b284754", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084970, "uuid": "d4a6b3dd-cc6d-4da2-ae4c-95e0c6750e11", "comment": "Malware payload (PhantomStealer)", "value": "710b500086d78940b41f39c53d4777852f7fe5df", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084970, "uuid": "cb10cf01-df40-4ab7-80a9-1cbe0499fecb", "comment": "Malware payload (PhantomStealer)", "value": "8acc8a800e964fdf889a4c1481d160bcf09625e7196dda9af6e285025a8fbacbfddaf9082f0dab7f976399d0cad88e82", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084970, "uuid": "0247025c-d922-436f-863a-2ae89ff1c0f1", "value": "T1085332418E05CBA4C97F16926FEC001F1A54ECA76CAE7EC8557F60898E06B6F4FD904B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084970, "uuid": "c681fbf6-191a-483c-84d5-c880f8b9f616", "value": "192:2RH9kL64JKARKBuEEGNHWJ4oRYy4yW5e9JoXt2YqSwosxbxJ+JHEEh17q4yHhp:aCJKhfN2Jtq2kyaBEwqDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084970, "uuid": "743f3439-555f-4269-ae89-9140e57cf811", "value": 63774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084970, "uuid": "15444018-c12d-4ded-8ce5-0d948708369f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084970, "uuid": "14a14dfd-f695-4141-826d-7f436caf7010", "value": "KARINCACIVATA Teklif Alma-Elekt Malz. sip. 928282104- 2000 adet.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c9a039-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046877, "uuid": "a5756ff2-ae9e-4a9a-8f7c-130d545c833f", "comment": "Malware payload (Mirai)", "value": "b752bc7ff426f732472130cb0c799231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046877, "uuid": "29803e80-7cce-48bf-9cd9-b9c3f57e61d3", "comment": "Malware payload (Mirai)", "value": "bc0a4d283fa9d777ba13882fb5d68853776c1b031b23297997a56c65db5fe852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046877, "uuid": "d9e31f59-8de6-40a8-bfb2-4768b886810b", "comment": "Malware payload (Mirai)", "value": "0da4c56d1c6c39d8206ec9a4290bf12e92f6d507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046877, "uuid": "d3780f10-a1a0-4401-85d9-06bb9d86936e", "comment": "Malware payload (Mirai)", "value": "13bc711fedaeef43f6be40b4aef8bd6a54525379273e97ad4cf7dc545f615b4520f845ffb5a896f5ffee97d190f6cecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046877, "uuid": "cd274d82-c420-47b2-a636-1c72bd8b2962", "value": "T179A34A26BD728E27C4C271F612F30731E5B2BB9A1D78951ABD722DCC6F241D032567A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046877, "uuid": "8d3d6b27-bb79-4f46-8a45-540cfb03a8b0", "value": "1536:nTfoF15OozL8+1rowO2yOQ+98tPcgoD5NODtNDlWI/vd:boFjzLJ1rY5/o9NOfZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046877, "uuid": "1bd2a482-216d-4694-b753-f198ac179adf", "value": 100656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046877, "uuid": "5e7fd716-ae64-42fe-a151-0b1c5351a1a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046877, "uuid": "82037bdc-3390-426f-97df-169964d600a8", "value": "SecuriteInfo.com.Linux.Mirai.10456.23539.2237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e5cca0-375c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100703, "uuid": "aee711a3-b22f-469a-a811-6af90ce53da4", "comment": "Malware payload", "value": "0e9bc9252b008a09e4898681fb9d5a36", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100703, "uuid": "75ff2a44-6b78-437f-b831-8093caa29ad6", "comment": "Malware payload", "value": "bcd5bdcd24000fddd5c512609692bdb62208a1c9c6081cbcfd08d53ea171824c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100703, "uuid": "0eac179e-92d7-44ed-bb05-8c2faf19e6b5", "comment": "Malware payload", "value": "894cb271211c3764ea25c1a994629ce6e4e9a462", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100703, "uuid": "fbd304d8-9a7a-429b-bf42-ee622c603773", "comment": "Malware payload", "value": "87cedc670ef86880ac04a2cacf919d3367c2d45ca4393b653d39aeeb8c3f87707d9a580c3321d3c87631391072b5ddf2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100703, "uuid": "c351215c-78b7-4cf9-a1c4-d6f65a565d0f", "value": "T115A20805AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100703, "uuid": "e0be0f83-93cc-4a39-9717-9869b36076ec", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100703, "uuid": "a6968d66-237f-4a4c-85e2-311d23441f98", "value": "384:Ou1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:ONuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100703, "uuid": "a1ae7c0b-a899-4e2e-aa6f-9a3ebd3bff4d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100703, "uuid": "80a91cfd-3cbb-4423-accc-67714d804040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100703, "uuid": "7885dd7a-ae41-457c-bbcb-7f16aac82636", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9a4e40-377c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776114432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114432, "uuid": "1edad2a5-3899-4cfa-93cb-95e5ddc0b7d6", "comment": "Malware payload", "value": "846b7420005320484499174f49552461", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114432, "uuid": "ef1ff569-30b2-4e47-b454-b761c1b4eb56", "comment": "Malware payload", "value": "bce106c776cbb7296726c3e1a16c516b29ea4b2d8507546d1fe9b4fda7421d8d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114432, "uuid": "2733c22d-3bda-4dc0-8da4-8f5e5ffd95a6", "comment": "Malware payload", "value": "36592d3c43ae63716c23db130d0bfe5e1f65c05e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114432, "uuid": "66013e9a-597f-47b4-aa63-0e3998d78dc6", "comment": "Malware payload", "value": "bd4d48cf10582dbb8ffd5016793e84fcaa6941bbc2bf7aa0de8b01d71731c38793a8a03b1e5fd9160a373c4d06e03757", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114432, "uuid": "ceefb0fd-05b9-4040-baa8-ead6915843bd", "value": "T19FF0C9CA5570BEA68064CF18E1B60E94921981D5B1E2F7E899F6042F8EC8701F95CF97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114432, "uuid": "c4e4475b-038d-4893-b782-1f3d8685552d", "value": "6:SonH5fSvmnH5xQxpImnH5SFGNIMSF+5c0Z0mnH5qX7K6mmnHaa8G0mnHLkLBLWCH:x/jM1PNIORZ7UrKID7aKcBzJ7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114432, "uuid": "2f59ba7e-6fe8-4de3-8d41-ff4d49ccf54b", "value": 626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114432, "uuid": "dd02b8b6-1900-41ec-a57a-8fbc84ac068a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114432, "uuid": "88e673f2-aa57-47c7-a3f9-ac891f13c51c", "value": "jg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a7d9b6-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776085837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085837, "uuid": "ebe16285-3c0d-4a9e-819d-ee09eaff9227", "comment": "Malware payload (XWorm)", "value": "6bc2dee0527e824657297a87a6adcd98", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085837, "uuid": "e979b9be-8610-4a4f-95b4-e05119fd303a", "comment": "Malware payload (XWorm)", "value": "bd1a108beb9193f36dfc1dd06617e929f4aeb63da30eb1c7908d5ab7801a445c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085837, "uuid": "61594d07-63af-41bf-ba7d-a5ec3fc4f6eb", "comment": "Malware payload (XWorm)", "value": "87ce46b318fcbc0f3a20c128a5f829e3ac968534", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085837, "uuid": "03ce547e-bae2-4662-a407-15274df47249", "comment": "Malware payload (XWorm)", "value": "7ebb2fe79320e018f18e7af36770e9b3e5c3dcbd8ac5d5c9d6a54ccacdd7f662855ae600709fc37a98d7108e85a7d433", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085837, "uuid": "5e03451f-8ff4-4eaa-a14d-49d8a2f6bd9b", "value": "T124D5241EB4343A7213F013731CAEB836E5F4E97E332EA816A59246C61145C7FD3A6B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085837, "uuid": "017800e5-5bf7-4ce8-afe9-abe5b30db996", "value": "768:xUjh+KKK4gj1ZQq+6rsS/iALQ1CbTwXAABUQHUqyqIcRaXmjKkNJNYOQYb7XhRPn:4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085837, "uuid": "b8f46988-0fed-4a5e-a538-35a8926d1bc7", "value": 2951011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085837, "uuid": "58bda585-dbea-44d3-a3d9-3b6d761229ba", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085837, "uuid": "5ae09c7f-075b-459b-9d29-10557ed388e4", "value": "Contract_13_04_26_8902.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe68895-36e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048239, "uuid": "071dd767-713c-4066-9503-1373839a76fe", "comment": "Malware payload", "value": "0342f693c43707bb3ca09c6ab48e6e4f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048239, "uuid": "875854c0-48c0-4c25-ac0d-fd6ad76b5281", "comment": "Malware payload", "value": "be82c8c77e6e3f64ece7df84511c4dbb60c80244ec03255ab462ff2300180ba9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048239, "uuid": "6cb5c668-8896-49bb-ae9c-d086f52829e8", "comment": "Malware payload", "value": "3b002dc525ac2acaafc638967133820083b28c39", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048239, "uuid": "615f0f04-03d3-4ec7-aff5-92aba36bd919", "comment": "Malware payload", "value": "e28e4e9377c581b4aaeaae48f0b0bc200ca3149d9ad5f110601cc123056678db7c8a02f79e0cbee9cac949930ef1eea9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048239, "uuid": "5d9007fc-4130-406c-8a81-eb7b01ea3a9c", "value": "T166F039EAF00512CF812DEE0420B2CD8C7153C2F062A98E1B6EC9283A80CFF02B821E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048239, "uuid": "062d7207-4842-4d73-ba8b-9adec1524111", "value": "12:W28aUJ5B5jNITTg7kgkSEJgvnZ35XEvCHQgjKgRO:Wldf5jNIo7kgrEyV52CHpKgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048239, "uuid": "9169017c-219c-4264-87be-b1a8f18d3a0e", "value": 485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048239, "uuid": "fbec5bd6-597b-4dfb-aa2a-66c040b29f2e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048239, "uuid": "b84e8c05-9bc0-417b-857c-b85b99a0c103", "value": "bj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eccd7d-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776085721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085721, "uuid": "d624a045-e3ee-4f67-86e0-35f3c0cca7ae", "comment": "Malware payload (AsyncRAT)", "value": "045bffd04bfce9dfd69bd883fcb0347c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085721, "uuid": "707ef9a8-b2b6-4702-b2be-d863c6038616", "comment": "Malware payload (AsyncRAT)", "value": "bee1a2041e9433e9f8a92eb55327eded19229f0c46ec267c0e32c5b37ba9ce50", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085721, "uuid": "0beadee8-3143-4980-a8e6-dc2a3b148e99", "comment": "Malware payload (AsyncRAT)", "value": "afddb43275244f84e385269feb49282c666695e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085721, "uuid": "909dd1a3-a7c5-4a24-841e-5a3400d0e7c6", "comment": "Malware payload (AsyncRAT)", "value": "56c2583192d59f564721b4b55b3f042f174d0cb2866c67ef5d259e3aa3cad79ce735e5824612ba402b93c47b49b8818a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085721, "uuid": "52e72309-3804-42d8-a080-95f1b80367c3", "value": "T1C5B5500DD0C9905662C4A38FDC3F9D54133FFB4B297615CEE9E865CA809703A4FA9AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085721, "uuid": "f05e5d24-d857-4ce5-9984-8ffcd5491f63", "value": "3072:vxsds6YymYxjXFX6m6X6XmsjXCYyYYmmxFxzXBm6sdmjXjXBsXm6xCsFXnxosXYD:fH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085721, "uuid": "832c0b40-3b4e-4be1-a153-f56708323994", "value": 2489277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085721, "uuid": "a37f88f7-6195-497d-9f71-b573ec7ccc5d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085721, "uuid": "d127105b-6e4b-4359-9b00-f9697b2b03ae", "value": "ORDEN DE COMPRA_HTML.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7311837c-36f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776055036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055036, "uuid": "cf4a07fd-95ea-4035-af3f-8ac0bef92acb", "comment": "Malware payload (Mirai)", "value": "f219c955ce82bbe13044bfb8381b4cf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055036, "uuid": "bd09c83b-7906-433b-8ef1-e80b9b558301", "comment": "Malware payload (Mirai)", "value": "bff36ed4acdbafe5dde46d2159839efcb33ab941cd568463c0c03d53db2490bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055036, "uuid": "b505dab7-94b6-4224-89ae-bacd943aaf7e", "comment": "Malware payload (Mirai)", "value": "421d612785ecb8bdbc57c7965cdc049b534a8138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055036, "uuid": "042b81b3-d7e2-4e50-835f-87e5366beb89", "comment": "Malware payload (Mirai)", "value": "3576a5d93a3e85e8def1c2470ca7b4ef6e9e9728e03ab7df3347a9a585ac0bcc647ccabbdf7a6685d1ac01988802b012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055036, "uuid": "e6145ae9-f96a-4b94-833a-02f144feb9b9", "value": "T164F3C6169FA10EFBDC6FDD3702A9060235CC954722A43B763674D528F64EA4F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055036, "uuid": "3327639b-84a7-4d68-a456-7a400ca20e52", "value": "3072:JFnGtX51a1jRnQKGMg2wn5tG4TI+xukAm:JFsXuWKGvjLvIlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055036, "uuid": "6087f54b-a97d-4ef9-882a-64b2ad1d8ceb", "value": 158152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055036, "uuid": "a1252a96-e4d9-420b-8b30-042d219560d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055036, "uuid": "8923d089-7b32-4945-9ff6-8539fa36e5ab", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76826d5e-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046881, "uuid": "139e13c9-77fe-429e-88a7-83f13032d5f7", "comment": "Malware payload (Mirai)", "value": "e3dde90f8366c191bb1ae9614b51e28a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046881, "uuid": "49176b15-3cb2-4b86-92d2-57eb7f51b1f6", "comment": "Malware payload (Mirai)", "value": "c02ac387458ce776a6067d0e92612ebb5bce47ea2f94c30cf10aad943e8da346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046881, "uuid": "fa11b25a-5cd9-4133-b737-c10297a7f403", "comment": "Malware payload (Mirai)", "value": "7e4438f537c4fa3afb5f0e7a838cbbb4be53f38e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046881, "uuid": "aa00df54-5ec0-4c51-9660-4e0a8b740ca0", "comment": "Malware payload (Mirai)", "value": "006e068acbff5f0feffc5b82417b52c10eb833eb9b996741d5e756efb3fb9b46767a334f10b060b9356e379187642d80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046881, "uuid": "a24e0cef-f57f-468d-bf18-6d14146f0932", "value": "T1028329B1FE878AF6D40754B101EABA7F8A71FD2E4431C66AFF646EA1C7135C12206358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046881, "uuid": "dcfc8494-07d0-47a2-a1a4-fe696fe27a16", "value": "1536:F/YNkRkcdOtLVdO2zkKdJcyuEs0bdZ1q9FcYJ6iWz6TgVo8E4K1x3Ipx8nN9g:/6LtLp5bHQ6YC+qo8E4K73IpIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046881, "uuid": "6d830266-1016-4015-b2bd-4b2dd8ccafd1", "value": 86504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046881, "uuid": "61254636-d5b3-48ea-b4ba-95d4ce91dc39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046881, "uuid": "0bf81daa-8ba5-46c6-a38d-0e9bca602e66", "value": "SecuriteInfo.com.Linux.Mirai.10456.27663.25411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca39851-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048798, "uuid": "f97c7f0c-b0d1-4d6b-8acc-7a170f24efab", "comment": "Malware payload", "value": "e8837605776bf95c40a97d71371c682a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048798, "uuid": "1e7e0ce6-ea69-470d-9546-5279963a2a83", "comment": "Malware payload", "value": "c02e191211ab121a5b04fb0f5c9b4ab1df8ab11d97c478e5abe07cbe44bf72a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048798, "uuid": "236161ff-2f15-4f10-93c2-64e11831bd51", "comment": "Malware payload", "value": "cc121d4a0449895e0426f99e5549d761473dbe29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048798, "uuid": "07125ebf-fbcf-4f28-8995-60eef53df6ed", "comment": "Malware payload", "value": "1f8d6b4207c43568de6827519ec64b9f69cbabda57ae35890bcc0506fbfecd404622a0fce4014f77926f115a7ed5cb3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048798, "uuid": "77c4dc78-66c0-439d-892d-9828558ca383", "value": "T1F68533858FEF634C19F11D8E716C987A9B54CB90DE4E87961D0EC386AFC674C632260E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048798, "uuid": "a53fc575-271d-42c4-94a3-5bb3db07d6e3", "value": "24576:62vGBwq/9WXiAbd9bXLqW6XW04oaez+CqTEXmjEOTATAGwBGBRz37CKCY30Q0+j:/qAFbdc7pl+CKZQk4p7CKz3j0+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048798, "uuid": "fb008a5e-b512-425e-b213-e53f6e5fd389", "value": 1739052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048798, "uuid": "8f6c8b85-d645-4bb8-8714-c13ff7e21caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048798, "uuid": "30b9ed90-90f5-4d93-9722-acf458c00009", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c74eb6-3721-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776075170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075170, "uuid": "469965b4-17e5-49a0-bfd3-297790d11c04", "comment": "Malware payload", "value": "9a250758964b408b076d71e9c9b813ce", "object_relation": "md5", "Tag": [ { "name": "brio-js", "colour": "#145EB0", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075170, "uuid": "43542142-8e3e-497c-8ff5-dcc9a2d13622", "comment": "Malware payload", "value": "c0eddca1acd16d28bcda9d19c37a6888f36a5a961884e5e7b8f638e5225d7863", "object_relation": "sha256", "Tag": [ { "name": "brio-js", "colour": "#145EB0", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075170, "uuid": "f1215b9d-5dc8-4d23-88a9-a858d556b87e", "comment": "Malware payload", "value": "fae49bb8995f168a625711ca75199a0adabb40b3", "object_relation": "sha1", "Tag": [ { "name": "brio-js", "colour": "#145EB0", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075170, "uuid": "c752163d-860a-49b5-8b7e-b2ef25bc7d74", "comment": "Malware payload", "value": "de14119dd17fff7292c7cbaa4cce9a3b67c2abba53be8b2bcf5211d7b03530a54e681960126852270046cf6b2e6e2e26", "object_relation": "sha3-384", "Tag": [ { "name": "brio-js", "colour": "#145EB0", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075170, "uuid": "fd48c3b1-e874-41aa-9a48-e78882f57012", "value": "T157542341AABDF85B3572155FCA7E90CF5878000AB72762445DBF01B1866B8CEBB83327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075170, "uuid": "1f0efcea-78ef-4ddd-831c-3af553900413", "value": "6144:bu6Vzpaxwa+epJ2myL8wnR74eZeQ79Ka9G1tbp7:Ssaxw2J2myLzR74eZeQpKaSl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776075170, "uuid": "ae987226-db72-4051-8082-bd6200cd09f3", "value": 279173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776075170, "uuid": "857d5305-fd6c-4c0e-b818-e6c8cab29641", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075170, "uuid": "95f7174f-a1ce-4de2-92e1-87c7eef4e843", "value": "Brio.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1ff82-372b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079513, "uuid": "bae02e99-3ee4-4bbc-b597-abac9947173d", "comment": "Malware payload", "value": "7528bf597fd7764fcb7ec06512e073e0", "object_relation": "md5", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079513, "uuid": "1895eff5-e116-4cdb-b82d-5873e8db07d8", "comment": "Malware payload", "value": "c13c194fc1a119fd110ee75f8011eddf126197bb76e404e17a6806c88960e6b3", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079513, "uuid": "5ea792c6-b371-43a7-ac27-d85528167b7e", "comment": "Malware payload", "value": "2a70c867740bc0756260d799e3b1b07ff7d7e29a", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079513, "uuid": "40a770b2-7579-4762-b0f1-b5cc31384fa5", "comment": "Malware payload", "value": "f1a499709b877f1389e0827631805fea54b7b2d905cf4c6f4b89b648f752dcb565b53220302226266940ea986e2ec6a8", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079513, "uuid": "a3c3fa59-c290-4ed6-8a1a-cce6ffd3eeb1", "value": "T1F2E4291BE6928AFDC46BC234C3969772BA30F45A5128B70F1EA8C7127E25D608F5F354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079513, "uuid": "7289bb13-5b3c-41cd-a39d-be4da04ce480", "value": "a5d37f77665986a642378fe387894223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079513, "uuid": "3da9f523-ea1e-4b68-adf8-ede0ea242b84", "value": "12288:H2odGmZ9oMGyDAM8ZnA/jz5R4W3XkUrO6m0EnHRf:HTgmZ9o9yMM4NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079513, "uuid": "2737ca68-9d6e-42c9-a6fa-7365c3074831", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079513, "uuid": "d32ce3f3-6cfc-488e-a528-03975b4a18f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079513, "uuid": "57b0f21e-5696-419d-94a3-1beef2580706", "value": "c13c194fc1a119fd110ee75f8011eddf126197bb76e404e17a6806c88960e6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4842d5-36e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048232, "uuid": "29d34b3e-dbd6-4605-9d57-33e68c72c28f", "comment": "Malware payload", "value": "e5ba5c77287071bb823c23107e9571b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048232, "uuid": "6c7bbdc6-0a80-407f-9656-bc82927ed11c", "comment": "Malware payload", "value": "c2569d8726e7f74f8c7b8679350e42979e5259334557316e85fec3cc2d5fb16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048232, "uuid": "3833d37f-962f-4918-b132-43430c3317bb", "comment": "Malware payload", "value": "c5334de153ed128269e908deb89d3081fbbaa669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048232, "uuid": "04cd0e39-e2fe-44b7-85c3-c696b0571ced", "comment": "Malware payload", "value": "5e589c3ec81c744d28abaa16cea5d4173a327ffa9ff15088342a8a787dbc48c933d4a8c9117a952e489b431714b85bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048232, "uuid": "7c9357f4-4ace-4e85-a48f-a5371ed63db7", "value": "T13333F885FD15971BC7E272FBE788038D3B3A1F6CA7E6321659316E9123C5AE0253A130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048232, "uuid": "42fd5865-1945-4e94-b282-6324d94235d1", "value": "1536:kQlapLajBNuYssqXNMrnKaj8tUglxpNG:tlapOss+N+KaTgZNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048232, "uuid": "430dcc5b-8ff4-4e3d-ae0a-0972e6019b7a", "value": 50192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048232, "uuid": "a8ef8cf8-efcc-47ee-add8-07a538e445e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048232, "uuid": "16670886-a136-494b-9b3d-7ad341342fc4", "value": "ultron.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7a0648-36e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048237, "uuid": "03c4df53-9c0e-460d-80b3-11e74041bc9f", "comment": "Malware payload", "value": "f0340815728aa3f1ca552139824f207b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048237, "uuid": "f91341ae-0a81-4f08-a6e6-ad9668293a0f", "comment": "Malware payload", "value": "c28a374366e78132a6a53fa288fa603c881497f2807f9314866369f2b03500e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048237, "uuid": "afc9ae77-76bb-4d02-af8f-2eb6f388643f", "comment": "Malware payload", "value": "af89b321e5e8d85067db61fa61362067568c6e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048237, "uuid": "808b35ce-a648-47e6-ae68-298a7e90862d", "comment": "Malware payload", "value": "4b2fc410857b718b27f0b1c5dc244a8232801629cfca289da0807c8afc546d6e1da1a7dd8c675aed984fbd1593182804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048237, "uuid": "299d4ed0-59cd-4b39-a40d-9815360cba32", "value": "T15A531B49E9515B19C7E232FFFB99128E33131FACE3EA31258D30AFA023C56D61935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048237, "uuid": "895163dc-ccd7-4fd2-a244-223c4a4970e8", "value": "1536:HNnUFUUgimS+QttaD73LNIHiQTNkBQYIL5IYGhn2:qFUUgicsakTNkBQYILaZhn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048237, "uuid": "a4bdb071-6c4d-45c9-9593-9836008008f3", "value": 65464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048237, "uuid": "8d7a0817-637c-4ecc-86a4-c2f279be9a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048237, "uuid": "8d73efdd-6667-4595-9c1d-08b5cc79ec58", "value": "ultron.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6096e9-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084692, "uuid": "c6c11f3f-e118-4142-b649-44f6e50dfbed", "comment": "Malware payload", "value": "c2883d75600cc1abc9256ffef31783bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084692, "uuid": "29a9768d-f58c-4e0e-9696-22b6f5adc08c", "comment": "Malware payload", "value": "c2f15bd02efacaaeb2162eb34caafb3decf576d2c21805af20c9afe3b4733382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084692, "uuid": "26c6b93f-096e-4dfb-a7b1-fd11cc94772b", "comment": "Malware payload", "value": "71d1def3be59cba0a0dedc432a22370604e4ade6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084692, "uuid": "6669a7b7-80aa-4ea9-a2f9-d625f662ffab", "comment": "Malware payload", "value": "27b69c568551ad22345fc9db3298cf7c838b893d30f9b48c0ccffa58b58e08b6146c6d5b2b8523e7919f54359d40e907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084692, "uuid": "aefd781c-0708-4aff-b5e6-dfc03611fd66", "value": "T1FA836B11F241C035F0F700BAC7B54B7A9EACAF20636450DBA3D855A9DB71AD1BA3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084692, "uuid": "18ec8126-594a-4f66-acd5-8faa4a4c4829", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084692, "uuid": "cdd55bfc-4be3-487b-af30-931cfbe2ee4f", "value": "768:D1AZZYr8n6KbXN+B3upC+3nZuif8rZehyiuoZkk0LEDxCnfAiVFi0o3AhRKBBRHc:DwS8n9N+Bk13Z7yIZkRF7uAhoB2yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084692, "uuid": "e78dcd13-c91d-44f1-9c84-30b7702f031e", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084692, "uuid": "28f2de0c-1d22-4dfd-99ab-23a74066a780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084692, "uuid": "b7d70381-c9a1-4f78-a4b8-fc9617a6aa65", "value": "c2883d75600cc1abc9256ffef31783bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201f508a-376c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776107296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776107296, "uuid": "272aba38-4ebd-474e-b72e-4638fa54bee7", "comment": "Malware payload", "value": "aa6d9a63d14b0ae4b9d83783ab6e6a1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776107296, "uuid": "244b8288-90cc-4a12-8615-6f9dc06b6d1f", "comment": "Malware payload", "value": "c3106f5489c1b841efdc193587b79e9f434f2410e851971f3539b9a043ed1ef3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776107296, "uuid": "8e897dcf-31eb-49fb-b742-66ca3abaebf9", "comment": "Malware payload", "value": "9ecf3962db337cdf5ebbdec5097506873d55a39d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776107296, "uuid": "6fa2a2e5-0cb2-47df-857b-8aae4b09cd4f", "comment": "Malware payload", "value": "01d832e08c9e3fb3d1f30b901190be7ba1a95b5b5e4a49df9d57ba90cdcb72fb90882125c835da2690b82b92a11d9508", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776107296, "uuid": "158976dc-dd41-4374-ba7f-47b0ff792b63", "value": "T197F63B6CF48D4A8CE6C7C378E67A785A113F620D77CCAAD80E741E1A70432B1B7526D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776107296, "uuid": "46353ffd-a746-48e6-a126-a1f3e0d0812c", "value": "196608:oimhDRGRV10aH5auXczpf5KdxS4Lz6ZIJ/:oimhDRGtPHIue5KdIg6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776107296, "uuid": "ef017178-ab9e-4d4d-bcc6-ba210d96e201", "value": 16242086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776107296, "uuid": "315803a6-9b28-4ede-9dc1-3dfa8b4f8cb8", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776107296, "uuid": "42b34f29-417f-42b0-826d-be501de556bb", "value": "Sliver C2 Leveraged by Many Threat Actors.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d053b2-3733-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1776082938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082938, "uuid": "85566b97-11d8-44c2-b632-1e0afe45e7c4", "comment": "Malware payload (DarkTortilla)", "value": "7030675aae6135ae1c973cd7c7009db4", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082938, "uuid": "15c69318-a838-474f-bb59-4cfa7fe8ea03", "comment": "Malware payload (DarkTortilla)", "value": "c3b91a11976ecafbbf95430bc492aecdc71970372ef265a4282728b7eb74a492", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082938, "uuid": "d7a656db-4cde-43b7-bd5d-15929b07668b", "comment": "Malware payload (DarkTortilla)", "value": "881ba6b102f5a30063d6bc44c9c794f2d04ae1aa", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082938, "uuid": "4b290fd6-e48e-4686-baab-ab8d1689b5f5", "comment": "Malware payload (DarkTortilla)", "value": "fa9cb584b51c86b7d210c56db3cb70e4cdac280ec9879933ed4e1f5f5fdba0432d7c13a1fb28aea059f0abde811362e8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082938, "uuid": "1965d0f4-5410-4d3c-aac3-7036ae5686ff", "value": "T1C7F4C0166F462B17C57EDBBCD4338058A3F08B07A3DAD3976EED50E506967C6C9222C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082938, "uuid": "ff9b48a8-f87d-4c50-84a9-866e8aa0c60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082938, "uuid": "ed7a9b67-adb3-4cf4-ba02-91f1bdd03402", "value": "12288:bjJQC3Q19YD86FdgeK9bY6wNs5LMrNSWFhIzu6:bFZ3sYDIeKXOs54rNSSIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776082938, "uuid": "bdfd6ee0-c5a1-46dd-93a0-a1a99d3ff965", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776082938, "uuid": "9ae6055a-d7eb-492a-9a06-c33c3c80f891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082938, "uuid": "48c0cde5-8843-4dc0-b3d9-07e66d249a2c", "value": "OC463971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d509cfa0-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776086124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086124, "uuid": "8c24ca3d-53a0-4b40-85cc-2f96f0a29bf3", "comment": "Malware payload", "value": "0ceab58650ce618fa15cf052ed1f0201", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086124, "uuid": "34377e2a-45f3-414e-9019-8926a1520901", "comment": "Malware payload", "value": "c3eb154ed89ae10ee7336ce8c5c77ef82b93f6e6dc8338473ea5027729e4ae58", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086124, "uuid": "977bc4b6-a82b-42c4-8418-0f852cc770ed", "comment": "Malware payload", "value": "dfe8e4298a807138e6c04bbf4b162d101604ae07", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776086124, "uuid": "67626584-b8f6-422a-a6e1-151b55eecef5", "comment": "Malware payload", "value": "6318596ad3d5dabc3443741bd8ee3796a60cdecb210a8c34a19bfdacdbb1d51f6cb081ad4ce823d5c2f9ce4b98f84067", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086124, "uuid": "2c6dc379-ed85-41dc-9ea9-132765df3ed6", "value": "T16CC16D6063FC4613E6B3CA7566306B44CF977E0159B692CC4622275CAC31F145E11F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086124, "uuid": "39afb5a3-16ad-4a82-bda4-69e804970752", "value": "24:8d/BMwKDvJ51fSYgFf0gJF/1GRzwlADiqi:8lBMVDGFfHF/1nADh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776086124, "uuid": "deca0b33-dafe-4ee6-ad2b-b2f3d74fbf93", "value": 5967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776086124, "uuid": "07c81b26-df84-41bc-9a49-76f71db51f25", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776086124, "uuid": "555bebbf-e453-4198-b60d-7e1afb9dc04e", "value": "Dodatok.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50270eeb-3759-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099216, "uuid": "fc0ca68a-ec67-486e-a7e7-42d9431dbeac", "comment": "Malware payload (Mirai)", "value": "881801aa2e963e68631c0334cc5da7bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099216, "uuid": "40c418f6-b68c-4432-abb3-b42c49b5d892", "comment": "Malware payload (Mirai)", "value": "c415097887aab79430d5a2138bfb33b76791fc65b84c6ea5fbe77a2f26398e44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099216, "uuid": "0ab2eb23-45df-4165-bb7a-7f82f3e13d57", "comment": "Malware payload (Mirai)", "value": "e9cbcd0c1ef1966f396108ea6b534535a6a6c5e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099216, "uuid": "74a531be-9acc-4948-858a-55d70d24998b", "comment": "Malware payload (Mirai)", "value": "0cb87c3d981da7e72a2b9ce3f769c29132ae2cba894c199fe124c51a267de3e96c73d54689670b2a3620145e99bdec8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099216, "uuid": "a6297e0b-8021-4e4f-ba1f-33fdf742a134", "value": "T185D47D0AFF551FEBC0BFCD30489E8257049DAA870AC5873562BCCE4CB759A9D0AD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099216, "uuid": "bfc6083c-bc7f-4ea3-ba8b-d8fd26610fdf", "value": "12288:GVEkRI7uyIka2Q2EBXY51eL+/JSZHKNfOUIHoJ/dBCnx/trVpfh2Yymgm7br++ne:UYYPgEnDnv65A25ytSxHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099216, "uuid": "282363b3-8657-4d37-a4d9-17b8e41835ba", "value": 646868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099216, "uuid": "483fabb3-e75e-42d8-b1d4-c3414dd69d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099216, "uuid": "af6e85eb-b113-499a-b26d-7670f64c1542", "value": "cloud.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd34cef-36ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776053336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053336, "uuid": "86c6dedc-9720-4cb0-9f82-0a6e84dc5083", "comment": "Malware payload (Mirai)", "value": "2519550c1bf5443708a8f48de7c9edb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053336, "uuid": "99560888-357f-4eff-8301-81b62b412657", "comment": "Malware payload (Mirai)", "value": "c447dba3eb12a0d508955447a517b4dccb4f07b8103059aefd8dd187910b079e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053336, "uuid": "bd492529-4f22-45a9-80c1-41252b20708c", "comment": "Malware payload (Mirai)", "value": "bf13529f4738bc1959f3274bb3c738344d536f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053336, "uuid": "5f21803a-4bd7-4cbc-91c7-7834bfab382d", "comment": "Malware payload (Mirai)", "value": "b157b618b3ddf5deac2a5e1b46c4d4a8bbf463ee5402d50417ad8973d4fca443aa4c02c1b1145c72a2aa57d911904392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053336, "uuid": "9e7a9821-1dce-42f1-a8f2-d7342d94a1df", "value": "T1C823F1F6A7B7B3BDCFE185B027AE4FFCDD2918911B15278B56C36A295CF66042D000A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053336, "uuid": "7e6ddcca-209c-4f10-a77d-a115cd1fec2a", "value": "768:SluSRBaqScGBCpk0VDCeTVpFT+KG75h1jbideDKflXPHXhhJCEpYSzKl/T7R2uKN:mREB70Bb5P+t7nhaee/XhqEqlJbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053336, "uuid": "ddaf9066-20e8-4c23-a5dd-1f9494728065", "value": 47776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053336, "uuid": "9da93ed0-e4d2-4c9a-939a-e33374b0ec32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053336, "uuid": "1d1a675f-2ba7-45de-8664-250dbca0f39e", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689b3d6c-3783-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776117296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117296, "uuid": "67169872-c0a0-439b-9a5e-e884fac25409", "comment": "Malware payload (MassLogger)", "value": "f32be2d99290b33c8b3860319c38851d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117296, "uuid": "6582f94e-d56a-4397-8d7e-f9d6c4c517d6", "comment": "Malware payload (MassLogger)", "value": "c4659369c84a24e6969730f2bf38d6aa58f887b98e98417e9e57786b263319cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117296, "uuid": "366bba14-64a5-4dfd-b9de-669af9a6177e", "comment": "Malware payload (MassLogger)", "value": "084af1f77dacbd1c701ba662832acb9f8645da10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117296, "uuid": "2ad39823-31e8-493c-b289-e72a7af1a0de", "comment": "Malware payload (MassLogger)", "value": "6584634cf690893746a8984b990e73ae7c0347cb72c2d58bd384ffdc06a59e0973dafdf05098100a4c242fec2610c89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117296, "uuid": "1f3d0693-88d2-4fcb-8b87-89ce88b22e8d", "value": "T1DAF4AE972B072D46C57283B85062E5FD9B036F5D7416C3220AF6FCA3BB72A471DDA092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117296, "uuid": "29bc46ff-a8bf-4dd8-8d38-9697a344f0e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117296, "uuid": "726ca296-65c2-47e9-8546-729ae3e1df64", "value": "12288:M/2QRXDD1yed0fsU4GSWaOvPESGj4s32xEdRCS:g2Q9NXw2/wPOjdGxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776117296, "uuid": "04a60b0d-d555-4b01-a448-d679ebd1de11", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776117296, "uuid": "97040efb-8a18-47a8-9081-e23018af3809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117296, "uuid": "c25f11eb-5600-4f78-9d1c-2ad3a871e7c9", "value": "ROBLOX - XENO Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cea7000-373a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085869, "uuid": "88bd6c62-f1da-43a2-b653-9e348be4b606", "comment": "Malware payload", "value": "15ffffc810ce6a1be1e3af395d637ff0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085869, "uuid": "51a5dcc8-7add-4d73-ad54-cce68c92e821", "comment": "Malware payload", "value": "c50d258aafaae549acc64e7c3fccf0d3d568f27855c604f46fae296f3957605c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085869, "uuid": "c7b32fe1-5d16-4a6c-9067-e506a91d1f24", "comment": "Malware payload", "value": "bb933e6af5c340c5d4eb2f4eb5dcd3b6101b5ce1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085869, "uuid": "47e9e99d-d070-43b5-972d-0ed85d6f404e", "comment": "Malware payload", "value": "7bdbf5ad33389728eddf31cf568a8a089e7d6b0e57d246733ec9394b41158dd5d66a594705b78aa67cd87783c77df9d9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085869, "uuid": "d798ce91-1e13-4089-9b81-5768a2722f2a", "value": "T1D141C2141BB10229EAF78B39E8F97213F6217D06EE219F5F02D0525844B5121F966F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085869, "uuid": "b3dfb5ae-42cc-4a6d-b299-b2ece4250b5c", "value": "24:8YupmJdmGjMDvSwjKUaWU3AcPWkp+/CWyp/LVvSZlJrOgdq4wZ9r4I0WK6c/6Cac:8dgDmeKpUQKvMllOgY4wDUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085869, "uuid": "5f853aa9-e7c4-45f0-a5d0-d50678c9a6ac", "value": 1891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085869, "uuid": "638dfbda-749d-4144-8db1-16cbbbafede2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085869, "uuid": "071d3291-ed12-454c-aa94-63f53198cc98", "value": "IMG-805068627.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793c1ca3-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046886, "uuid": "6d72c3d2-bb39-498f-a5fa-36a5a0c9273c", "comment": "Malware payload (Mirai)", "value": "773c8aafc94ba01ac8a450e35391b03b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046886, "uuid": "f0481cc7-9153-49d2-9089-42ed208b77b5", "comment": "Malware payload (Mirai)", "value": "c61369ca1e1185a717ff0c6fb4fcba5d8e2b6cfb173a83cabda5be2c199943ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046886, "uuid": "87a9a17f-4a7c-4716-b9ce-44109e5207ff", "comment": "Malware payload (Mirai)", "value": "ac09e88556ece67504155615c3c69ac0a99d47a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046886, "uuid": "a2b011dd-0216-428c-98dd-6c1915a66b01", "comment": "Malware payload (Mirai)", "value": "271ed9e8ea19deb0ab35e0c6d4dd0d7883668170067be73b99744c6595bd1fb9f910f7bb423775365699694ab10012a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046886, "uuid": "de96e73a-32ea-416a-9339-c3953a6c2b00", "value": "T113A32986BD418E12C4C225BAFE6F454D33135BFCD3EB31128E25AFA067865E70A3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046886, "uuid": "5d19ba56-87ff-4be5-9d3a-d6a8eb1fc43f", "value": "1536:lVnTmEfvL6fGyI60mnzfrXvcptqmfRPRMaJFimRfDVALdqZzgvauTC9N5S6B2Ez+:Lv1FaPTO68ywa88yYJ/Y9Pz+g1yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046886, "uuid": "54624574-7d01-4600-b320-806171e06386", "value": 107204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046886, "uuid": "9efd3caf-5a20-4b40-a9c8-eb79daa7d572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046886, "uuid": "4f98c45e-ef94-488e-beab-942d777844c3", "value": "SecuriteInfo.com.Linux.Mirai.10456.27140.19501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e6a791-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066716, "uuid": "e0b5c72b-692d-4dd1-8944-9ba94c91eb83", "comment": "Malware payload", "value": "1d608e6c13f745342b88f763c49b0eb2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066716, "uuid": "28d843ce-66be-4a81-9fea-db24dff26ae0", "comment": "Malware payload", "value": "c6efac5ee99ea63b5f927bcd342073ff2d3540d572ab7b5d353fe857f8f08d49", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066716, "uuid": "ca3b9661-0637-47a6-b709-368e8bcfef59", "comment": "Malware payload", "value": "7e30f3bf54ef65c52141cbcd5a63299ed49429f0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066716, "uuid": "ecaa226c-c3d9-4024-bf18-742dc17323d8", "comment": "Malware payload", "value": "4d9e0d5a00141938068ccc0d5bc14e6e5dbb482fe4b4e8d8619e92a78e4d6fbcadf6c8ec8bfc82b5a397ca6251d0483d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066716, "uuid": "87678eeb-8ac9-4910-b9b3-78d4456cdfc8", "value": "T1BAE023F44F19FE25C1700435C216F3100F1579274540B1F100D050D1D4701863E3E295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066716, "uuid": "22f95176-df8d-4dd0-93e4-3cdfba965752", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWXiPTFFyC6w5fJWXCBLGPebRJ:4xtJCUOblw7BJYXHpQtXiPTFBQebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066716, "uuid": "73c9e023-a3d4-4263-85e1-0e785d7fdd09", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066716, "uuid": "92a9add4-6620-4ae6-8dee-0e39c81fa60b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066716, "uuid": "b3c5ddbe-9338-4084-84f4-984df5c3c3d9", "value": "c6efac5ee99ea63b5f927bcd342073ff2d3540d572ab7b5d353fe857f8f08d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d1d0db-373f-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776087951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087951, "uuid": "660e7d2f-4b3a-4f52-b56a-6316ec505fbc", "comment": "Malware payload (OffLoader)", "value": "5e462eeb9c7879e6eef8773fd7d8dc0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087951, "uuid": "38d75d81-9099-4c60-9268-44538c43c32b", "comment": "Malware payload (OffLoader)", "value": "c7512951e33b97996b2218af7039a60d766d1c1b197e93ea3843335f25eb29f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087951, "uuid": "6f0212df-ca23-4411-b2d1-d8d9ee4fecd6", "comment": "Malware payload (OffLoader)", "value": "97ddce077e33ff573bea14c7dae875331b88d449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087951, "uuid": "04a8a563-2160-472e-9f5d-c181a910d991", "comment": "Malware payload (OffLoader)", "value": "2d024650d9a7cb78757cd297626b4ffc7dd63389a4bfc72a9310185fd20af11c5f1eafd091289f9ab2d13db604651ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087951, "uuid": "c8f12c23-86b2-4249-8222-fa15a9431c62", "value": "T1D3A6D0E0F0653D6FE337443A49D9EB19D3AD0011E71AD43BB06EE56443226902FAED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087951, "uuid": "d477c58a-1a50-4c39-bf79-be0d00f7cc67", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087951, "uuid": "62317054-e8c3-4d17-90d2-9eda46482a44", "value": "196608:/ViOfOWzrqKoVnhVw68zw4wNsPz9CMs6QXvSDBpWFzJjiEWt+hmb:/E8rz+Sw4awz9CujWFzoEWtlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087951, "uuid": "ca284336-5122-4fe9-a56b-ba88b124d70f", "value": 10297896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087951, "uuid": "13a456ea-f6dc-4ba8-bd2c-43d6dad18da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087951, "uuid": "8b875be5-9378-467e-9297-ec3515f21af8", "value": "\u5982\u4f55\u627e\u5230\u5408\u9002\u81ea\u5df1\u7684\u8bdd\u672f\u5957\u8def\u53bb\u5f00\u5355_l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed954162-371d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776073710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073710, "uuid": "e278bcef-74cc-40d8-b18d-2692988c7d3f", "comment": "Malware payload", "value": "2dcfbf338789185d0b89775ffd4996ff", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073710, "uuid": "17d9a8a0-433c-4d8b-8b9e-de6501454b5f", "comment": "Malware payload", "value": "c7da0a4276b3faf7c122ab9de0ba6c7f8499f7d72aa947515a2f41e13ca4f9a6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073710, "uuid": "17fce433-fd5b-4fd9-ac47-881263e6f683", "comment": "Malware payload", "value": "6c6fe3ef84f3118161b3f5c16f495957441036c6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073710, "uuid": "87ff5bf6-df35-45ef-83ad-ca84d7833f1b", "comment": "Malware payload", "value": "1f90dd076f66930e38a67f00bd6b9716c81dde5e92275c8c08b5727bf965847bf553e77abcfff077586fef44363c84c0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073710, "uuid": "9f458528-3948-41e3-bd0c-e9fc8c6a2340", "value": "T1FAB32B3270A9BD224327DC6CD3F813054A4996AF2ABBA9533CC5C93673FE15884A5FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073710, "uuid": "d34725da-e685-418e-8b3d-f450925bb82a", "value": "3072:WYB7UWWWWWWWWWWWWr999999999999999999999999999999999999999999999V:WYKWWWWWWWWWWWWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776073710, "uuid": "eeaf9780-3841-4109-a7fb-38ee8928e5c1", "value": 112560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776073710, "uuid": "92403960-d1aa-4e96-936b-863d82f14dff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073710, "uuid": "14358b2c-de43-4b01-9296-15bb5bfff775", "value": "Scan_1_16_4_1690_13.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b9b994-373e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776087823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087823, "uuid": "fd7682e0-660a-466b-a0d1-8afc01e1ffd2", "comment": "Malware payload", "value": "94c615889f8b921fd628746c3fe56144", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087823, "uuid": "11d13805-1c05-4a08-9f97-8a9e9f4183a4", "comment": "Malware payload", "value": "c7da5f914ab2802b84bb411e4a2f46fdf0754626229a85593e2bd2030039aaf3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087823, "uuid": "0e456132-6ce6-4be6-a1e9-c8138cf31af7", "comment": "Malware payload", "value": "cdd57aebe9dd90590dfed89fd260296d5d72ccb6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776087823, "uuid": "a80aff15-acb9-4cc7-a955-74b4878a67e8", "comment": "Malware payload", "value": "ab52c8104412f54270c66d58fc3f0801e3fbdb5d1880c12de18b3c2b303bea3748922e47f27981134274bc675babf2c9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087823, "uuid": "479834ee-d404-4bd3-9c05-77b20a5f5f9e", "value": "T1E32367CD3AD09C52D0DBA893784F9AF31451DC5BE2716B3DB8AE8D93030E11968317EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087823, "uuid": "c00f2faf-bfa2-4dcb-b617-ecf846679728", "value": "384:Vq8XeG0jd7rlc5Pr8cVM0TkXprUhaZBnzEY:VqO9yPiziJZBnzEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776087823, "uuid": "470b3c34-43d3-4a63-a4cd-2e87a235d115", "value": 47971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776087823, "uuid": "205ce5fc-2c64-4f23-a911-501b66b6af40", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776087823, "uuid": "07d4f10b-159b-4633-95b8-aee879ad8cf4", "value": "cloudconnect.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f2802e-36e9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776051311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051311, "uuid": "c12e18cb-a27b-4693-af0d-09b25b6a5388", "comment": "Malware payload (GuLoader)", "value": "9c30cb70917e1758d28caafc6ce50523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051311, "uuid": "fd71d158-b186-415b-befb-dabdae5ce97f", "comment": "Malware payload (GuLoader)", "value": "c85d9d1a2e9675a375c71cb653a03af7370459fae1280124365be11cade2a886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051311, "uuid": "84a258ce-9c98-4e99-bb41-146970c6685f", "comment": "Malware payload (GuLoader)", "value": "a1049ddaa7c9cba88694aa0c637d5406cf4f9263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776051311, "uuid": "1f4012d6-7b23-42d0-9e34-5e258c9cd4d3", "comment": "Malware payload (GuLoader)", "value": "7342a6f525fae200cb633b57ab56e738cabefa8f38177e917bb4f98c60a1d5e49e1c6ba64d6432dea51c06bc3f92d700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051311, "uuid": "6bd3d344-de99-4de0-adfc-453a96506d76", "value": "T115469F26FDA808ADC582A37A887351437E38B800571123D76AD9636C2F637F4937AF5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051311, "uuid": "a4db7382-7940-4c7f-8c0e-eb034f1e5c97", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051311, "uuid": "e859051c-b61d-482b-b826-33c6f9e879f9", "value": "49152:CvcC4veNRBA9CiZ9t+A8kKwM/xyrjwLpjfi4JlQc7Mxn7kiSXEUkUTRx/di0LDn8:Cv3bkQXLpjfi4J29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776051311, "uuid": "8b37c998-8879-4940-9e99-921c7718605f", "value": 5568032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776051311, "uuid": "be6578c9-6c31-4e1b-aa72-ca14f3d258ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776051311, "uuid": "086aece3-ee63-4cdd-bb4c-c0b25e9c374e", "value": "SecuriteInfo.com.Variant.Midie.178032.56591614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081b6bf0-36f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776056145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056145, "uuid": "6610a35a-d607-48c7-bc77-4b2089f9d375", "comment": "Malware payload (Mirai)", "value": "16a6b0f6eb18329082aadfd67771ea8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056145, "uuid": "b9b832aa-b9cd-44f1-b970-5e7a40eada9f", "comment": "Malware payload (Mirai)", "value": "ca2b898ad8c95acbddb45c9eab78fb555594d0213e2ce14ddf57380ff00f2dee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056145, "uuid": "79be0dbf-efd2-4a17-8dcd-6d99e15d38ef", "comment": "Malware payload (Mirai)", "value": "97e5a73e5d7d129de82ad757edb55346c19a8c37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776056145, "uuid": "44397d08-cccd-4519-9bc6-833289216f90", "comment": "Malware payload (Mirai)", "value": "8075acfeaeda54ed59a7068d27ea35d782a755ff4fa0434feb1e5022966735b294e9c38f0f1df33158b366699a8607a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056145, "uuid": "3674a736-2118-4e5a-8417-07b1bd7b4a45", "value": "T1DE93F749FD416B10D8D635FAFE4F024973934B6CE3FA7201AA245B2123CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056145, "uuid": "4f062e89-12ed-4672-8fc4-dbeb1f5fab3d", "value": "1536:YAnwLsWc2zgUdtS0tFbvacgzafVAweBuqKlUI8HiLNRIbT2gZ1YqB:usWsUv5nTacgzafVAwe5YNRIbT2gX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776056145, "uuid": "5923570d-a74e-4f66-8f25-95a6695652d3", "value": 93316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776056145, "uuid": "eb111d73-e270-4d77-963c-bd240d68fdbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776056145, "uuid": "9ee7af81-16b1-4a46-944e-da9be4321aec", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a02069-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043499, "uuid": "9b3df096-da68-49a7-b532-53c3b5706a5a", "comment": "Malware payload (Mirai)", "value": "5950d0c89dd001626526c03f9e5a7275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043499, "uuid": "03361b39-0395-4f63-aa28-b07650cf8a4d", "comment": "Malware payload (Mirai)", "value": "ca306060f225d016522f5b688ab9b13b8ab7dd829df94076b077c9a81941f916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043499, "uuid": "4f5f4078-0c05-4335-8413-91afcfabcaaa", "comment": "Malware payload (Mirai)", "value": "c1d076582ae17e4d296a85d793f56b5ac7070217", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043499, "uuid": "6e343c60-320f-472f-9ac0-9985850a6006", "comment": "Malware payload (Mirai)", "value": "62b1ae15f8e58101c984390a448a29c228c7b3f00445437ef23c2b8c99de6117d4c2446b4a5ff4b4ebb46ff73d7cb44c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043499, "uuid": "afcc6476-8a77-4170-91a4-ae2089a0896c", "value": "T1D5448D137F494EEFC26E97B51ADB5320CB23F03A0B17978F6354B8A52F896D49D88604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043499, "uuid": "ee559246-d4b5-48b1-a75f-79c1670eb194", "value": "3072:EDsusCvhbSokjBpc8sctHu1ylf2hbhUjCwj0l7wjLqVZVhePVrp:GZIokt+cddurwjLqVZVhePVrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043499, "uuid": "c408bc3b-1628-4601-bd47-798bbc728576", "value": 255426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043499, "uuid": "ded8fb9a-d5b5-4b4a-a356-7b38b9491810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043499, "uuid": "1c333a38-6946-4e61-838c-561f970e8107", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aa48ca-375c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100493, "uuid": "bc1d93ab-8193-4a99-806e-64458a46c0c4", "comment": "Malware payload", "value": "02de2959ce625bebf36664b21ccf3c5b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100493, "uuid": "6a5bf410-5ca8-4d37-a1ae-3a8a87f76a5e", "comment": "Malware payload", "value": "cb1a41580d2053e337dd0c04843b9ca1d2609610f943cdc4cedcdae3aad0d290", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100493, "uuid": "9323b33f-b753-4154-bc9a-31fee3d1bc5f", "comment": "Malware payload", "value": "c4225d8597131c4954bbabb148ec0b2ed577e1ee", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100493, "uuid": "c193c073-76c5-4114-bb0a-dd6581fa00ff", "comment": "Malware payload", "value": "9bc0cc731afabc0da611dcf11aca0ba6dde598a785bc49e37bc9202dc14fb8a76f1fd62be97863df3c70258952d611b4", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100493, "uuid": "1de5b6ae-aff0-4733-8b86-9ea2c852b1c7", "value": "T1C212C81366AE4C334157DA35E49278881E362A970007AD55BB6C7388EFC0B7DCBC539E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100493, "uuid": "ad011f3c-ba17-4d6a-a81c-0045f123f0bd", "value": "192:vDaISPMMfrpZdbNTMZu7UeGQbAEOa58vC5GPUo8Ty6bTzy6Nka094aEiesPs3cKQ:huwGUa58vnALbTrNkasgXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100493, "uuid": "9201fee5-fc4f-49f2-a1b0-1ffd41b91166", "value": 9392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100493, "uuid": "cd843b9f-0672-48cf-b360-5feda4752115", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100493, "uuid": "802d87ef-476a-4f1e-8f77-b96213738d56", "value": "form_99806.pdf.decrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925c7562-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043492, "uuid": "f5062afe-293f-404c-a179-ab40b2971e73", "comment": "Malware payload (Mirai)", "value": "97efa347d87766b87e18cccddef525c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043492, "uuid": "c7f586ec-2206-4f65-bfb1-4f6ddcc25ba0", "comment": "Malware payload (Mirai)", "value": "cb265ad6af32a2f17af717864b8cc4342eba0672d5f34e920ac58679546a5df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043492, "uuid": "d2ab80a2-249c-452b-aaae-4453c52ef842", "comment": "Malware payload (Mirai)", "value": "92c555fb543b6053070495057e5f0634e7787884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043492, "uuid": "c59e269f-e03c-484a-a1cb-71df2b657137", "comment": "Malware payload (Mirai)", "value": "ae8d520513db61412fca36a7ae442a2fbfb07396345e39e468855fc0173126c80cda6e5067af21e5a6f12136fef38ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043492, "uuid": "bbda0612-be6b-4889-810b-66aa882de567", "value": "T19BC31886BD419B02C4D325FAFE5F458933136BB8E3FB3112CD259F64238699B0A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043492, "uuid": "316ecfb7-682e-4c62-9f18-66082fd3e6a3", "value": "3072:LNyLvfTbOLuFSFaLlKcY+0FmmLPUF53Ttjmti09j:aMQgaLgcY+0FmmTUF/jmti09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043492, "uuid": "03ba73d8-43b2-40ef-807a-4ba34e8341a9", "value": 123676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043492, "uuid": "ff39389e-833c-451f-ac20-5da4b90b3983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043492, "uuid": "154f7879-f421-4bb0-aab3-8e0ee48538eb", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091e3c9e-374e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776094372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094372, "uuid": "9af3bc44-e625-4835-acc3-bc3a2e16443b", "comment": "Malware payload", "value": "3c77eddfaa3ff99bb7ff421ddb5af3b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094372, "uuid": "4683f4b9-4845-4053-a15c-3d2e3435baac", "comment": "Malware payload", "value": "cb636808cf6ea68f8732c59bee276d024c75e8c143e153a6f8351f9b2f9cd858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094372, "uuid": "d90d02b9-e60b-462e-bced-10acea056fe5", "comment": "Malware payload", "value": "e7f97e9c8edfee1b22b7ad9f82c9c1e63134bf6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094372, "uuid": "95a0a951-6652-4286-ac57-6d48c4ab849f", "comment": "Malware payload", "value": "3a290ce7e8c5237046c70e3b5e2b43cf9cbfe7f9b466aaed08a2d5c5747582ac6cd6b551cf4af8943227a172413333cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094372, "uuid": "b4ef7634-c172-4539-bb91-fd49e3a8dd7a", "value": "T1A055DF02B27192E1D5EA8931D8A6C61669307D515F69C69B3B38F3CA3B713C36E3834D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094372, "uuid": "6a1c7f08-783a-4caa-ac0a-f7a0294fe9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094372, "uuid": "97fdfa95-063b-4f28-9868-bd3437bbd9b7", "value": "24576:iNbCDPZbCDP29pmQR5+so3pr9pxXUyunXrMrQWkc+YtGsURs5PjCzPA:iNbCDPZbCDP29pmQn09pNUhnXrMrrJtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776094372, "uuid": "04627fd4-d941-4a1c-8ed2-db70eb15518b", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776094372, "uuid": "09ae4f70-6de4-40c1-bc90-30e60dc15904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094372, "uuid": "29e014a1-604c-47ac-b032-e3a0d89d0f4e", "value": "RstHosts2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e221bad6-3700-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776061235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061235, "uuid": "a554dc85-6df8-45be-aa27-781977a3ddfc", "comment": "Malware payload", "value": "c0c027f09a5433fd43c363fa44f3af13", "object_relation": "md5", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061235, "uuid": "7dd2e75d-ef6a-4fce-834c-c8aac275c28b", "comment": "Malware payload", "value": "cbaeaa4b58fced59013acfe3eab94e3164d010d8ad39b6797353c6ce411bd84e", "object_relation": "sha256", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061235, "uuid": "0a7a2382-8934-46f6-840a-a62f43cc8f26", "comment": "Malware payload", "value": "60ff0392e30b1ce8c3d6c6bca29fc6b42fe571f7", "object_relation": "sha1", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776061235, "uuid": "ec410173-f3d5-41ba-a1de-3fb0cc16a6d9", "comment": "Malware payload", "value": "ab3e8a4ddbfe13de198b6a01496e8dd91ca2fc6635fa5523c4c5e78465665020c6ac109e6d4fe7f4f00787737ca972b6", "object_relation": "sha3-384", "Tag": [ { "name": "ghanioilandgas-com", "colour": "#7D5DA7", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061235, "uuid": "3298b5fb-d8fe-4aea-8e97-40c10a049106", "value": "T150963323A56449C7D43AE27BA1F216C143D7320AF943D4BAEC917ADC76E27C948C871B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061235, "uuid": "9614c752-49c3-4712-acec-3b110253177d", "value": "196608:+Zftl+WEg2XhVXzEzNr18+Pj9Ri70uU+HB/OGUElH6XU8YYlbHXUf:+BZEg23Exr18+Hi7rU+h/PUEl0U8YYlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776061235, "uuid": "b48d8b74-7621-40b6-9219-d200f9b0e584", "value": 9439702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776061235, "uuid": "ecccfd22-9917-4f39-bd2f-584e88d9d7b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776061235, "uuid": "1f8f4fb2-836b-405d-8ada-aab671912de4", "value": "ghanioilandgas.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfde3af5-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085659, "uuid": "b3595c5c-851e-401d-9d6c-3cf5e90fcda4", "comment": "Malware payload (PhantomStealer)", "value": "14653129509063c5a537f0336af9a052", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085659, "uuid": "14a3cb71-2679-47b4-89e2-86563a3c9743", "comment": "Malware payload (PhantomStealer)", "value": "cbc9ce9067d192a6372095aea321a1b26ee2300173a0e1155ddda981b4300171", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085659, "uuid": "22f5850b-3749-4ebc-900f-585d80d708ed", "comment": "Malware payload (PhantomStealer)", "value": "9e180fb2e60ad187e6f387ce5f3810e19a573236", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085659, "uuid": "8ecb5897-8478-478c-8760-f1bd2041e02e", "comment": "Malware payload (PhantomStealer)", "value": "a8f1361dc59fa0c12232b1a8b5a8a78ebb5d28ed6d58e2cf4f1f41061411741ea3d5992068593587bab3d87798afec11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085659, "uuid": "2f559699-147f-4130-92da-2ff2efc1f3e0", "value": "T19F53F8E157DB91A8CAFD5732C7149CF9DC5585E7103A08E6AAE4478BD6B8C80320FB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085659, "uuid": "e286dee9-838e-404e-94b4-c1f32e84f0d1", "value": "192:eubKfDhSJ6uo5EAcbgwaSzabF+O/feCtA+CWGrZNq8b9ETLcrSk4meZe1qXPgr4Q:Tz05GR50HMNgWCsc7EtUN0bjacnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085659, "uuid": "5ceb84bd-fdef-4f0c-81f4-def41910762c", "value": 63567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085659, "uuid": "731d0808-d371-4355-950b-19e575f894b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085659, "uuid": "9d7e1fc0-5c3c-42b8-a28b-a1fc1a20f078", "value": "Lampiran B_Swasta _surat pcb(audit)020A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d6777-372b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079409, "uuid": "01a82ff9-61db-4534-a30b-4ea8fe4e7aaf", "comment": "Malware payload", "value": "423a8bed96c8c71443d3949ec9556120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079409, "uuid": "6e3c3e61-ac97-4984-aa61-fc5360d0b202", "comment": "Malware payload", "value": "ccbbf6b731c924615245e721faf90b7f8b7a41fdc6a6191b8fdfe85c162c85fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079409, "uuid": "589873f2-0b52-4100-bfd2-0b0a5181fbc8", "comment": "Malware payload", "value": "943b824422ee16cdf5e19776fb0331713bf4184d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079409, "uuid": "3312ddda-151e-43ee-8f5d-8e242a0e841b", "comment": "Malware payload", "value": "fc0d855fef875425dc74d6680d47e063697e6d47dd016dc5de9e97ea17d06769ea4f7ea9e324775e536f631866f51868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079409, "uuid": "a10afa17-ef4c-412c-85f9-db55263e3b6a", "value": "T13C050B7DAD10A626F70CD0BAE287D7534FA53801033ABAA3197ED7241106872DB677ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079409, "uuid": "8890baad-8071-4256-afc5-e9a364cacde5", "value": "12288:hL+1MJ2KStSAPnrnbBTKiTBj48k13OvykAhAQCAvLALrgE:hCSJ21BDbBTt6lxu03vLALc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079409, "uuid": "79181883-7e41-4821-afc2-afce7b3b23d9", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079409, "uuid": "c66d77de-ce16-4ee1-bd36-a7c2efc59e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079409, "uuid": "ae61cb36-fb94-4104-93a8-27c79481d727", "value": "ccbbf6b731c924615245e721faf90b7f8b7a41fdc6a6191b8fdfe85c162c85fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ab419-378c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776121345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121345, "uuid": "bd59d988-bcef-4df5-8bcc-d08635a933b4", "comment": "Malware payload (Smoke Loader)", "value": "6dd6c726066a03763d9472452a3bbaf6", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121345, "uuid": "9273ae37-f8d5-4c3a-b35c-9a9ea2b43a35", "comment": "Malware payload (Smoke Loader)", "value": "cd658537462787f1c28d850f3a5923b18dd4dc103e176e6e3d4745033c110ab8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121345, "uuid": "2bb83a3a-cbfc-4ae6-88b8-2e5d954a1a4b", "comment": "Malware payload (Smoke Loader)", "value": "1a575f35c5345d92a9dcfe53736355eb90c9caae", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776121345, "uuid": "a4447697-0946-4084-b8a2-8d6156683c45", "comment": "Malware payload (Smoke Loader)", "value": "524af13b530a5d02d8bf7fa0f1623f10247e22dd3db99fdb8b223ce70f84ac8b2bd9cb48b1d67ab2ffd4899a19c9500e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121345, "uuid": "d786f231-f3bb-44fc-9830-8243a753b6e4", "value": "T1F0A56C0BAC9505FAD0A9A73288B75292BB75FC090B3133D32E91B6792FB67D05E35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121345, "uuid": "095fa308-a5a3-4a26-833b-38a80b2752de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121345, "uuid": "c27011d5-d597-48ae-9b94-b61e31b7b5f2", "value": "24576:Yk7rZTUz+5pjso5AqL6J9QOEVM1Tm5DV9jWPhheleh2KmyYIn7NA:YkHho+Lso5dLYyOLOvjjInxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776121345, "uuid": "b2a23c4d-5243-4cfb-8084-bc1edc0ce334", "value": 2188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776121345, "uuid": "fa87d951-dfba-41b2-aeb5-4544ee8da1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776121345, "uuid": "3c3b9f96-fdd6-4b2c-aa22-a108c7be40d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d031250a-3734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083539, "uuid": "7cfad882-f959-45ab-854e-b0386c3b88a8", "comment": "Malware payload", "value": "65ddc53db705479e1e64a2d2bfec04e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083539, "uuid": "ae18e02c-601c-4ffd-a271-cc6ff92a21a5", "comment": "Malware payload", "value": "cdcaf925f97e40db1f113e798ab75f0f4c29420034a213d083949b6b74e9e712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083539, "uuid": "8c8af602-9fad-472c-9736-87c0f7c9069f", "comment": "Malware payload", "value": "bdc5c7384ae17683631f4fc8fcc4aadfd21c5ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083539, "uuid": "c59a895b-7fc0-41bc-86b6-6634d2f23917", "comment": "Malware payload", "value": "f299481a5379403ce60b6f4876f91190c5d624b8039d4a0c49bf04d1c45944761152a40632fb30f8e45278a940945e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083539, "uuid": "b722ba19-67f7-4553-87ca-fdd16d549be6", "value": "T1CBB59E5393EC41E4F0774A7488698716EEF1BC250B74A6DF0285F61E2F33AC25A76722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083539, "uuid": "ed527e08-acf5-479e-a47e-c8d4351e01c1", "value": "74a352b7be38be736b4f1e0d51b66e8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083539, "uuid": "89fcce8e-5081-4872-84a7-7d7cda250ee2", "value": "24576:RTVGQGQatHHJKFqKeB1vc4ZcVsof9gctPAPtEGH5AQoV6FaTv8:NcQxeHJKFqKevv7m9gctYPbH51a78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083539, "uuid": "c201f618-d37e-47aa-bc5f-74c4aa95434c", "value": 2397064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083539, "uuid": "25088640-4390-45d3-b9c0-0fd9a2b8ab09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083539, "uuid": "68dc59d5-3fe5-4876-b95e-37b9e09775cd", "value": "shjef2aVFDe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca042a61-3755-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776097702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097702, "uuid": "3fce243a-4931-401e-b5b2-6cbce580286c", "comment": "Malware payload", "value": "deccc12eaff4ae23403e2eebfa343ec3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097702, "uuid": "0a065675-650e-4a88-b15d-d37287a16a67", "comment": "Malware payload", "value": "cdcdef6cdfab4abbcf83265b1975fdecefbad68ab65931a74f4b930e5e22b29c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097702, "uuid": "6b9f56c3-7a14-4f3e-9c26-dc3834fa06be", "comment": "Malware payload", "value": "1481cc95e0c2bc4798316dec05a90d287ec88ad7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776097702, "uuid": "212657b3-daba-4961-901a-aa57cc94fa62", "comment": "Malware payload", "value": "a8f80e798d5c7c545602f42cbe9abc2f6fb927d146d7809802348c0e9843b65b77143e44259e07a67cfa8e2a268bb964", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097702, "uuid": "c96740d8-e92f-41c8-bd96-a45a446d1ee6", "value": "T1E2D56C46B7124E7AC9BE423718BA036033329D41AF435747304DB6B86DB76DA1F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097702, "uuid": "5532f3f3-1a0f-4201-91f4-6c36c01f0a46", "value": "24576:cE43SVhdSZBDOC0CQ/bbANVD7jmgNnj258p6NWtnx2/4zgdubHBFULWKekQt1tgB:dhOBphDy58pP4zdCKSv/tgIk3ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776097702, "uuid": "605a6f17-b499-4697-901b-988c094a1f2c", "value": 2894296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776097702, "uuid": "d4217664-0efc-47d9-9b91-04aaa4d7d27e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776097702, "uuid": "5ecb0386-2352-475f-828e-23ccb6318ecf", "value": "release0304.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df25bb0-3743-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776089709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089709, "uuid": "af086eb2-7570-4af7-882f-d283447a1f35", "comment": "Malware payload", "value": "f7fa2bad1495d127e2514dbf72383e6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089709, "uuid": "8796de36-b298-482f-9bae-56d69ce2015c", "comment": "Malware payload", "value": "cdff04bb90da3e4d8aa0dee08c59e7d71031dfaf098f4cc85608edbe47e89cd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089709, "uuid": "accc88d5-c949-4e3a-b2af-197fd210d3ff", "comment": "Malware payload", "value": "cc455ee7651337d315c9f22eea97daf00dcd3ba8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776089709, "uuid": "1046bada-b1ea-47c7-bf4b-46b75e4f99ec", "comment": "Malware payload", "value": "e25346d0eafc56665c1a2cb9a592cddda5886f8779657b849e36136c4851a6070e9ac4df4045916d0e9b9165f977552a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "https://pdfplugout.com", "colour": "#793AC6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089709, "uuid": "b55dec22-71b7-4d5d-8144-2e66d90a6b20", "value": "T1EB934900B1D1C175D9BE18351828DAB59B3EB910DFE0EDEB379506AA4F302C1EE35A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089709, "uuid": "c54b8fe0-87fc-4b9e-9258-84489be93907", "value": "240bf396dc08fdac0351a3dbd1d9b0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089709, "uuid": "09b99440-ad6b-431d-90bd-f5b29f79eb35", "value": "1536:NIkKpaMrH+D0UWs3mhzE2kN/M+r6NDQQOPCb0C2jxgDkF7sWscdw1DF07W:NypaM5Ud3mGN/ZuEQOPCuFmkhw1DF07W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776089709, "uuid": "6fb1d0ac-2222-459f-b389-de000841b4f6", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776089709, "uuid": "269ff2e2-289c-4a1c-99e8-df28df181a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776089709, "uuid": "33fe4e88-1c02-4af7-bfbc-59265b659a14", "value": "Q.n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe2e4bc-370c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066412, "uuid": "7567c8db-2755-4e8a-a6df-4e2450a64954", "comment": "Malware payload", "value": "5251417f594440395a25747bae78d871", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066412, "uuid": "ba1d9cc5-f35f-4605-a8cf-8c48efb62720", "comment": "Malware payload", "value": "cf81d9f639b192d1c2f953be822ad7d9def0693938d3e2ab93ea7b543bd9ab38", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066412, "uuid": "2d7bceab-b34a-4d12-b854-28f5bdcc9dc6", "comment": "Malware payload", "value": "9ed52fe958864a9f3411978556e8f41a6c52f0ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066412, "uuid": "80f86b3a-2b85-4a2a-b8a2-38f672e0d2c3", "comment": "Malware payload", "value": "dd0faf4b07f5e91f3edde29481fb0b9197ea1fec44ba6641ea7a336a7061b36ef3d7a1fec577082c64aeda59f613aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066412, "uuid": "d25f8111-8296-4d38-8749-652919e7a9ab", "value": "T1E7E41CA26888B7DD5D5CB31B223DCC5E2A0A178F32D166D53425B2F7E49C6238D02DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066412, "uuid": "e44a61f8-8eee-49a4-b73d-eb76437ce8f4", "value": "768:SwUz5Tl4AXKPvBmiY2tDdYHIfEdkyOpjQ8u/OqsyeeePKgWh8WDOSf6df9sDtWZi:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066412, "uuid": "0da4f3e3-9d5a-40ae-b807-1c6a2e74e91a", "value": 720635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066412, "uuid": "35208fca-8e71-400b-b850-a2306153acb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066412, "uuid": "2c77bbbe-b9b4-480d-9322-81d9c12273bc", "value": "FT2232HQ-REEL_FTDI_7244pcs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd577146-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085655, "uuid": "16053cf0-c7d6-46e1-bfdf-bc1af8de1e80", "comment": "Malware payload", "value": "8a13a65e16f4fa6a155bf23f6fa8e296", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085655, "uuid": "1aa032c4-52df-40c6-aad3-4cde57fb3e0a", "comment": "Malware payload", "value": "d1e1e223beed328793ad35d3ecd5acae0bb4e2c083e800b62998511d5caa8875", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085655, "uuid": "97a39b6e-e672-46db-ad3a-14f56da9fb6c", "comment": "Malware payload", "value": "410dd002c312d0612349db6afa240d9255a50e69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085655, "uuid": "ab54fc9f-3132-4b8b-9c58-dd0a81b0ff73", "comment": "Malware payload", "value": "230a1f679ec7f250be170dc4d6b70060efbb81c5e49d28afabee8f956c949879dbf72bca6025221683641eeb35b0e251", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085655, "uuid": "8cd9076b-b4c8-4140-a34d-1b8715d15521", "value": "T15FB43038AAFA0019B1B3EF55AEE47497D92FBB33370E985D1081034A4723945EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085655, "uuid": "3a8d705f-54ad-430c-83a6-6cb58c04dda0", "value": "12288:5rHpBEEG0e1iqkjH6iXHb096dpEAWfkWk87ri4+Y7YltsmoIe0Y:ptkUayRaxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085655, "uuid": "0676cf36-5004-4ec5-a694-76ae51985eb2", "value": 506390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085655, "uuid": "67baca61-00f0-4a46-a6bc-0047903931c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085655, "uuid": "34cafbc0-4885-4591-986c-898e0c1768b9", "value": "Invoice_for_payment_00320267750.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cb0703-3767-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776105500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105500, "uuid": "dfa77643-c201-4e98-a2e7-6428e0b71db2", "comment": "Malware payload (SantaStealer)", "value": "b7f2153d2845d16eab34a1738c75e937", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105500, "uuid": "89f17dec-5539-41fb-8e5a-343979269368", "comment": "Malware payload (SantaStealer)", "value": "d28e4a090cc3ea8ffc3e557246d8b8178f81bc13664948d77df9282d7966e970", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105500, "uuid": "6b98216e-5350-4ba5-a466-62a00750b04a", "comment": "Malware payload (SantaStealer)", "value": "a9774021d6e2f3f91e5f8a8aed8c50e77a2d1e7b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105500, "uuid": "d31e2639-ac1a-4340-bb81-f20517921a04", "comment": "Malware payload (SantaStealer)", "value": "0dfd9dede70907d4f37b9884aa267f09c56e5510e6369a8c358bfc8c3d3dae926e4a1ab338c9855f2f413a7750f2201c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105500, "uuid": "bf531c45-0cfc-4917-ab62-bfd6c8afeff4", "value": "T1D9D5021532CF631ED9A543F3C13AA27DEFC66FC64DF4D826A557309B28B4AC8581C186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105500, "uuid": "d48a3b5c-e92f-4f33-8c45-154a74ac02bb", "value": "49152:0aMg3NXXsPro7AQO3SIcqj3Hr/jUTwzHnJWl8ggdvIKg0daPs4mwk0UoH7Q281Ei:XXsIoSMXrXzoqem/0UgEf1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105500, "uuid": "b4803dff-9c52-4204-b588-81f2820c676c", "value": 2772992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105500, "uuid": "794113a3-1367-4c30-8012-bdd5867cb2a0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105500, "uuid": "bd1fc53f-a672-4a3f-afc8-cec402751b85", "value": "JSON Mod Manager v9.9.0 Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27160f0d-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776060063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060063, "uuid": "9aec3164-08a7-41d4-9d1e-e944dbcff0f7", "comment": "Malware payload (DCRat)", "value": "567eb08d6aeaf859c94387af8388c1ac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060063, "uuid": "a777b369-faa7-4a05-bfee-7eec457eef67", "comment": "Malware payload (DCRat)", "value": "d2d8c3e06c399369792c86c59db008d6c7b6c474041f90e79ec1e19dcd49a3fe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060063, "uuid": "f3a26a08-0326-44ae-bab5-43fea0714dd3", "comment": "Malware payload (DCRat)", "value": "ea90a0e18435c476dd0fa2347dab067bb15b42e8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060063, "uuid": "cb4dd576-5efb-4956-83f8-37ef6aa1ff70", "comment": "Malware payload (DCRat)", "value": "518d31746fab177055b233607bf580998bd821ef08e7f3ccbb61c264f75f03aa1e55b8a7a9d8ae5cf217d917fce8bf34", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060063, "uuid": "30f1ff69-163c-4d2a-bcac-1388eac1dd2a", "value": "T183E49D103BE94935F1BB6F79D4F26651973DBD627B2ACB4F1690028E0A22380DD50B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060063, "uuid": "92a0a730-65fd-4ebe-8a83-d361f0407ff0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060063, "uuid": "607946fd-0771-48db-8075-eda28900636b", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbcY2N7BAKy2yyY7FE6nDdxrFruXWuqfyxk:U2G/nvxW3Ww0tcY2RylHEsxsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060063, "uuid": "6bf73f28-e31c-4157-b91b-01c1e2ecfe1e", "value": 708815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060063, "uuid": "4da7b4f1-1934-4c60-a9f3-fc3205ec3559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060063, "uuid": "5458e586-e7d4-4bbf-91f2-ac1c3bf44164", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dc463f-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085668, "uuid": "145e9ebb-7fcd-4ca0-af87-85f6d269db70", "comment": "Malware payload (AgentTesla)", "value": "e6d55bc04c01e711b8e67377c0f00955", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085668, "uuid": "a18dfb3d-faf4-40cc-95eb-b1236c569f4b", "comment": "Malware payload (AgentTesla)", "value": "d2ec143140403176ca4090160ee57b032da3b6b11bb2e5214186ee49cf055166", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085668, "uuid": "05a82c1c-1f28-46ad-8f80-30a99e7d8b0a", "comment": "Malware payload (AgentTesla)", "value": "f3f71296772cfd2ef322b81e5958601e5c38f3c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085668, "uuid": "7daf32cc-1402-4f90-80d9-50aac948116c", "comment": "Malware payload (AgentTesla)", "value": "77439ca3e0ed80645b8989b57cce8e3295f0430c3691b6b9b368e3c13eb357ced756d46258b39fe39a66e9d03cb0ab28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085668, "uuid": "bc02cc94-f9d8-49d0-a1ef-56a3059034fa", "value": "T1D1569408E0A4B20D58C2DF5EA53BD4B0488E7A6A6F4DCAB2B52FD87C1C55FB3851119F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085668, "uuid": "663aed2f-8726-407e-9e2e-f1267b23d590", "value": "98304:C/ARR1FbEVje0q5n38WiMOhFeRJiI2b/RI2UDJCVOtk2/8lC4fjMZVAQF6cfP3pp:CoRfaVjeP8WiMqa32zRwJ4OtZ/8lC+M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085668, "uuid": "0920e9eb-3779-4cab-b830-1fa394752b2c", "value": 6195880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085668, "uuid": "37ed8f39-6ad1-4608-871b-744525c640c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085668, "uuid": "7ac1c008-1188-4cbf-a39d-d8d7e47d9eb0", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a450b024-3781-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776116537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116537, "uuid": "b0db2397-fe7d-489e-b0a3-e2f5681c2c4d", "comment": "Malware payload", "value": "001c589477fa089ad037dcf1a79e6f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116537, "uuid": "c30e552f-2eeb-41ca-ba33-fb5ad772b1aa", "comment": "Malware payload", "value": "d3852d9af00ffde1047520fe4392b01c346ad90c2cbef9d630f281b92da55529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116537, "uuid": "92dcf902-7603-4734-a412-9ebf499107a0", "comment": "Malware payload", "value": "9709eef632f517f56af971dca9c0d4d41d9a1d4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776116537, "uuid": "108befbb-66b4-4474-ac29-2cf6d6c6506f", "comment": "Malware payload", "value": "817d22540ad36023c995e31f9538a236ae7dec6710a68d51d310a909910a72fc23caad29dfb94ae8c02f5ee7b570bd4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116537, "uuid": "d0d9deef-efad-4d4e-a1e7-6c4d756fe3f8", "value": "T1630722E715D921F8D0D38B34A28B53D9B0C0B58985F9595F3AC72C035A21EEA914FBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116537, "uuid": "548350dc-56ac-4b11-a917-f80134098c16", "value": "b2e75b71068f6963ef466cd917a8621f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116537, "uuid": "12e54dc5-b483-42ec-9753-2814b25bba10", "value": "196608:PUmpHH/qeUTTRDGMC6JGgR31KihBqefwlyaSHlr6J02pl5ZM1N0FI1xIMqSQQ69w:P7H0Td/XJDR3tOKhav0N0y1qnTq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776116537, "uuid": "d56e2b58-a51c-4317-8dba-416023d95762", "value": 17701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776116537, "uuid": "d5382702-7e93-4c04-95f6-31412506f1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776116537, "uuid": "eaed6ffb-b00f-4826-8550-6661f4542f9c", "value": "Whisone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59422fb-375a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776099869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099869, "uuid": "1e239231-b6ab-4044-8d3d-97af00e6ee8d", "comment": "Malware payload", "value": "0563e2f2e91b7c325f19592056432a80", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099869, "uuid": "e9f18a1a-bdd8-4e73-84eb-b942be75fc11", "comment": "Malware payload", "value": "d3fa07a31970d495448f6fb53683e96fa5002088a3aba01dbdb6c4a08a29bdd4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099869, "uuid": "61bbd11f-d008-426e-9fa0-3ca1f6a305dd", "comment": "Malware payload", "value": "64d430fdf3af284cb6285236a6f28e2174f2498e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099869, "uuid": "17580858-6979-4286-99bc-ebd3be799dda", "comment": "Malware payload", "value": "a928f470a5018921c2437045840dfb46cf87c5a75ce7e70aa15ca5f93b207d5581a5f6b294c804d9839e7fc2ca216c20", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099869, "uuid": "8a125967-28e1-4690-8ebd-64c7be61aaa6", "value": "T196E022E88E16FE21C0700935820AE3630F11BA1A2A48F2A181E8B092E97018F3E27066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099869, "uuid": "5ef85ee5-b415-4b28-9cab-045ec32bfa7a", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrllAFyC67AiJZGPebRJ:4xtJCUOblw7BJYXHpUr7ebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099869, "uuid": "abcf7a3e-adff-41d1-aa69-2fe09df90178", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099869, "uuid": "31a03977-4cf8-4a43-89c3-8904fb68d5c3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099869, "uuid": "361688f3-695b-48b0-b48c-69bcea6d7719", "value": "testx.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ab1901-378b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776120727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120727, "uuid": "d74cd096-60ca-4f33-be0e-cd718dbc124b", "comment": "Malware payload", "value": "b88812bb83ccef31796bc0ce775770df", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120727, "uuid": "80dd4df2-696f-4552-923e-5f4e160dd748", "comment": "Malware payload", "value": "d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120727, "uuid": "d680f2ed-fe78-404c-9c14-2f14e29dd2c7", "comment": "Malware payload", "value": "a355cbbcfc849e14a0fcd3b3e0a00ea6377034bc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776120727, "uuid": "7fcb5d5b-651a-4212-b55c-051843607d0a", "comment": "Malware payload", "value": "5f10628eb214cd3167c1363c1a8c125aee9fe88a630068f06aa67f4ea6988bffb32281fd8ee3f2e80560bd48a09eee63", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120727, "uuid": "fd95cbed-16e4-4e2b-bfd2-a16d6b56ad3b", "value": "T1F1E62311A38FC226E16E0177D82EEE0EA1397EA7073041D7A3F4799E1E718C15A7DB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120727, "uuid": "fd12e1fb-12bf-401f-9519-4ea0f00fb36c", "value": "196608:YLlQ2gQ+LNduqXny5wE8JAL/1DwRdVYBsyHnFAdMJBUpHBaBRLY+QARnqR208S9/:YG2g1j5Ef/twn/KnecaVmYuhGp9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776120727, "uuid": "623e2b3f-b751-4617-8d9f-8bb0d2561db0", "value": 14188032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776120727, "uuid": "85de41cf-67ad-4aa3-934d-0ee95eeeae36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776120727, "uuid": "7d3eeda0-2b64-44c5-bb7b-ec8febcc5f83", "value": "chronmwin.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29058f6-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085691, "uuid": "b53919de-1da3-45b6-a92d-4d161be63a1e", "comment": "Malware payload", "value": "5d1672f96167420d608d2279126f6df6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085691, "uuid": "e163f028-258e-49ba-902d-f5f022f233fb", "comment": "Malware payload", "value": "d47049877ecb492ebae587fb74ce6482c24f009291452adc7d839c2548554a94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085691, "uuid": "4586bceb-c20c-4d32-83d7-d16fa9c43e37", "comment": "Malware payload", "value": "f6b0e5384470015d0868e787de7c41a8c060e952", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085691, "uuid": "56793755-3c73-458d-bf68-97034119de65", "comment": "Malware payload", "value": "2acc8620079973fd30cd2854988a642e4addf3a716aca36590eb9e27cf977f161224eb3f5a41cf5c7ded8e89651f3839", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085691, "uuid": "276448a0-4a83-4892-89e2-ce713257a354", "value": "T1C5A44238AEFA401AB1B3EF14AEE47493E96FBB63370E585D1081034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085691, "uuid": "7ecb8b4c-5dfa-4254-8d9b-b65cc309688d", "value": "12288:Oz5uBPhfRdIT6e2hr3psHb4YVoinNeZP/XmiGZR2:yuth/HjDUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085691, "uuid": "d05cf46b-32b2-4402-90d7-f1082c1e6ba8", "value": 482172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085691, "uuid": "be39f229-0d9e-4283-b60e-c56d22daab15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085691, "uuid": "3c71f6e8-cde4-40c2-ae83-cb13bae66587", "value": "Request for Quote Doc#0024.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0f4f62-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048802, "uuid": "b3235344-341e-4cf9-804c-c49379cb53a6", "comment": "Malware payload", "value": "ea3d3d4e3edab4092378cab72a935154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048802, "uuid": "6cd65da3-4c8d-4df2-8770-105de51aabba", "comment": "Malware payload", "value": "d4cf0ea01fd70016f760020f05890a33934c600030d93574dea316ec68667457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048802, "uuid": "ad57e3fc-df84-4715-972a-a4854916955b", "comment": "Malware payload", "value": "a8a62e21f7a4fe2c2b4ad2d70822e251cdc0f55f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048802, "uuid": "b31be4d2-2841-4069-a4ce-eb7a0c3a6c89", "comment": "Malware payload", "value": "e32fc1573dd9de57c1b7ec6a6dc1aea137b4fc5b9be703f8e468e6aa777d6f01177ea1bd5afc74658d0184cf05a4debc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048802, "uuid": "e0f9bc78-940e-4dc4-941c-d3d05ff88529", "value": "T1EB75338EEE9F86D0D4E4D906E4F2EAA544C745368859221EBFFDB1B12D3381B372C491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048802, "uuid": "2f0aa18f-c014-4854-adf4-af380683d7a1", "value": "49152:p3Ot9aRb6/CYiXBcVxgy4NdcvbKYeo76grkgen:xOt9kSniR8gy4Lcf7tr/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048802, "uuid": "de746c5e-7d65-424b-b053-a5f7b3717830", "value": 1693836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048802, "uuid": "3740d5b3-8716-47ec-a1d6-cf1d3c6ee0b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048802, "uuid": "e0050ea7-dcd2-47b6-b73a-095f54f26b90", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a7b0ec-3703-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776062560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062560, "uuid": "7c6b2c05-7d59-4ff0-ab21-40f7e9233ef5", "comment": "Malware payload (AsyncRAT)", "value": "33329e30ef225911423a0226a1f6d5b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062560, "uuid": "83a8cd70-680a-40b0-b325-644829b04414", "comment": "Malware payload (AsyncRAT)", "value": "d5640399613a1d35867bf069eee7c8bf4779caceda30f499426a15bc18b4130d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062560, "uuid": "3a8eeb93-1fdd-40ec-8b77-999117ac010d", "comment": "Malware payload (AsyncRAT)", "value": "476c207373bf5a672bf186eacc1432017b3299b8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776062560, "uuid": "4b194ee7-108b-4851-ae89-d5b57510403c", "comment": "Malware payload (AsyncRAT)", "value": "9bc2f480fa56c1e3d5581da4535f5eb3660b3f441e3925de32a29dfe497ebb985b623d594658767366d3346efc0c3b30", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062560, "uuid": "70a7f557-b344-405e-ba37-011d0ab26177", "value": "T153C1281867E95348F0F3AB0DA9FA91A3553BB91DED71CBCC1169D30D0AB1A008516F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062560, "uuid": "466b6195-b821-4a86-bb25-7e94ff153958", "value": "96:rsgsZ5Rd30Rr0Rr0Rr0Rr0Rr0Rr0Rr0Rr0RkoH23x9HtmkGH1m7LJtJb4q:wFdo00000000oB3PGAjJb4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776062560, "uuid": "71ed2f73-2356-46a5-892a-7012b7628d8d", "value": 5934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776062560, "uuid": "9b796fd1-b545-4f90-96bb-580ed9bf4212", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776062560, "uuid": "d4538db9-4fe4-418f-9522-3f7a2c63aff4", "value": "TBgpde.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7451e589-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085532, "uuid": "0d0f56f7-a347-48a3-9e14-80800de89d2a", "comment": "Malware payload (AgentTesla)", "value": "0ed209ea6d610166f8021c6f325b6825", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085532, "uuid": "6251e369-4c60-4846-8d1b-b6d44b6a032d", "comment": "Malware payload (AgentTesla)", "value": "d79596639850225c709f02c02719a4766aaa85b821d4ef5b50f35737b32ecc83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085532, "uuid": "6e64c040-a352-4db3-9d9b-6b080bd302f8", "comment": "Malware payload (AgentTesla)", "value": "0955f715670e20532601d5368ea8ed87ca7b3ce0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085532, "uuid": "3fb0fff9-0ab7-4589-8cf0-4fad54d54276", "comment": "Malware payload (AgentTesla)", "value": "4cd756272b68d6293111e0fbf3fcaa104d66c043d67bc4efe8c9634925d4be398e0c9987fcadb90f100c7556d3db8128", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085532, "uuid": "f1694ab0-84a4-42fa-aae1-2b83703a09e8", "value": "T152569418D0E4B90D58C3DF5EA636C4B04A8EB96AAE0D8DB2A43FD4BC1C55F9384116DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085532, "uuid": "74c524db-ef81-44da-8806-24dedcab5e6f", "value": "98304:VKJ0wU8Lp7mK/53K5JHpAC+yy34r5YXflHQlWcz3SuTpQPj02gprXh5qKJ1HDDwS:MJ1LtmKqJHqry441YXfFiWcNEjFgprXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085532, "uuid": "e5504468-dc9c-4cc2-b9d9-65a27673fe6b", "value": 6189736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085532, "uuid": "3b5d922d-210b-4768-a3f3-04ae083c6597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085532, "uuid": "bd029cc0-3f1a-49df-88aa-7771d2459789", "value": "SALE CONTRACT PO.XJ210821Q.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41dfe7c-36fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776058689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776058689, "uuid": "963bd56e-c888-4d41-8d5a-4e2c56b276c3", "comment": "Malware payload (Mirai)", "value": "3d1716c661f048898228609f2c1737a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776058689, "uuid": "b9b5aea2-244a-4980-ab94-eaf4266ac518", "comment": "Malware payload (Mirai)", "value": "d7e1dc5e919b12a67fb84db7b2cae8c5d857b997b973aa293cff8aa7005c7ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776058689, "uuid": "31506c48-6ec6-4b8a-b5a9-307aa15ebe27", "comment": "Malware payload (Mirai)", "value": "f6f05e5f8d5361a15f34203c968fea6adf1f4e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776058689, "uuid": "1785e328-ebbb-42b9-8195-d995aff17869", "comment": "Malware payload (Mirai)", "value": "603a969f53d1f77e7b31f0cb35a9e2378b2f9b52d46bbfd9fb6fd9d2f123311427d9a2cda402445f64d3b95d31a95a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776058689, "uuid": "eb5cc725-4adc-4535-8aab-059e8f4e73f1", "value": "T1F1C32905B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776058689, "uuid": "17bce770-fc3b-4b75-8abc-351a39f1caf2", "value": "1536:qMUMZ4Ox10MLEKQ777ZLag4RvAnjSLtROj6+cTRq6SyNOZP3dutc:qq4Ox9Q7vZCenCS8aotc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776058689, "uuid": "ba67eb3d-8827-46cf-939f-3eec40b65c08", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776058689, "uuid": "ba54b330-51a5-482c-b3ae-48e24dd88630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776058689, "uuid": "24f69af7-e0b9-420f-8fcf-b7f0df79633c", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a66c605-374a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776092817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092817, "uuid": "3ebf8ec7-1d24-45c7-90a7-93e43802dce3", "comment": "Malware payload (Mirai)", "value": "f6fa3a9b2a1e7c73db364a082497a0ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092817, "uuid": "22eb26bb-9db6-488a-9b6b-5ebf5a5d1f5f", "comment": "Malware payload (Mirai)", "value": "d88b030bf566c968f46f3163c5efa93d0689b398e34fa21934adbe09cd3c3dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092817, "uuid": "e48d1a1e-23ed-4efe-96d1-1d1c79261dd6", "comment": "Malware payload (Mirai)", "value": "fa587e84fb0b5ad7f354da5570ab6b65ad504408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776092817, "uuid": "e07721eb-1737-422c-a4c6-a2eff0f8ee03", "comment": "Malware payload (Mirai)", "value": "54e9aad9273fa39d23bd782cb0ea6549712a85f55dc27f4e830ef54cbad42252dd162cb4badc170c78d17f13a2f1e4cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092817, "uuid": "c1a49dc3-6b49-4917-a207-d82fb64596fb", "value": "T1FBA31A8ABCC5C702C5E0A1B6FB1F52CD375643A8D3EA7147CD19AF29274B85B0A3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092817, "uuid": "f09dc95b-048a-4bff-a63e-fc4513631242", "value": "1536:0j3VgSyozdJWM6/gJj44SrT78ktLGOkUUSwI6Iy8egZo+n4b+R:0j3VgSy26/TprT78ktLGFWypgq+n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776092817, "uuid": "2edf20e0-7855-4437-999a-de25b60dc58d", "value": 103820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776092817, "uuid": "1e2311e5-29b7-4be9-954b-83bfac2c54b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776092817, "uuid": "8382e500-ef28-4936-bfbe-255f3666c4a2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2dd672-3760-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776102511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102511, "uuid": "57ce55cd-d795-4eb8-8de6-28b88457ed8e", "comment": "Malware payload (RustyStealer)", "value": "24f9bcafd4190e28b31cddc15c723f3a", "object_relation": "md5", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102511, "uuid": "0e58daae-3ff3-46cb-befb-a4eaaec7cca6", "comment": "Malware payload (RustyStealer)", "value": "d8fcebf0f68ee6030a3d659d5de3013ce02c219c593c7a7dd88ed98ac139c7a3", "object_relation": "sha256", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102511, "uuid": "089ee598-ff2d-4728-90cc-f719977c2249", "comment": "Malware payload (RustyStealer)", "value": "dd18463fb2594e8d249600263cdd8dd01ca197d6", "object_relation": "sha1", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102511, "uuid": "8ff79969-2461-4dc3-b736-f235adb71260", "comment": "Malware payload (RustyStealer)", "value": "3e71ba33e9880a3e50db9d93c03749b828329144ce7c4cfc39197f7147c005f58a7e84f31327d6e9fd77f85bd1329779", "object_relation": "sha3-384", "Tag": [ { "name": "188-240-81-229", "colour": "#16F333", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102511, "uuid": "01131252-5b50-4048-be2f-99b00c049b1f", "value": "T14B082313F79541ECC06AC174861A5233E772B8890730ABEF7ADC86252F52EE05E7D798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102511, "uuid": "6e406587-cc4d-4e6c-b7cf-44d74f8ad93d", "value": "37e209056a9135987843f29414ef659a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102511, "uuid": "f59ec1a5-0cea-4846-ad61-831151355e31", "value": "1572864:76FPhcWXAmES8GFtsN6+kJJFaJzXiFUDKHXHXK9JhmDZ9ypcZUquzJHR1BmeF:8hckA9nGFt0tkbF9K9zEXypWmJxmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102511, "uuid": "69b2f9bb-c4ea-4935-870b-ff1f14ff4c9e", "value": 83893480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102511, "uuid": "2d109ffe-f334-4ceb-b62d-01c24e43bb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102511, "uuid": "92a48710-6e8f-46f4-854b-702373343dfb", "value": "nvsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddcf599-375c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100527, "uuid": "d11450dc-94bc-42bc-85e3-128a658ed98b", "comment": "Malware payload", "value": "e33425cc06ee86380969640e183eeb07", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100527, "uuid": "0dfadd0c-1a38-4169-93ff-d45199b0398b", "comment": "Malware payload", "value": "d90d806ef59f667afb9f63adf98af977ee24bb2ea0ff4afd5030f5b97f0b629a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100527, "uuid": "ac0df822-0f80-4d95-ae79-7c16e314ce9a", "comment": "Malware payload", "value": "230204d60836bbdc9268cd3c6dbd158a0f1df43f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100527, "uuid": "13a0e128-99a7-4de6-8dee-6234445b6af5", "comment": "Malware payload", "value": "a5885ed7744c3804def6a03e0a2392d390006368c50c56e56c7ea5d5bcecb378e274a1492870df910dd81d8326885cb9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100527, "uuid": "b0323812-e753-43f0-a19c-8e12af7c880d", "value": "T140E0A9E88E59EF26C4700C36812AF3200F1AA91A0B60B2E200E0A491E8711893E2A266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100527, "uuid": "02891f1c-0a78-4a4a-87c3-2231b538dc23", "value": "3:4xtllvptkldQ3kNP9Kklw7BJizl//Lr1UYrll8wWXx5FFyC6w5fJWXR3GPebRJ:4xtJCUOblw7BJYXHpQtXx1gEebRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100527, "uuid": "2b47f68b-7f33-4d75-b534-2f0dc2b0b7b3", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100527, "uuid": "41a1ff66-306b-4547-a54a-24fe3c1d4a9a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100527, "uuid": "dcf1d188-8436-46f6-b9ce-c4891708c184", "value": "form_99389.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d652af09-3715-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776070235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070235, "uuid": "7d963f8b-c162-4235-b218-c8c4785e22ca", "comment": "Malware payload (Amadey)", "value": "2d396dbc205cfc984cc843c582f1a053", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070235, "uuid": "396cca45-e395-460e-b5fc-45292cb26f5e", "comment": "Malware payload (Amadey)", "value": "da921834b074ea5c015dbe16ec50ed110700609cfb469240bb96139b20d313fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070235, "uuid": "b892f404-33d2-4d45-a111-acd5b856d54a", "comment": "Malware payload (Amadey)", "value": "08c7d0391127bb33dccb9e056dfd3ef3b3ad38e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070235, "uuid": "bb53cb13-1ab2-426a-ad19-2319bfea43bb", "comment": "Malware payload (Amadey)", "value": "0313c0b7bc57e2a178fa0ffb0a92b4aa01fc5b407034c257d5398ce547d3d01b5f131e981d94aabc470ff752a23128bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070235, "uuid": "7d2b45b5-6ec5-4f7c-b2b1-b495f38d2fbf", "value": "T178558D51EB9DEE1AC135D63AC1D66111E3F3EE85E2250F8B4B62FE5C11077025A2BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070235, "uuid": "b7512a7f-61f5-4586-8946-673fbace9d9f", "value": "8fa50cdca47c29e7b344a529b7e7d3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070235, "uuid": "587285fc-0ec2-420a-baf9-9b33e476e857", "value": "24576:4wd1Pcy63XOKXrQB47mMCGNQch64qwBsmMCGwvDW0BxmMCu2wSAGUzt8BXuIkokW:pou2a8UAGUwup7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776070235, "uuid": "154dd1f3-f5db-4844-86ec-4a91d2d634be", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776070235, "uuid": "8813b5bd-bea1-4be0-9d39-ab31e3c9a656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070235, "uuid": "cac334d0-89ae-41b9-a6f6-bf9ac0c5cf52", "value": "xda921834b074ea5c015dbe16ec50ed110700609cfb46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f648c02-3738-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776084960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084960, "uuid": "6fe1b3b6-6ff6-4acc-bfbe-841220aea972", "comment": "Malware payload (PhantomStealer)", "value": "53c57852dedfcd293ce819e21bf85830", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084960, "uuid": "b563d0b5-a5d1-42c4-bc28-8e9031a8b7dc", "comment": "Malware payload (PhantomStealer)", "value": "dbb474f236caeda92d5b893ed1d9f9e80858529754756a9ca1d1dc5597421efa", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084960, "uuid": "5504d596-cdc0-46df-ae76-f5d4f3af38c4", "comment": "Malware payload (PhantomStealer)", "value": "40d4c721cae141c3f6e52d98c6201c2c4fd1c3fa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084960, "uuid": "ac54780f-5f7b-42a3-93de-03c6345d44b8", "comment": "Malware payload (PhantomStealer)", "value": "fd2fd84121e6aa527da331616c41281d82c7aa1ade07d6ef9c9d8c54a6e87a06dccfcaff2c4d6d217015c6cc8725fbfd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084960, "uuid": "a8394f89-be2f-4ba8-b42f-bea859e84b6b", "value": "T133522E7DC4D4FCC4879B22D178EAFBC2129E87137E5A5B6CF9C800950B94364EBB9188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084960, "uuid": "829a0102-cb72-486f-8bdf-32b722fc82de", "value": "384:wsj6PgkAAB7MLv8yp156BJ3KhwVKKRq0XX5ixE/nGgNScXecBu:f3gwLf/8gwsKX+ELxBBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084960, "uuid": "4c2a41bf-adad-4ca0-8392-2d1aa47546cc", "value": 13671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084960, "uuid": "fc06a4e3-9c44-48bc-9d96-e609b37f4e1e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084960, "uuid": "26994951-9bab-47ff-9b4b-efffd7eb12b2", "value": "Sip. DISAGRUP_F\u0130YAT VE TERM\u0130N TALEB\u0130.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4443d6ff-3739-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776085452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085452, "uuid": "b61e25c8-2a02-40f9-9478-4929c3d3d87f", "comment": "Malware payload", "value": "aa7e409eb8c3c2abf37b3ee81d2a8443", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085452, "uuid": "515e7049-5a82-4b84-b148-b41616d78105", "comment": "Malware payload", "value": "dd4b56277b174faf4e7e65ee107d15fda931e063cab5b305fd226ca698270cb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085452, "uuid": "4e542935-c530-4873-a586-46f61f53600c", "comment": "Malware payload", "value": "37b3d6e5e39638e5ae7210258ebb87f984fa33b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085452, "uuid": "72e8321c-630a-4d86-8ec9-69f362146d42", "comment": "Malware payload", "value": "ae07b45396acec2a109844c894b3c531999d865464c9b8e3477719253069b1e441650810572f8f96ed41d625a6db2df0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085452, "uuid": "7894a3f9-f11c-4784-b9e2-a2ba26500448", "value": "T1A172308953498EC0D63AAAD7CE518491CFFADA73F0708C716B4A5C54061389CB87FEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085452, "uuid": "c51ade5f-ab19-4af6-b326-95191026758a", "value": "96:i3zucTWmaQUK5Pm0BxxjmRlLDTftSRpkaRkyiM/Zd7zTBTgA6TtToTwToTBTyTgy:GZTe856wxj1BsXhf3tH5k+pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085452, "uuid": "380080da-7460-4a25-a6fe-18a9dc83312c", "value": 16422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085452, "uuid": "d1b3cdb2-261a-4552-b1e2-a93a2518e880", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085452, "uuid": "d754625b-52e2-4c91-9ce0-7fd1325856c4", "value": "ZD-0010413026_Stolarczyk_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb9bc37-3757-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776098381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098381, "uuid": "ddc92b68-f8bf-4ae0-9dfe-b20cb49c9b80", "comment": "Malware payload", "value": "595142b735b84c9213663acc54581125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098381, "uuid": "66aefd71-f6d5-42a8-ac0f-7698d2892a22", "comment": "Malware payload", "value": "dd61d7b9d35663f32c719294ba96dcb8c1c74ccd23434472710496014a83caed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098381, "uuid": "776b925f-a6e5-4cff-85fa-7cb8688a7253", "comment": "Malware payload", "value": "eeaf914ecf6362cb194ef71f51b7c82973b25931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776098381, "uuid": "d80764c6-375a-4af9-b561-944fadf95641", "comment": "Malware payload", "value": "fd32455f391cada99684ae0784ce517340b662c14d3dc138f7ca0d0438871f96439c294a06f3db83ca62743c20f3d67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098381, "uuid": "a9d61a0e-1dbf-46ad-944f-4d37a74dc0b0", "value": "T1C04533915311E8ABD43707B090BC2ED7ADCDD01261206B774FE19E1D6E38BA8681AF5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098381, "uuid": "77c93a21-6a46-4144-a381-420cc780f170", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098381, "uuid": "061fd2de-f184-4571-951d-109f4f17df8f", "value": "24576:05DUO7B95kfsCOFZ8Hf/v3mjG97wFjNk14w8CRPfRC9w2ue5//e2I:BO7JkECOwXvWjG97CG14qRPf8EQXe2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776098381, "uuid": "e6489a14-ecbb-428c-b8da-e40af73c3e1e", "value": 1228506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776098381, "uuid": "0431658e-9896-46cb-900d-6d5f5475c23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776098381, "uuid": "a44f06cc-a836-45bb-bb6b-7b34a3f0fc1f", "value": "Contract_Documents,_Payment_Receipts,_and_Outstanding_Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40716816-3783-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776117228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117228, "uuid": "056704de-14da-45b7-9f24-5931c3859f65", "comment": "Malware payload", "value": "63a7ca2cae91c110169accff1d53a2e8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117228, "uuid": "e5edc274-b7db-4694-ac8d-b97572f76747", "comment": "Malware payload", "value": "dea6cfb3234780ceeea718787e027cc6d2de18cfead1f8cc234e0ad268987868", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117228, "uuid": "e6568314-b564-45ac-9d68-78a0de0c706b", "comment": "Malware payload", "value": "dccc0653c9174c88fe9fa4a83258f6a7fdd196da", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117228, "uuid": "676ef174-32a1-427f-a475-0d5bb1065a1e", "comment": "Malware payload", "value": "ffde0e4353f72751996f9ef1e1fd3f93a25bf50e46f9633a921ebdb1dd4ad0a618615e5b849682a0b0864cf449ab43c4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117228, "uuid": "1e11be4b-6511-4ab0-9780-2664c4aa1085", "value": "T1F314015B9C534C5DB359004A9C7BAF260363EE340A5F4DDEE785B4CA84F3AD8B606178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117228, "uuid": "2cf3ac3c-b6c5-4880-8201-073875b23448", "value": "6144:cWFcvYSqZWRIYj2L0q8EvS4WrCy6Kq4RS1230XiN:HivYHwsxvSkkS230XiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776117228, "uuid": "66a65f2e-a16d-4822-92ce-13a5ddb4dcf1", "value": 208338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776117228, "uuid": "e269017a-bb4d-4652-883b-9a3b14178b57", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117228, "uuid": "0f67c759-c23a-4315-9795-fe59d83db3cc", "value": "service.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be16669c-3767-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776105413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105413, "uuid": "9f01c02c-d8b7-4337-83f5-d1742b1e3327", "comment": "Malware payload (RatonRAT)", "value": "fc02dfa4db1176b4b8d3374de5a0feeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105413, "uuid": "5aa92afa-6c4e-4fb2-b00f-1dfbb69f1ec7", "comment": "Malware payload (RatonRAT)", "value": "decadae3bf66a1cf34b442bba14ccb1d1a4855a8348b2bf0991bcd1514b5280a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105413, "uuid": "673a5f66-7d9f-4465-b910-297459730676", "comment": "Malware payload (RatonRAT)", "value": "8cf4d57568fa78ee1c0bdb05e690c0537404b89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776105413, "uuid": "525bbd53-e07d-4333-9a61-81dc866d499f", "comment": "Malware payload (RatonRAT)", "value": "f6cba0de54c5f7b7abce060630995100c3ca30bbcbcd7a6c18c658f1c768c493b6e626f76c8ca448cdb1ab086d2357b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105413, "uuid": "fd0219e8-3c0d-4d66-9aa5-e9ff558ce948", "value": "T1EF06CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105413, "uuid": "31649ca0-f12e-41c8-be09-7f311d64c5fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105413, "uuid": "834432b2-8e41-492f-9d0e-42686b87a593", "value": "49152:3mu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sj:sq0WgVUuHjkDGjYQeqpgmltj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776105413, "uuid": "924daf59-de9c-4b76-ada4-8f5a3c230034", "value": 3696640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776105413, "uuid": "c13c550a-12df-47a7-ba9c-8d831bbc5fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776105413, "uuid": "483ffad7-faeb-434f-9d02-61620a566131", "value": "xxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aba08f-36f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776055717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055717, "uuid": "8c9121df-0430-40bf-82a1-265dbe59ac7c", "comment": "Malware payload (Mirai)", "value": "cf331ae316b23812a852bafa61fd6c96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055717, "uuid": "2a8afdf9-ae03-4706-9c1f-a57b9f75a2bf", "comment": "Malware payload (Mirai)", "value": "df74ad3aa76bed163e0b3bd72dce5e4d390711e149b45d9ea17d150b38732911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055717, "uuid": "0ff76515-618d-4864-868d-7f6d11a42772", "comment": "Malware payload (Mirai)", "value": "df8b9fa9229814e7d52408f4eb6240451bee3db1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055717, "uuid": "3307fb1a-b6a8-4b9c-a850-0e97d17501b4", "comment": "Malware payload (Mirai)", "value": "3395503b0f8dbb2ad52c6d76a80e7c6fe9ed1254b9682f76a3c60c5e2c0769918f6d4dc4c08e76014bc0f5f45a00ac05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055717, "uuid": "98e5f649-bd75-4049-bf6e-368f1bcdaef6", "value": "T16DB3F845F8409B17C6C666BBFB4E438D7B2A1758D3FE720399256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055717, "uuid": "074331a2-fdad-47c9-9539-e9970e9c9b54", "value": "1536:u2uVnPJ86wi4VI8RTUUCvyNOzju+m9wYeFZdmlV9MwywlQ33m3Ds2dgoYakJc+:1u9PJ/4VRwUSi+IxebcNhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055717, "uuid": "9c982e9c-38ae-49dc-9c0d-3d90932ef83a", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055717, "uuid": "42c35aba-59a5-48fd-a4a6-ed25e9d5edeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055717, "uuid": "449cedc3-9a76-4ded-bed0-14adea4645a3", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733186ee-36f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776055466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055466, "uuid": "c227f770-afcd-4e2c-8c3d-f801f1016a9a", "comment": "Malware payload (ValleyRAT)", "value": "130920e8dd16ec5927503f0ec1aa9046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055466, "uuid": "c9feb80a-ea21-42cc-9b95-04415f7174b8", "comment": "Malware payload (ValleyRAT)", "value": "e0fa452c7672f34e7f92d0a6a43d51baadecbebc5b134fb1e83c80085a09f9bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055466, "uuid": "46754171-44e2-44ae-9c59-f88bd3cc8760", "comment": "Malware payload (ValleyRAT)", "value": "5850a00c45c4a9eac009d525dd6e32f7bddd059b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776055466, "uuid": "02241e58-50cf-4c04-a0c4-2002b326215f", "comment": "Malware payload (ValleyRAT)", "value": "6b654627f0a73306b960849f67ebc34c444a9f8fafaf82bc5ae85940a9e2b1693f23ad0047a1c482273bf2e930731973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055466, "uuid": "0442a5eb-a2cf-4a9c-ac57-ea359750af7f", "value": "T1716533BBDEBA419AF2A181368E01DEF4259C383DBE91206715C19F8CE67FBD0E250355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055466, "uuid": "9e74e9d1-ca73-4bcd-86b5-9dd90bc100a9", "value": "8c4c69111630d8599dacdb4710373322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055466, "uuid": "ccb1eaf1-2263-498d-ba62-4cd716f1c418", "value": "24576:6TRRgkObgBSIi/MLxAnAwjtfCrEfRdMgGc4VdtUKPXPzQQ8JgBmmUWjz30C:6Tznni/MVOAKfCrqE1DPrQBvmTz37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776055466, "uuid": "5c9b8045-25ea-4d3d-9305-4f4341e64704", "value": 1502933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776055466, "uuid": "ef137347-7fdf-4b92-952e-50eb8b477229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776055466, "uuid": "71ca1383-f1d6-436c-b01e-6a439b599649", "value": "tod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee7e7d-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776060040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060040, "uuid": "4c41d45f-12c4-4cfc-b8ff-7477f100273f", "comment": "Malware payload (DCRat)", "value": "225992a37f4841b9ec369293033adbfb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060040, "uuid": "c80bf768-7d95-48c7-9cb4-57c776cf8191", "comment": "Malware payload (DCRat)", "value": "e27612b8fcea6e08c9f6fb9139744475affba0a2381d47ae20a7c93a39ef8ec4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060040, "uuid": "adeedfd5-bb9d-4b22-a26c-0726ae1b78a2", "comment": "Malware payload (DCRat)", "value": "7c01784686427afc337a14978300bc4c58a9c675", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060040, "uuid": "ce1bbb25-4168-4aa9-b572-7f0b76aa8dac", "comment": "Malware payload (DCRat)", "value": "8445574a456d7fbb68e1b574aec8f44a2cd8242e56caf3c849a29a92e88669231b9109c6de5fcc15311e30c9741b3865", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060040, "uuid": "41c01fcf-c505-46de-a6b4-f17605254396", "value": "T15A4549117E64CA12F0191273C2FF490447B4AC516AA6E32BBEBA377E55123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060040, "uuid": "3b1a8c1e-e3b6-404a-987b-8f700c2f26db", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060040, "uuid": "6f4429d8-d79b-4560-acb7-d6723734bc04", "value": "24576:U2G/nvxW3Ww0thNL9upaX3XfCqGxMO1st5hdPHwlV4:UbA30hp9ufp1Kdgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060040, "uuid": "cc3c9b57-bdf1-4f55-bb30-e87763e43057", "value": 1164406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060040, "uuid": "4340eed4-1def-4ed5-a6fe-bebe60b0b97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060040, "uuid": "012a4e63-2f3d-457c-9e11-5ce94bc233fb", "value": "daun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2010644a-36ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776053608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053608, "uuid": "4d629849-4441-4726-b558-e478088be980", "comment": "Malware payload", "value": "6ed031cfa668cf28c243e35b38bb66be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053608, "uuid": "964acc15-2033-42bb-bf29-264e9d13e595", "comment": "Malware payload", "value": "e2921a6fb1258148ada9930f40df18bf4a94dba92003069ec1a7c69ff2da8bd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053608, "uuid": "8751dcd0-db28-49b8-b8a7-8484af96c2a9", "comment": "Malware payload", "value": "624ce829c5fc9e2e9de5d8c0826fb2c7c8762780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776053608, "uuid": "7805dd98-616a-4380-b357-63b5f3b3d1f8", "comment": "Malware payload", "value": "c71b16d69e9f72531a3f1584853d84fd5938fa4ec179ea76723789a67b426321680a66dadacfd8f522b844785c7425af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053608, "uuid": "b456310f-3137-4486-863c-afd5985b8e6e", "value": "T1F8E3885A6E228FAEF67C873547F74A20976D23D623E1D684D2ACC1141F6038E541FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053608, "uuid": "d782c6cf-7832-4da0-88ee-ceb48c063005", "value": "3072:3O+qDHvC6+S0OUI425eNjZKcwumdEBfEVy:3Sfz0zIcNYcwumdKfEVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776053608, "uuid": "a90873ba-0e6d-48cc-961d-290e764d094c", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776053608, "uuid": "4982cae1-4987-4d0e-a5c8-1718c8c02765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776053608, "uuid": "0f005588-665f-49a3-be2c-6cf0015ee703", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f17e391-374d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776094033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094033, "uuid": "84eb30ea-0cba-4dee-83de-66ba7b30238f", "comment": "Malware payload (ValleyRAT)", "value": "c10d06f698e3cbc67cf16178a28337ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094033, "uuid": "6b3d8700-ebc2-4880-9e17-24d503faab5d", "comment": "Malware payload (ValleyRAT)", "value": "e2c72920b15258deaaef003cca1defdce6f6db00ad2f6c5e396a112815bea9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094033, "uuid": "97fa7d87-80fd-46fe-bfd4-67d74d45c46f", "comment": "Malware payload (ValleyRAT)", "value": "91f7c0c45235b2c1ec465b16905560e31a5298c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776094033, "uuid": "3175090e-8295-49c8-b7c5-25c378996a80", "comment": "Malware payload (ValleyRAT)", "value": "c8efd454800a7ea4ae318549ca2aa034103d3bcfd45e9f55eab32c68cac108b9a7406fd99764fe6d5ba9836cc026c1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094033, "uuid": "bebd6221-fe2f-456b-abc5-a338ccf2847f", "value": "T1F6C5B013665408B5E46FC135A8D69E3BEBB474420BA0C7CB13A8C6694F637C12F7E3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094033, "uuid": "a17e3712-a55a-4b4c-a4be-78e5fee620de", "value": "c127b5c3dca6719be48578d9541b6a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094033, "uuid": "14069e90-e8c2-42b2-a1d9-770f1a653d52", "value": "49152:GRItqar3Gb2P9QTdE2UY+FGV7cwS7FHW+:CIH6QQTgYV7bs2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776094033, "uuid": "a4190b70-7d4e-4ded-9e58-71553fd5f52e", "value": 2609624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776094033, "uuid": "b04362e4-061b-41f0-9c66-ce9cacfe1fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776094033, "uuid": "7d518f2e-703a-4be5-94bf-45eec6b9b233", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a35d238-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043478, "uuid": "73820bf5-a335-41e4-b7e6-6bd5f473ec9c", "comment": "Malware payload (Mirai)", "value": "d826c842e47893c9deceb90afb132d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043478, "uuid": "13784281-0984-46cd-87ee-e201e5811f19", "comment": "Malware payload (Mirai)", "value": "e2ca45274f5ced7ba85193ed2e4cbfe7e34aa07da46583dc42bea9fe615f0d8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043478, "uuid": "69f89275-06db-4f48-954f-78bff0d5d344", "comment": "Malware payload (Mirai)", "value": "9bac8d8ed97ba2349885ef8377a12c70cf2ebea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043478, "uuid": "f2ca6fc3-1f60-4e47-9dd6-85f990d6ee19", "comment": "Malware payload (Mirai)", "value": "059891074172d0e4aac7ca7df10bb9c4ae7c225f659cedd18bd5f415c58387a3f4fea0505cca211d71b0136d1cc16870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043478, "uuid": "28d47d90-f070-413e-83c2-c0cf8e02f26a", "value": "T12EC3188ABD429B02C4D325FAFB5F458933135BB8E3FB3112CD259F64238699B0A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043478, "uuid": "b444d01e-2de7-416a-8608-74f2f754ab54", "value": "3072:LN1DGqTbMQnRuFSFaflKcY+0FmELPUF5bDtjmt8vLj:fMERQgafgcY+0FmETUFrjmt8vLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043478, "uuid": "19f3c711-fce0-4d2a-85bc-ddfe48dd9012", "value": 123676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043478, "uuid": "4734929c-6680-4602-967f-b69be9056b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043478, "uuid": "f7123014-15f6-4ecc-9e3f-0e306079d313", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56911ebe-378f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776122419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122419, "uuid": "fed5645a-0e31-4abd-8cea-2cfab1e6f3b6", "comment": "Malware payload (AgentTesla)", "value": "e26893cdb57eae971f6e100c5449f05b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122419, "uuid": "0027c89c-d341-415c-aa32-f83a9d853036", "comment": "Malware payload (AgentTesla)", "value": "e3299b434ea8094b5f5d45b7e767e42f7a4419d89571b2b179ebf909e4338453", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122419, "uuid": "38ede979-7dd0-4e6c-a282-37bde818e3c8", "comment": "Malware payload (AgentTesla)", "value": "dfe5e12307122db9b89ba9c27a9f47acb98458d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776122419, "uuid": "6fdefa51-d979-46be-8e17-55a49de4b022", "comment": "Malware payload (AgentTesla)", "value": "c85fc52ea7c706fe6b5c2dcd06429ab47c37e54b54de15eeebc863e1685526779f98fa8519bb55ea4ca467de580f8cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122419, "uuid": "4fac4528-798a-4078-bfb5-18480fb6a65c", "value": "T16425332CC1077D39343E08DE17217CB1FF007241E547ACA96A46F9A0A7EC66A9563EB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122419, "uuid": "5e489664-1885-4e8c-ad0e-fcfc424f4fa9", "value": "24576:UroruS5ZKcJI2d4xSnXDW0RIdz4aHadlbQgVhMmzy:Br7fOx6aTaHbQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776122419, "uuid": "f2be9194-4a63-455f-9e63-69a7d44af04d", "value": 995003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776122419, "uuid": "2ca800fb-bbf8-4a39-8554-44aa8a8f0f50", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776122419, "uuid": "d682be98-60c5-4c19-bc70-49794167bd9b", "value": "new order pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574ddc56-3717-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776070881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070881, "uuid": "9ac7084b-81d0-484b-ac4b-83dd3084ebb6", "comment": "Malware payload (DonutLoader)", "value": "0cecc0a6a039438f93ebc30b5f9989be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ftp-antoniomayol-com", "colour": "#C6A2DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070881, "uuid": "bcee8a05-4488-4c36-b379-16b6b389f92b", "comment": "Malware payload (DonutLoader)", "value": "e48d6b1d2fef03f8d5af077e7df5ac94a564181697d7b80f62310bb9a8949f25", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ftp-antoniomayol-com", "colour": "#C6A2DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070881, "uuid": "9e241477-0fb8-4b57-bc88-cb2cf124f754", "comment": "Malware payload (DonutLoader)", "value": "21ceac600015ff0ed1d108115202bccf835b1fca", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ftp-antoniomayol-com", "colour": "#C6A2DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776070881, "uuid": "50dfa617-0e70-4f33-9ad2-cd7d3d39ebac", "comment": "Malware payload (DonutLoader)", "value": "5ca58cf7d5cf0c20935391ea8f3d0450762fde53eeef461127937d881b8fa683c0ea60c19d7207ddd22625192af605cc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ftp-antoniomayol-com", "colour": "#C6A2DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070881, "uuid": "f5d7688b-91c2-42b4-ab9e-7b0ed928593e", "value": "T1D044F11555CC2FA8CF785A3400FD192B73908AAF8169798EDB237D069FEBB401A1F1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070881, "uuid": "7885a5f1-9ce5-49d7-adcd-6dc8a15ab5dc", "value": "3072:1EqMADAjZpGIKor0dyF3XTo6rOBWe6QX2nRH7Ywv3AjDSzr8PV9QXdAWl047icoK:1Yd+74u6aBQP7x3Jr8t927uBGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776070881, "uuid": "593fbe2b-a743-4348-8f1c-4d8143f192ff", "value": 276091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776070881, "uuid": "679b1cdd-9f8e-4558-837a-bcea1c7d3f95", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776070881, "uuid": "37a43989-a9a1-4495-8537-6a269aea149c", "value": "RGHPO09876545678TG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5b5074-375f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776102001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102001, "uuid": "8d51149b-9e75-48e1-abeb-18ecac5e9d2a", "comment": "Malware payload (Gh0stRAT)", "value": "edec9e3deb9c9695b7a848b57d7c097a", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102001, "uuid": "e67dd4ac-9e62-4b9e-8223-2f0022708be4", "comment": "Malware payload (Gh0stRAT)", "value": "e64439c378326542318970b435d55bd27d85452786abdf0a989121d7eae87a97", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102001, "uuid": "dbdaa6b4-df66-4d49-a6a3-d65ce77ff5d9", "comment": "Malware payload (Gh0stRAT)", "value": "b63d599a60b2c801d05100b888bde3f86e02cf56", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102001, "uuid": "c868b9a2-10df-447f-b1f0-e306e19c32d1", "comment": "Malware payload (Gh0stRAT)", "value": "94b24486b99ee3a250baee6df6086b3ddbb3fe32a5ac33d5148053628289ac71d29c3034d2bf9088ca830afdfd1fe1f1", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102001, "uuid": "8071a500-be53-4993-b3cf-519d395c213a", "value": "T1B517332ECDCF15B9A54F55AB11D4925B58CAB805B338A8A6FDABDCC2C20C1D9732C374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102001, "uuid": "26485228-ad1c-4ba0-9153-e3937414f99e", "value": "393216:dNlvmnOEUhH4SA92jlSTUhTmSa1biHn+4h9SjlXIvB8hC5d/G:5iOEU94S1BgfSaJz8dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102001, "uuid": "67f6ef9c-0952-445e-9975-a174516da2c4", "value": 19525871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102001, "uuid": "6f348beb-6756-4f17-8551-f3ea4e321d8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102001, "uuid": "56b70927-9bab-449d-b91e-f6d7e43056b9", "value": "Electrical appliance purchase orderxlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a98b6f6-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776085865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085865, "uuid": "384d822c-577d-4cf0-9c04-0f55d232c686", "comment": "Malware payload (Vidar)", "value": "e72947f3b75951a922e9769752780b78", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085865, "uuid": "c9c78ddf-e2e6-4f18-8423-2450d33e191f", "comment": "Malware payload (Vidar)", "value": "e6fa70c3e60eb3f6c7c3fc0b7c8e746f16debd9dff4308b145274276390b75ba", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085865, "uuid": "9f8ac4e0-a75a-4410-b5ea-db76ee7afb50", "comment": "Malware payload (Vidar)", "value": "d832d37db701c35d3cf6077554cac67df8f75ab5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085865, "uuid": "74341766-cc8b-404f-8449-bcef748c6c46", "comment": "Malware payload (Vidar)", "value": "8f3acd7c65f5c362967359b816fc5539a74b501147f9069db419b94c97130a389bb40adb95f325d360a61aeb0effc553", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085865, "uuid": "b8e53629-eb96-4a42-8899-ee050e1c67b7", "value": "T1013111211BB10329EAF78B3598FE7213A6307806EB219F8F01C0035845B1021E866F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085865, "uuid": "378bb76c-de82-4563-8a82-a175f7a37015", "value": "24:8czwdmGjMDvSwjKUaWU3AcPWkp+/CW2prYwRlnyxE3T4wZE3Ur4I0WK6c/6Cab7k:8c2meKpUQ+FRsk4wbUIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085865, "uuid": "a68a4ab7-261f-4271-8823-db3a21566c6e", "value": 1867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085865, "uuid": "92e88cfe-7c76-4531-8275-0163209d4e56", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085865, "uuid": "3c60d331-588e-422a-8833-f2d666da1938", "value": "IMG-464360077.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12016a35-36fe-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776060027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060027, "uuid": "99883543-7b8d-4772-9b74-578c934a4e3a", "comment": "Malware payload (njrat)", "value": "28c9bdb24a0d8967c85bf04cc76ac31f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060027, "uuid": "ebd82321-c0cc-422a-9994-eb0559c374af", "comment": "Malware payload (njrat)", "value": "e8075b112dce342920a41f450cd06c037217b72c817f3954861ecdc6a844fa42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060027, "uuid": "2aa02439-2ff2-4781-b757-5fd54dbc9daf", "comment": "Malware payload (njrat)", "value": "fc725f543973af92de3f9af346476a3c33dacf92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776060027, "uuid": "b6f4e354-552c-4a44-98dc-fada5cdb6f4d", "comment": "Malware payload (njrat)", "value": "2795ea20a08674fcd5f6dab18cb4184487daf3d122fbcbb1cad7692a554dc471c4a294f4c67f973398ec51a0577449fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060027, "uuid": "4fce6a2f-3464-42b8-a972-0dd86e8d7b55", "value": "T153E22BADFBE64465D1BD0AB50671951013B4E143E523F77E4ECA24A62B3B3C84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060027, "uuid": "f3f66490-09dc-4765-b165-1df5ec182c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060027, "uuid": "9f039e00-876b-43cb-b514-a5dedb5ebe44", "value": "768:kh2QgAJ5r9mzxBu9pPKDJBPvhZ+KQmIDUu0tiUAj:0g0sfRTQVk8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776060027, "uuid": "fd418112-bdc1-4784-998e-f7ea37d22710", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776060027, "uuid": "5d61a897-7f31-44fd-a94f-cce64693305b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776060027, "uuid": "3fc6dbb0-07dd-469f-a735-ef8e06fb80ab", "value": "28c9bdb24a0d8967c85bf04cc76ac31f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b35afc8-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776085839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085839, "uuid": "69838731-55ff-47dc-85fc-04ae2b5df9ee", "comment": "Malware payload (PhantomStealer)", "value": "bf4ac7501a877bddb7908b6c46a5d878", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085839, "uuid": "e16f3e33-df92-48b4-b096-0f76d939da31", "comment": "Malware payload (PhantomStealer)", "value": "e89b2694d79be1e2c98d0cad3e2e75b83fdd9f334756d34eba62d21eb3605fd7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085839, "uuid": "dd5af0a8-4817-42c9-b3be-c9ee2c006ebb", "comment": "Malware payload (PhantomStealer)", "value": "f93be2456ec3ed611d7ca876f8d4d02e98b88f13", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085839, "uuid": "3c38fde1-bff5-4f9f-96d8-1de4ccf9fafd", "comment": "Malware payload (PhantomStealer)", "value": "98d08196e92a439c5b115826e1d4ab4b08f0c31e19608b70cb82b286e38a88cdf3d575ac12c984f01042ba13ad72eb4e", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085839, "uuid": "cdae2cc3-332c-4036-b617-6947056abffd", "value": "T10A82C82B9A05DFF00A3E3255659BA816A9204363B5382D4D7C8FC19D3F7A610CBE15FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085839, "uuid": "31c8c61d-d9d3-4c51-aacc-0cf42bf351ea", "value": "384:KSTTDSJ2JbBGQK+lsuwP+tPGIn9TPFf3F3aa0lF8TGK8g2irc:KSDK2pBjOGIePN4RCCg2ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085839, "uuid": "068b30e4-aacd-4e3e-82c3-c0d6161cc354", "value": 17809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085839, "uuid": "8f151aec-06db-4262-8e7a-e6f2db028b4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085839, "uuid": "709a1f93-22f0-4bb3-a424-905858b81273", "value": "salary difference & leave adjustment.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df659bce-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1776085712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085712, "uuid": "d074fb03-1b3b-45d2-9392-bd85ccd4623e", "comment": "Malware payload (DonutLoader)", "value": "0f89879373a467cc3b8790f94e987ce1", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085712, "uuid": "f8d6054f-7fcb-4913-a343-ed06e985d98f", "comment": "Malware payload (DonutLoader)", "value": "e922a21664b7e71fc288da99b301ac575eea29d56b03bc11f520aa13e0408b10", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085712, "uuid": "64cff2bd-3339-4ad8-be25-d2a5d093f70d", "comment": "Malware payload (DonutLoader)", "value": "b496e0577a7ce6984c52d8f696c78bf6ecb983c2", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085712, "uuid": "2af69bfd-afc0-4185-8d58-361778c50bdc", "comment": "Malware payload (DonutLoader)", "value": "58c3f629af3e04756fc7097a23b110c0b7b1dd1ce4d8de16325c054f6a6fee6e3776e4e443a083185b2ebc3b7d3e24aa", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085712, "uuid": "0fbbab0a-01b9-4123-91f9-95dcc3d4730b", "value": "T1A6F66264E8F6A14AB3D1D78E853AA590988E60771E1E8E26300FD13C1C9AFD78550DFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085712, "uuid": "5e478815-adbb-4c10-bb64-d71812b6dc06", "value": "196608:srujIMNxZCsk6ZZEgsmGGOP+mV90hPaDH:ohMNmsk6D8mGLx90hPaDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085712, "uuid": "edf8ca9b-e305-4bde-a808-c2a8b860c1af", "value": 16112139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085712, "uuid": "7df93e8d-8861-4e98-a824-3b2b577cb570", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085712, "uuid": "2c080d9f-2a07-486c-bc08-dbfb5d644d27", "value": "E4132609442.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ab209b-377d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776114923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114923, "uuid": "62895ad3-186d-4e7b-bc21-9ba8bb4ff6a8", "comment": "Malware payload (Gh0stRAT)", "value": "db8c4caae2bf2f61d3a72c0a6ef40610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114923, "uuid": "11983dc6-67ec-4e4d-a8e3-09744ea2a034", "comment": "Malware payload (Gh0stRAT)", "value": "e98d8cd621d4a335d42b887be93e872903eebd59ace03d92965058b5f2bec336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114923, "uuid": "552d36fb-ff9a-471c-9aa8-7c9a9ebff89c", "comment": "Malware payload (Gh0stRAT)", "value": "5e5d49b298ed76d7e97ba2ec84f2cfdae6ba64f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776114923, "uuid": "0afe1ce0-5e8d-462b-9800-94dbdc6a7341", "comment": "Malware payload (Gh0stRAT)", "value": "5f6f473774f6a1a9d92a52c8673f390c5b4f2f2740e075fac627ffda4b3ec697377d3d83697b80e641c26eb0f773e5d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114923, "uuid": "b6dc0fb2-a14f-44ba-b936-746b06f3ad79", "value": "T1C4D73313F7DB553FE529953A1AB3C272813F7A2026168C9696EC74DCCA2A5C00D3F64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114923, "uuid": "21ca00b9-96f3-4bc5-8d9c-b25384764017", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114923, "uuid": "85437fd0-cb4e-427d-a4a7-16e25e2e00a9", "value": "1572864:VOg0bGnaPWnpBa31AYZvyNQNIk9bmjtNOq+U5vURkpS9D6y:FXnpezZvywuoU5vUKpS9DD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776114923, "uuid": "dbbda24b-a699-4baa-b8d0-a11f5b0fd6dd", "value": 60437968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776114923, "uuid": "f34f0390-cfa2-42e2-827a-86214912542e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776114923, "uuid": "a4426624-285a-4a17-b655-c22674dcf190", "value": "GapiUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15cdca7-3747-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776091621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091621, "uuid": "b7e1373c-cbbf-4d8e-ba7a-7637f7b0e322", "comment": "Malware payload (Smoke Loader)", "value": "57c4b459fb5d9f34909b73f838c58209", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091621, "uuid": "f104fab1-8210-478a-82b6-46043a392dcc", "comment": "Malware payload (Smoke Loader)", "value": "e9af32d6f1350073ac15fa90ef9ca01f598af37b58c0e1ae6b93c12361161a76", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091621, "uuid": "86b90042-c0b8-45c3-84bd-f2471552292e", "comment": "Malware payload (Smoke Loader)", "value": "8eb00af8b4f97eef3142b62d336bec4d0d911349", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776091621, "uuid": "6fbbbde7-62f2-48cb-97fd-e878a1dcdb79", "comment": "Malware payload (Smoke Loader)", "value": "dab253c2887423b7d222add1764384fd8e80804bbe966b971b14321cf98d5a9b05b7d43362569b5e39a29aabfe3396d2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091621, "uuid": "f012f0e3-a9d8-41da-9240-fc5ad8d4f348", "value": "T1CFA55A0B7C9545FAC4AAA73688B66591BB74BC090B3233E72F90B6382F767E05D74704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091621, "uuid": "dced4243-1c89-4907-9071-99773ec6777c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091621, "uuid": "b6200ded-18a7-4220-a249-9c3b4e8adf6a", "value": "24576:KTv+cLxm0xZbL6uFzylYk+hjGc+pU2VWPrheleh2KmyVeZ:KrxtmCbL6Qzyyk+D4U2VlIUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776091621, "uuid": "1bdea332-c8c2-4a13-98ab-2868e2668e05", "value": 2151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776091621, "uuid": "7e16dbb3-3b22-4a5a-b6ce-5e6ad5993906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776091621, "uuid": "7c0873f1-0690-45dd-8aec-1a62db45d919", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9305f3fb-375b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776100187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100187, "uuid": "08e06f84-f82d-42c2-ac2d-212218823a82", "comment": "Malware payload", "value": "bcf81e8826a5dd910070fd6b76a58e13", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100187, "uuid": "3234db2d-0863-4748-918c-76a04a7e565e", "comment": "Malware payload", "value": "e9cf043b043098180be37fe96147a2c13ede97a14205bfa4f2b7827b1cf038a0", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100187, "uuid": "7d748f0b-78e2-4f00-bec7-9a53f8fd3f17", "comment": "Malware payload", "value": "67dd06b6811d8eae32e7b1eec965c8c95d8fba8b", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776100187, "uuid": "c354925f-9021-4841-8b4c-45c9326db119", "comment": "Malware payload", "value": "87adbc5944bf8093fd3881d3305f3bbb0d88168ab2e77d9e7f7e6d75dc75c2df41e0d03c72f20bc20ebc31b866d5530a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100187, "uuid": "a3893b16-efbe-4ddc-80fa-ce69f5b8b986", "value": "T10F41B5EFE4169334CE43867501AA6C9DDF22E63B5502A050FA8C4E45BB149B5F3A13DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100187, "uuid": "6f0d58cd-ad38-4b9b-90d0-9f50e11102cd", "value": "48:w2MkMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:+kUP4ZkS56kUf6qo8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776100187, "uuid": "5ea34691-7e8b-41d1-8607-d7408261d586", "value": 2277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776100187, "uuid": "1acaeccf-a9b1-4db7-9013-653396d86add", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776100187, "uuid": "c008c743-bb02-4d01-8c65-677d297d1120", "value": "form_897893.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358d9f45-3736-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1776084139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084139, "uuid": "20e75a8e-2d42-433b-8a61-63be77242d47", "comment": "Malware payload (SVCStealer)", "value": "e9d5e5ae99fd339f19c475246fdaac66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084139, "uuid": "a4c71314-f767-467f-b062-ee19bed8d303", "comment": "Malware payload (SVCStealer)", "value": "ea05197e0c3bfb7ca461146bcfba417834b97a96d2a24397d745fe0f487e5d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084139, "uuid": "d40510fa-d4be-42d0-a07d-561559d0ae42", "comment": "Malware payload (SVCStealer)", "value": "7a7b77b017111fbe515b69b36776f3bcce8d1b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084139, "uuid": "5351ab43-8bc2-4522-af2e-1adbbe2ff2c0", "comment": "Malware payload (SVCStealer)", "value": "49b6a6088b72a8eab81cf53727c8f483604d91f94ca601e64493d6cfa59f5fce4ebab8a7e39be1b972ea8e72792b5ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084139, "uuid": "8e929d8e-15bc-49ac-9050-d341cad7ce35", "value": "T166F36E0A335460F4E17B9278CDA25B46E7B2787A17B1634E437843BA5F33251AE3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084139, "uuid": "53980b5d-123a-46ba-8b09-b0dc7cf2a04f", "value": "58e55310d66c611cb140f28166224b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084139, "uuid": "9f6feb51-58d5-419d-9fd0-9a896ed47f03", "value": "3072:H7nVDG7iPEC7P6Tx5TksYq2KCTzo9I/A++3lJ+56Kpv/f:VG7iPECL6TTTtjE4I/B+7rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084139, "uuid": "fa6881b1-2db7-49eb-8ed7-f26077eb0a63", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084139, "uuid": "c6f1ec27-0026-42f0-bf0d-015374fc7626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084139, "uuid": "912aefa8-1079-4d35-b2be-3a3781cef045", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60952de-370b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776065940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065940, "uuid": "be2a9fe8-de69-4133-afbf-52eda511bff4", "comment": "Malware payload", "value": "02d3faf760791591628a1b31d7f06f2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065940, "uuid": "e7eaf687-8eae-492c-b6fd-d6be9d482698", "comment": "Malware payload", "value": "ebbcdbfc44a26db06f240952c5882e1a7ade491f84e689ec17cf88276b4eedaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065940, "uuid": "486aa04b-c1e5-448c-ae9c-cc2a7ed17f14", "comment": "Malware payload", "value": "863c33cba0b950af96909e765586350a1a4b233a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065940, "uuid": "ebd9bcd7-545c-4e06-add6-459935f43c1f", "comment": "Malware payload", "value": "c2b80d4e34f597bd191692bc5746dceb99e32033704825b4b9a0f3aec6bc9a56cbd659e42c9ac20b1c8cc34031197b68", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065940, "uuid": "f26d7614-d122-4729-954d-ea62cb342bd8", "value": "T155B44F38ADEA401AB1B3EF55AEE47493E96FB7733B0E588C1081034A4723945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065940, "uuid": "682d02f9-5ed3-4186-9cb4-e4a45acaeabf", "value": "12288:ekNncA5IXuJTpo2mLZir9kUzD++L2vOpG1y5+Ms7upVCngmw5XU0o:eklCa/3y0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065940, "uuid": "7a78f238-b4e0-4cda-874f-838aca39b8cc", "value": 502924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065940, "uuid": "db159515-c640-4711-bf01-cd899cf7273c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065940, "uuid": "3010f8b5-4522-4158-9fab-69e7dfe28776", "value": "TT COPY 0081369904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9245d637-3722-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776075704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075704, "uuid": "b981027f-9c52-4029-9701-788ecefedc53", "comment": "Malware payload (RemcosRAT)", "value": "82b0f297b309a56ff878fe3da79644d7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075704, "uuid": "7f15f115-a15e-4322-9e77-a8f7cbaecbdd", "comment": "Malware payload (RemcosRAT)", "value": "ec16924f17c2b41aea206ee5de28accb1de198076730259bb0117109c45f9c5b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075704, "uuid": "d64d5272-3b7b-4eef-b0c1-8dda7d309ca4", "comment": "Malware payload (RemcosRAT)", "value": "8390ffbb6d619c3ba9f5f4531806b7a68b53d56e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776075704, "uuid": "f238aafd-c85a-4ce1-9285-5a1e5b948a6e", "comment": "Malware payload (RemcosRAT)", "value": "11b7a593da63d30aba30454bceea32e0d7b067fdf08ed198b721e20558c3a06f6cc546d495e97f2c15f85f883a157c64", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075704, "uuid": "a518f3b3-8f59-4276-9991-289332353b12", "value": "T17EB601F4CF04746ED2AB973E93F991C18F497C466D0E958DB9607D320E85CE02E68B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075704, "uuid": "6ea7d519-c455-470d-b399-4cea5d2e1536", "value": "dab9a384a2e5b54b344731c03c3dcbfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075704, "uuid": "86d46a20-34a5-416b-9fd8-8ee356d5f357", "value": "196608:HdL5uVJkOxMIc0MGgfdL5uVJkOxMIc0MG:H+fRZclv+fRZclG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776075704, "uuid": "5cdaa274-1b10-42fb-ba08-c19fde6a1b4d", "value": 10839040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776075704, "uuid": "34a4a8bb-2af7-4a77-b656-4ba04b6b4a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776075704, "uuid": "64d04f3d-0170-4ca1-b24f-bc7df448af5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3eac68b-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048810, "uuid": "d579a822-501c-4482-bed9-d8aa051b0b3d", "comment": "Malware payload", "value": "55f5e67576509dd85a9bc6ec0d08d930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048810, "uuid": "c52a75ea-da9e-4e29-abb6-5701cbff7d22", "comment": "Malware payload", "value": "ec6339d9d46f43579a9e15119625921c3c0889a46d891d8f977244744e91bcac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048810, "uuid": "fe17c1d4-0777-490e-8426-9f4c856447cf", "comment": "Malware payload", "value": "224247ec3fc597d536eafd348d74c2c72ab137f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048810, "uuid": "7b679e4e-5bee-4693-a2fc-056919fc8ef0", "comment": "Malware payload", "value": "2f4f200f4112faf1cec76684413e9c1ba37e6f193d858249995f8fcd186300c145cc6c37afc38fa61d18e5456ae35577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048810, "uuid": "52413d00-be69-468d-bc61-2a4b026966c5", "value": "T1328533433DF04A6F85B5B4B7D9834C72B66C3AFE4A4A9489CE80CD48EEC75E1160E4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048810, "uuid": "f7fae882-aeb8-4ac6-b79e-5a3f43b0276c", "value": "49152:RH4laTtAdC++fVXQBHp+t5J60qHuFjYpoDuJ5BCoR:Yh6gBHpWL/qeYpoi5BCoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048810, "uuid": "61779afc-81ab-44a8-a96d-11810c0d7f50", "value": 1722028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048810, "uuid": "c81d6ee6-bd2e-44ff-ab84-a3adfc898d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048810, "uuid": "2b330467-0133-46bf-8cbf-983c7dbe9352", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92adf2fa-3735-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776083865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083865, "uuid": "c60bd327-2458-4b60-b818-c2b4faa01436", "comment": "Malware payload", "value": "002e269ae94dfc788a24adb92b4c4b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083865, "uuid": "76084f4e-8183-4f52-907b-3d81b69c6805", "comment": "Malware payload", "value": "ec83f2b9ff230c77ebbce326e80834f2714945eace0f9675d9a000202b56f4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083865, "uuid": "26e7613c-64aa-4a50-bcfa-3ca56e0cd3f0", "comment": "Malware payload", "value": "cf524c80632a1fdf332e518bcecf945b8ad02e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776083865, "uuid": "59d9122f-636b-45f1-b7ec-1c7cb76dd964", "comment": "Malware payload", "value": "c3199fed832bc2dbbc1f4117d528eb3fe522b5d6074fa6d3b14c17af6892d9cd66d1f1aedb6a4f03e6ff6f548599f877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083865, "uuid": "07beaa0f-1e89-46e1-9d94-3c0dfb190d0b", "value": "T16EB45038ADEA001A7173EE14AED47497E96FB773370E585D10C1038A472394AEDD9A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083865, "uuid": "d76261a9-5fe8-45b8-ae6a-f6a3d056cbdb", "value": "12288:nW2YE/sTIOYjNeqv/pPCBVAmvzQhp57xFewIEOUHEfi0C5SWZLn:nmYysdxXr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776083865, "uuid": "35888884-ef0c-4281-8c57-e4aa592a690b", "value": 506302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776083865, "uuid": "65bf1404-459b-485e-9f13-257d36ca877e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776083865, "uuid": "ce894579-d5a4-4453-ba98-8df335713875", "value": "order 3102319727.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e91468-370d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066615, "uuid": "84386aa0-67c2-4ac9-8bf0-2acce1695b77", "comment": "Malware payload", "value": "c665978db00bb0f222ae7a0e795252ca", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066615, "uuid": "89401f78-764c-4088-acc0-2535f533e0e3", "comment": "Malware payload", "value": "ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066615, "uuid": "c3e4522c-3edb-4e06-8902-ec8854b119dc", "comment": "Malware payload", "value": "76256a724562a9ad941c8fd2041cd0cfc8cb900d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066615, "uuid": "63e706c2-9d15-46f6-8a07-904ccce7fa05", "comment": "Malware payload", "value": "38d516e5cfab54d0990faa2eb17629b0eb13e783614245b54f7431c8ed505263c69985a9384839a02be2142c8c89330c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066615, "uuid": "bd704fba-5c94-49b1-9f43-8eeb694a33f8", "value": "T122C27E61BE98F0B897CF330776B4F9969534B7B2A08D655C60EE84C153DCAE0E53C192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066615, "uuid": "e64c015f-7fe6-435b-aff0-75a182424654", "value": "384:j3CCmd4S3p5Y+ugCM0Y2FBAmOiaq0rJxmru83pE:WCY4ovY1gCM0YWMA0qxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066615, "uuid": "39653da8-b451-4802-8616-42f7cd3bb431", "value": 27195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066615, "uuid": "9c17954f-5291-4649-9fcb-8bf25c5c7bd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066615, "uuid": "1fbbc598-5adf-4873-8f51-5eadff51f8f7", "value": "ecb24042763d29992391a8ce3586035780fa7a6f082002ca7229cc316e314fd7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82506949-371c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776073101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073101, "uuid": "25e34bf7-c272-42e2-bfc5-06c731759cac", "comment": "Malware payload (Formbook)", "value": "d9bf7765d4e3a5070d40b168b72ee18b", "object_relation": "md5", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073101, "uuid": "a571ed91-48be-450b-a7bd-d2100f525f99", "comment": "Malware payload (Formbook)", "value": "ecd983b0de122bb62a6203d687984d9f890032472679631c8b1259652bbad8a7", "object_relation": "sha256", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073101, "uuid": "bb2c8ba9-8feb-4846-b511-4a33f1cc59f7", "comment": "Malware payload (Formbook)", "value": "46d2eb5e5fd93e5026d4d8487c230ac719c7ba73", "object_relation": "sha1", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073101, "uuid": "b68c2573-7cd7-44ed-a87b-f28756c0e733", "comment": "Malware payload (Formbook)", "value": "a00914aa589207ed4a9ff97e307ba78f19ff64eb75c8dbaa142e3abb09b5e806807533e3cd6a1cdff58ce160d907460b", "object_relation": "sha3-384", "Tag": [ { "name": "DT4784994", "colour": "#4CBA2A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073101, "uuid": "4bb80019-a503-42fb-9b53-837c576b3144", "value": "T10236331C1748AE0D2B9C9E9F09DC264C74BC9D8C69BB51562B03D4DEF936442EEEC368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073101, "uuid": "b4f0dadd-382c-4010-b0a0-0d9dc7e5976a", "value": "98304:3zXCJyC7vgMKu+NBCPJJCNL8JocANiKc7gpIDZhcdODvnPCGmp062HRAsN/ge3p+:3zXCJyC7vg1vCJi+AQn8IUdOD/PCLp0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776073101, "uuid": "8c7f0085-45df-40f2-9bc9-65df778fe6b5", "value": 5145263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776073101, "uuid": "2daf828f-7675-4e22-b822-365995a51e49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073101, "uuid": "52481dd5-3938-4bb2-9adc-b986044e3b4e", "value": "Contract DT4784994.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d563b2-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084574, "uuid": "1c80a12f-3992-4c1d-a541-4795443bbdf9", "comment": "Malware payload", "value": "b245384d0ea4fa15c7a20e58d771f2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084574, "uuid": "37753fe4-beb4-4d69-9859-ee6244295efc", "comment": "Malware payload", "value": "ece57a0c60c8b634eb2fb7eb98d5926f67052d8f796bce4975b63b6adf26334c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084574, "uuid": "f924d566-190d-4181-9797-6a7dfafce58b", "comment": "Malware payload", "value": "74ed9e0932f43df5b6ed5eb0f044dd478403b683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084574, "uuid": "a096a841-1ed0-4764-9e92-1282eb65a03a", "comment": "Malware payload", "value": "590c01d3f09d98b5a4ba70ef4e801fa4b1cfff56d4489b1f0b111c7dd6d572cb9b0b7782b084befea7af1afcf9987fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084574, "uuid": "d2d7322b-17f3-4cbc-b5a2-69dcef40c478", "value": "T19A835B12F251C039F0F700BAC7B64B7AADBCAF10536890DB63D855A9DB61AC1BA31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084574, "uuid": "d54df5c7-59a1-4af8-ba51-5939e21fad36", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084574, "uuid": "dfd7736c-dd1a-49dd-9f8a-b91e9bcf4233", "value": "768:g/AOCLYV8f44npN+B30xKGDP1kQOQhVEebkkPeLEDtXQn7AiRFi0o3AhRKBBRHSn:gKC8fHN+Bw/DnTbkSe8GbuAhoB2yA2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084574, "uuid": "3d5f84a5-a0fa-42cc-b50b-0354dc026b65", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084574, "uuid": "57d566cd-9ee8-4ddf-8de0-d310ee3ff03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084574, "uuid": "a67fed6a-c3ea-4269-a63e-4ad8a6349738", "value": "b245384d0ea4fa15c7a20e58d771f2a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3704cc15-3737-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776084571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084571, "uuid": "5a5e4ebd-284d-4387-9211-cdc396434dea", "comment": "Malware payload", "value": "b41f478f33a0ba481b2aff40ef2c89d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084571, "uuid": "6ca5e6aa-80c9-4160-a7c9-cb8af738b7ab", "comment": "Malware payload", "value": "ed28b7709204a841f2933c665cb3ef8943ba126762bc99bff30e1c19afd2477d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084571, "uuid": "0ca27443-cb2a-4b3d-adcc-e38c261303e3", "comment": "Malware payload", "value": "29c4d04cc610503ecf71cd65f685370346bd3453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776084571, "uuid": "45947f83-ae65-4720-a1db-2c051fd52f70", "comment": "Malware payload", "value": "f0638aeea64e4c42fc1c583e371703eabbf30c22fc99de8115361a23d46e277b13640034fb67ac33100547faa480bc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084571, "uuid": "3b94f467-10f5-4388-bca0-6d33d4611f16", "value": "T163834B11F241C036F0FB00BAC7B64B7E9E686F21636850DF53D865A99B71AC2BA31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084571, "uuid": "8776b9f6-9da5-4190-a8b5-5b00cf6f2840", "value": "6a5a3919d6bebf63a6f776305bb77974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084571, "uuid": "ccc494ae-cf2e-49b5-b565-276864a86f18", "value": "768:s6ATaYCP8DHt5wN+B3zogyUI9d2h2BXbakkSLEDRZn/AiZFi0o3AhRKBBRHSyU2i:sHCP8DIN+BsnAkbakvknuAhoB2yU2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776084571, "uuid": "1a9b3046-9fe0-412b-9644-cc9f376c7f0e", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776084571, "uuid": "655ead49-7f0b-4b78-b8b8-7cb37fe1f353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776084571, "uuid": "9c4098e2-147a-42d8-8281-b951b678dd72", "value": "b41f478f33a0ba481b2aff40ef2c89d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861308b1-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043472, "uuid": "4aa4936f-9076-4b32-b114-1fe8cc9347cb", "comment": "Malware payload (Mirai)", "value": "ca3007c1f06b105d030d336b2a044483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043472, "uuid": "fb84de4c-aaf0-4ef0-9846-10fbd9ba385b", "comment": "Malware payload (Mirai)", "value": "edec33096d3dc858baa939db043b595e37eeb8dbbd6c4bec25cf8a6a2b4e625d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043472, "uuid": "fc842479-55e2-4abb-9817-a252ee76a0a4", "comment": "Malware payload (Mirai)", "value": "7d057ea7abaca23ab2e8d18515678c23d19e2bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043472, "uuid": "bddfb86a-2fdd-4fed-9ab4-e3f8459078c7", "comment": "Malware payload (Mirai)", "value": "ff595a44f5bac8bc0cedcd1b632b26458d2357c23ba51a69cf3d41a7ad593aa3ae3456ea8f9a5922d4bd0aa0eb0806e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043472, "uuid": "f8b47b46-165c-40a9-b896-b1e2b23fd4d4", "value": "T1E1A319A3FA00DE7BF00BE7B744A308097670FB750D536A6262173997AD7D1D92926F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043472, "uuid": "21b970c4-5cd6-4861-a8d0-0937e723526d", "value": "3072:ElBfHmF2gTDZttfiEn7apyo5MTG3tZoArQ/eU:M4gyoCTG9ZhgeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043472, "uuid": "5983723e-51a9-4d68-abde-cf03e191280b", "value": 104580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043472, "uuid": "ca55adf5-4f08-4225-9b3f-819095b7de92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043472, "uuid": "23e67dc4-88c6-4857-bc3c-da39db9644a5", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a7cf9b-370c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776066214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066214, "uuid": "023df732-69a2-47f2-a00e-a627a9f5957a", "comment": "Malware payload", "value": "686aa90ff49dba071cae0133492f3b4b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066214, "uuid": "157c48d7-9e35-450a-9845-f6994c7ba622", "comment": "Malware payload", "value": "ee757ec949815971c3a5db2e6bf7caf4943e3e59d24cf972677f18574b8bbe91", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066214, "uuid": "1aa44010-0bdd-4d6a-b6c8-4fb2f6b2f2fe", "comment": "Malware payload", "value": "9f692dd48d2c696ae0342df0fff0d261c1b16494", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776066214, "uuid": "35ee0fb9-fc6e-4750-900d-7cb580539100", "comment": "Malware payload", "value": "d279a891b8a9bec1eb7a2ac166f82e3f5a3cfb5067b6450ee05c8f206b401b28493f9514d46ac9f8f3703e50b26f9992", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066214, "uuid": "087e0d61-72ea-47ac-b06c-17fa0bdae188", "value": "T1F9B23F3ECA84DFF00B2A31E5AA6F7A1665180327B5382A4D7DCE81593B35644CBF01ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066214, "uuid": "a8f37b87-6efa-4077-842f-c07ee4acf9c5", "value": "384:KYTTDSJ2YAUsubSkm2/k6cY2O6RjaJhTAa2Gpu0XHDgDber94clx7+07ihe6JRot:KYDK2VSSZ2/kFpwlN9nceJLM/Eb1N/FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776066214, "uuid": "9363c83f-5279-431a-8d02-32106b0f3d87", "value": 23673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776066214, "uuid": "58167448-4d60-4678-ae90-c88335f2301d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776066214, "uuid": "f5606edb-fe5d-4acd-ba2c-ab2bfabcdff0", "value": "e-dekont.html.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74f9016-3731-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776082263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082263, "uuid": "9cc91caf-f082-41db-9dc3-247842f95a84", "comment": "Malware payload", "value": "d596058e4ebdc8385a978574417385e4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082263, "uuid": "d7d26b0e-2b5b-415e-88ca-dd9b7b03e867", "comment": "Malware payload", "value": "f0ceb2fce76e35eedb4b7fc0f5157f2a6e2d3dadc656fe63cda4cc13b847855a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082263, "uuid": "06d33c66-23e7-43e2-8b34-1ccb19091ce7", "comment": "Malware payload", "value": "5383f9edc93da026e34d286296a1f2dc280bfc40", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776082263, "uuid": "eb5e52de-150b-4f60-a260-b1d05ea4485e", "comment": "Malware payload", "value": "45b93d1e362e478d56070fb2c124782fda85a08d573fc52023e491b3f2d2c29f10d74fdf583d711de6b994971890ab92", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082263, "uuid": "b19fd1a6-ea8f-443d-ad86-449394c4a585", "value": "T198B533037BC681B5C8D92332485547BA19BEE4E95719C6CBBF881C059F732C5E73A88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082263, "uuid": "1e16fcfe-7169-4ace-8a7f-fc2f21ba0f9a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082263, "uuid": "4ed98c16-51e9-40f3-8865-9af7a24e6919", "value": "49152:cgwR+bHM7JC89Vw1cBQiv/S0b76VfzRIbOxWjwvbB:cgwR+YE8Hw1upvn6dzq+ywv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776082263, "uuid": "581bf230-4099-4dcb-a478-453926a36007", "value": 2342404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776082263, "uuid": "d159215f-0fa2-42b8-b526-2ff46744ef23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776082263, "uuid": "9a14a231-3bea-4376-adfd-7ffa71e039cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a8aa07-3759-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776099218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099218, "uuid": "6a9a6234-50a4-4932-8870-b0024c3fa170", "comment": "Malware payload (Mirai)", "value": "379002d5845bf9c85d40537f60903ba6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099218, "uuid": "43549441-aacf-42ba-baa9-8dfef8563427", "comment": "Malware payload (Mirai)", "value": "f1c3fe51b1724177b04227338b6a3add1bd7a0c72ceb1c7bb63077a726f8eb5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099218, "uuid": "ad739524-3e51-44d8-9a72-98a1c27ac894", "comment": "Malware payload (Mirai)", "value": "c168740d25d4823ab407954cdb7e169aa3a4387c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099218, "uuid": "76afc89f-9363-4b92-b705-6896b9088e02", "comment": "Malware payload (Mirai)", "value": "6cebcf7d387f67bbd484d00b480b47a7bdbb1613eb7d8eadbcfa6de514e6eb00cacbf6ab4a544f7f84ed5f22e7a1c47d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099218, "uuid": "3182b068-5119-4f0f-b6bb-cbac9b436f1b", "value": "T1B0D47D23A3518FA5E368D27101F38B14899522E30BF345D65378D628BA506BC2D7FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099218, "uuid": "2da1b7de-a7c9-4cef-8e51-15d3b5787ed6", "value": "12288:k3zySLLtA7a/AqbkofhnIKuhMu2wIpnWzo83EOQWT9ScOS3wbgKk3QPp57WqQp3i:kDFte9qbvZnJaIpWzo83EpWT9Sc7TAPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099218, "uuid": "d8e16fac-5b6d-4062-9338-3fc6cf28d7dd", "value": 646868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099218, "uuid": "bded6769-b718-41c3-9258-5fcd67b20130", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099218, "uuid": "301931ea-e216-4738-b6df-823f936ae2ec", "value": "cloud.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f26c898-373a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776085819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085819, "uuid": "409e4c6d-6c43-4723-81bc-84f872e636e6", "comment": "Malware payload (AgentTesla)", "value": "c2c5ebe19160a3244cefc9ba12c6d845", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085819, "uuid": "d10dc91a-446d-4602-a788-f9453364e790", "comment": "Malware payload (AgentTesla)", "value": "f245d3cca0205ddf0eacc7b56c54d5306f650a942913db0bb442252c15f994b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085819, "uuid": "4cc3c552-9254-4225-b4a7-d9bd151c8a75", "comment": "Malware payload (AgentTesla)", "value": "42dbc35ddb37db20996d2d9ec52d3a8534ec6c2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085819, "uuid": "edf5fa7d-d52a-45c1-a86e-f2773864eec5", "comment": "Malware payload (AgentTesla)", "value": "55a2f30d149410cea4f4d9c89994a51141c08292661f69809c352aa740f0591ad608799783cab54fe2de9e60ce9c4302", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085819, "uuid": "08d615f7-97c4-4530-b464-10639828491d", "value": "T1D182951A8A049FF40A7D3191B66B781AA9100367B538395D7D8FC1DD3F7AE10CBE14EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085819, "uuid": "949d35cc-7a6f-4987-bbe3-158ccfb2fe6a", "value": "384:KDTTDSJ2bvG3ZlNyJ9wnO8nH0VahVKpR5whmTkkGG9kkdLGdgErc:KDDK2biLTbswk9OwdGgEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085819, "uuid": "35ac3083-1242-4eee-95cb-87460636e976", "value": 17638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085819, "uuid": "02c9cb63-4163-4663-ba84-a396072904fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085819, "uuid": "8b9c625c-d494-4883-aa59-c6aa0a202705", "value": "ORDER_SPECIFICATION 073_2820.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10af6d6e-36cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Banload)", "timestamp": 1776039839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776039839, "uuid": "fe1a05f3-9562-4545-9d33-77dbb100fec8", "comment": "Malware payload (Banload)", "value": "a49d925d9f27aadb99f7f2cfb45e48e1", "object_relation": "md5", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776039839, "uuid": "5f025476-b465-40dc-9bfe-1349c09416b7", "comment": "Malware payload (Banload)", "value": "f26156642164d69f4868ee5b0030cdc0de2664acabe2926aabc3c35294b5ab2d", "object_relation": "sha256", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776039839, "uuid": "4d6229b6-7fd0-492e-a4ef-350962605815", "comment": "Malware payload (Banload)", "value": "65f35144e7a2de35aea337b7adc2c99439b22b3e", "object_relation": "sha1", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776039839, "uuid": "ded93742-6ab5-478e-8382-d5a12ef2dd5a", "comment": "Malware payload (Banload)", "value": "88d12db12264b4d6ec0a4fd66a822c52b86ee2029cee28fde1b12d26609c9b2749cc6f4fe6540451225bbdbf61117c24", "object_relation": "sha3-384", "Tag": [ { "name": "adobeready-online", "colour": "#4E4FAF", "exportable": true, "hide_tag": false }, { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776039839, "uuid": "5ba66c43-b60b-4a44-9cd7-74952261f9d2", "value": "T1F8B57C21B287C136D57D0272A928EE6E157DBFB30B3144E7B7E83E6E49B08C15335A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776039839, "uuid": "a381c068-f92f-410a-b76a-6b4ec30451c2", "value": "49152:+6QYSk+q4E5q8g735hdndJf2R7vKo/A25zEKU94xxEN1QwDQT15q+M+b:1d+XLn/8/ZBxe1Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776039839, "uuid": "a1e19d7d-30b8-4cee-92ae-48e3a432ef5c", "value": 2447360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776039839, "uuid": "6b376746-9d70-4b2a-b118-bd5fb9d2c667", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776039839, "uuid": "0a5767c7-bc4d-4637-be0d-c655989d9976", "value": "1004.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81021a6-36e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776048817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048817, "uuid": "27ca9da2-02aa-4ef4-9ded-291d9ba64ddf", "comment": "Malware payload", "value": "9847e4b0e6be9b91571fe16a7a84b90a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048817, "uuid": "50b9ff73-a646-416f-b5b6-0fd0028c168c", "comment": "Malware payload", "value": "f4fd86d7902d10c5454bd1ac7e5fb5d8ef03650497e2cd8d62c6ba0427007b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048817, "uuid": "47ca0b1f-3e85-409c-9c55-02c79519b0b9", "comment": "Malware payload", "value": "a5f8486e5d7dcd84c3692ddfa678d4555b979814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776048817, "uuid": "87025f45-1b13-4728-8b86-a8314af98df4", "comment": "Malware payload", "value": "11de537b2b7e5105356ddc60f86959d9fc506a2acbd1b4beefdba8f1483b3829e3cff9a795948c186c68ca489bc6e455", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048817, "uuid": "a704f0c7-5f81-46f1-8a66-fdec8ae79f40", "value": "T15485331D7463D10FFA3D7B72194568AE1A70800C6BBDD07172E295CAB1726D0B3EADE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048817, "uuid": "cd7f8eb2-76db-41f7-8f02-14ebe7f95916", "value": "49152:4yVAXv0stHELBJKe1da12mjbSIQ9mKdYvpRSSso:Z+Xv0lJaNu9mjvpRSXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776048817, "uuid": "a1d0d5d2-d44b-43ca-9af1-d04a9a986aae", "value": 1744640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776048817, "uuid": "8cd90a2d-3a98-4f73-9077-91311a2202c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776048817, "uuid": "b99bbf16-5de1-462a-8aa7-25bac6e7e17e", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc17fcb-36fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776059507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776059507, "uuid": "31eceeef-30dc-440a-8bb4-13351dc18c92", "comment": "Malware payload (Mirai)", "value": "e549f4dd8890830f488976d6ea80f138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776059507, "uuid": "4cdb0f4f-d04c-44f9-9781-301bc8b3f5c0", "comment": "Malware payload (Mirai)", "value": "f66e307bf77a60c33e15fdce2dedad80b20f41b6d9174657a329af47715957a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776059507, "uuid": "26eb2fab-2d09-423f-9ee9-7a961a41ff9d", "comment": "Malware payload (Mirai)", "value": "93f2d03a5eef4a3e5a833a52efdd5062866efc14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776059507, "uuid": "2eb142a3-5ebc-414d-8518-0405830fa60f", "comment": "Malware payload (Mirai)", "value": "f970e9ec60bd46d3ba8c23fe38e7cdb036ab37baac6f04a2f48cbdeec8a8d74b605489fd0a111c7d8ec182dff7afb5cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776059507, "uuid": "a4913c8b-59d3-49b5-9596-36d42ea7d384", "value": "T1C5D307C7F900DAF6F80AE33748570906B230FBA509925A373257356FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776059507, "uuid": "bf66f765-b856-4731-8639-9ec2ab44beb6", "value": "3072:pYIWHH0JpKySeuthlBk4604iocFOPPZcPhV1jbiBL2eliVH:hKySVtDBkPiW3ZcPEL2vH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776059507, "uuid": "a18fab15-5efe-471b-ab91-0e9da5da970a", "value": 140416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776059507, "uuid": "0ecd771b-6b13-49c1-bca0-0cc0f7bfc678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776059507, "uuid": "c7c67f19-e10b-4fc2-976a-8883a3abf6cd", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df60f07-372f-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776081093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081093, "uuid": "afee1f39-6685-4b8d-a3af-60d937b47dc2", "comment": "Malware payload (Socks5Systemz)", "value": "e1793ab9a7197a0cd44e232b4ee3495c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081093, "uuid": "ec68dd43-cf32-4c8e-bed4-71172151d53f", "comment": "Malware payload (Socks5Systemz)", "value": "f73812b7c3b82f9b9610be067626d924af1b3a1f3a0e9533d7ed76f431599ba5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081093, "uuid": "11a23fb8-54fd-4e18-95e8-6fd9242fc0f1", "comment": "Malware payload (Socks5Systemz)", "value": "c103c1af9925d552a6b9e4ade3d31885df2e89ae", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081093, "uuid": "5a5d7856-b6b0-43ac-a8f7-9bcd8a66e818", "comment": "Malware payload (Socks5Systemz)", "value": "a501a77d8013dda55b6f57c812299a7b668955ea15f4d0b6395ac7d682569b1d8eb5d54e77f487403c968dda66250605", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081093, "uuid": "592a5064-64bd-41af-8999-688a798f934d", "value": "T139F5FB8152836CC463C151BEBB3AF7910C53CA86D72CDBC61EFDB6D803821E6A973656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081093, "uuid": "8fd8c820-6b03-46e5-8858-417f5916342e", "value": "79a7a41b06e8d99ae4fe67fd22310960", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081093, "uuid": "7a493ab2-b917-47fd-aaa9-cf003efcefb2", "value": "98304:qoVlUHIEew1P1nKxwsxfq04nDCrHHP326dzfA4H7WlPpERLxQIzWRT4u7n1zD+pb:qNIEew91nKxwsxfq04nDCrHHP326dzf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776081093, "uuid": "370d9d75-3cc6-46c3-a29b-d8dededfb64d", "value": 3462144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776081093, "uuid": "2f87205e-ff94-4433-a571-073690580820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081093, "uuid": "7cf5ee11-59c2-4ce4-a921-300cb4b37572", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec4e47d-375a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776099831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099831, "uuid": "c3690484-ff69-449f-a41a-ed328dd2c1ed", "comment": "Malware payload", "value": "cbab4a91fff85beaf9096736d33c110e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099831, "uuid": "ea291f9f-a44c-40f5-8992-7af8fe3ccea7", "comment": "Malware payload", "value": "f74128de852336b27069a677eebbf7e4ee751c294b96b17c1200cbd65a90793d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099831, "uuid": "b8b455e3-20fa-4e2f-846c-ce070011cf2a", "comment": "Malware payload", "value": "3fb78394fa51f227f903ab63618f01e7344d501a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099831, "uuid": "80383cbc-d68e-4481-9c92-82d82f089218", "comment": "Malware payload", "value": "be6c4c8895cb9b88e741ee9f254a211ec5785d5abdb067b0d69496f09449fc08cbbb09396bfe1c0df31a02f834d5bcb8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "refundonex-com", "colour": "#2F97B5", "exportable": true, "hide_tag": false }, { "name": "stealer-campaign", "colour": "#B5230D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099831, "uuid": "bc31e4d8-8dc2-4aa1-8759-922ce106398b", "value": "T1ECC27DA27E94F0B457CF371776B4F9914534BBB2A0896A0CA1DE508163DDEE0F63C1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099831, "uuid": "c8b3557b-11c5-401b-aa9d-c1490f92b6e4", "value": "384:P3C1UiosAm+rfd5CZsmYOLs+JqLKsFKHhdg5zJ4:61UiosN+7XOwix4K8z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099831, "uuid": "5808e20c-09a7-4abb-bfb1-af5512229d47", "value": 27173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099831, "uuid": "224d61fb-195a-46a5-af21-01f8c1c7607d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099831, "uuid": "0973ba0e-c4e9-421e-b163-a2245fc45238", "value": "testx.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7720a107-36d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776043446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043446, "uuid": "011aebf7-7b5f-482a-8077-a718240a1508", "comment": "Malware payload (Mirai)", "value": "4db9a7c9a3c381da5411f2fdb48ed54d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043446, "uuid": "a9704585-55c4-4d65-b353-d63def1ca94b", "comment": "Malware payload (Mirai)", "value": "f779057e4049edbc02d7732eb3fe1a56c46c7ef2dfcac8b8372d2385c6f009ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043446, "uuid": "f60905c2-e508-42f8-b0ce-deea98f7e1aa", "comment": "Malware payload (Mirai)", "value": "312abfcc35b699380b1047f333fc1ea53955763c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776043446, "uuid": "f249a7b0-96ce-4951-b1c2-adfbc4c5f90e", "comment": "Malware payload (Mirai)", "value": "a49e735b390720578e45b75a5ae14fa15e7d57f8a17069ea5a883fccaf84245f7073708d698f8e7749d3ba9613dbe6aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043446, "uuid": "74d35ca2-ff0e-4121-8d51-cc600ee731b9", "value": "T19A933A4377080F47D2A32EF03A7B2BE45799FA5129F1D584691ABEC643309B22542FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043446, "uuid": "de0ffd04-03d1-4cf5-8d9c-0b36ed6fdc25", "value": "1536:QOpk8QtpD1v0wyl2zY8xvoU+pBumOT+PVDsHkc3UlmeqAwMlg:/Wp5QWWDKkcEr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776043446, "uuid": "e037e398-422e-468e-a0e9-8f0712b5f507", "value": 94680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776043446, "uuid": "cf61c534-695b-4a54-b35e-7d18a4ff54f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776043446, "uuid": "ab9dc70e-67ca-4256-9d49-708b58a8cbec", "value": "zyre.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933a41c7-371a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776072270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072270, "uuid": "f2ce9efc-6718-433d-ab64-978639f09419", "comment": "Malware payload", "value": "84fa3de800bb7922e6c3348401a076fb", "object_relation": "md5", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072270, "uuid": "56686d72-4721-4ecc-9c92-287c9f1c5e4b", "comment": "Malware payload", "value": "f7b86411950c5c40e14c59e23ff8392c52a2846241a54b7dcf2fedb8ef364d9d", "object_relation": "sha256", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072270, "uuid": "a290bccc-0184-49be-969e-212b22aee2eb", "comment": "Malware payload", "value": "964ee7ccb3d92a44afd07678a9fe83cf2364b3f9", "object_relation": "sha1", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776072270, "uuid": "35d6083b-ea4b-424b-8ff9-d6455eb0ecb9", "comment": "Malware payload", "value": "b1df1b6bca8020075eb1c879e2ec0b1dca5050a2adad8725969969543f7c348aae7237a21ce3e5e77ff34c1fca4df9af", "object_relation": "sha3-384", "Tag": [ { "name": "64-89-160-253", "colour": "#6EF285", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072270, "uuid": "6b29b1d1-757a-497f-9817-a327df9a543d", "value": "T140D0C2F3745554F0850BC8BA632491C741C6025049032934896D9B3470E8314E930F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072270, "uuid": "ac3b0e99-90bb-474a-a6f7-a99ee508500c", "value": "6:ADziSC3Qs3T+6Qgio9uyamo9ulLG600c3PV0RXmo9ukIFB:AXAj3i4B9uyE9urc3mn9uBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776072270, "uuid": "867a3351-2a99-4427-a350-a138f3f5ed19", "value": 291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776072270, "uuid": "f6c93f58-98d9-4658-8fa3-be7eb2b2b03b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776072270, "uuid": "992f801d-d968-49bb-b581-c2430843dcdb", "value": "update_udp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be315909-36df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776047002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047002, "uuid": "a2eb6a56-356c-4cfe-82ab-b2fca5a8455b", "comment": "Malware payload", "value": "ede2505b44f921a3f4003bdfe6782810", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047002, "uuid": "1342c8b9-8106-48a5-84e9-68bd1af13af3", "comment": "Malware payload", "value": "f7fd4c3dd2c2b4f18cf6b22132d609579f4f96dd16ba32bbe39ee1a3397a31c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047002, "uuid": "6ace4f8b-98a7-49ec-a977-97a6a3fbb1b5", "comment": "Malware payload", "value": "b2a2a55729836d6cd2248c38b647c260877cb014", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776047002, "uuid": "70e2d5d2-3a12-456d-9314-52e0c51abd8a", "comment": "Malware payload", "value": "5e618eb6f55bce85ae404ce3eb90f4841589ce983acf4a322721f73fd4dacfefaa73e653e2fcd045a40541f9aed41ab3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047002, "uuid": "2973d5af-5b1d-462b-91e8-0a58f4a5012d", "value": "T121B533848AC151F2C875CF74C5E747FCBA2B77B5C455196F0BF867A8C1B2AD880A68E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047002, "uuid": "c9aff71d-ca02-4d74-82a2-bd7f99061974", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047002, "uuid": "8e15d8eb-e893-40bb-95e1-59334a540792", "value": "49152:hXVcs9PTynUi8TJViXMX1BmexRr+Lr/8FKj7U6rXULQSS09/b:hldylw4CX3S78FKbAQ0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776047002, "uuid": "855cc04e-a8ce-4769-9462-cf921414836e", "value": 2309120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776047002, "uuid": "becc16c6-5d59-478c-beed-62169b02e4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776047002, "uuid": "093f3aba-2989-41cc-b7cc-c7d235223821", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b8e73d-3783-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776117346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117346, "uuid": "34480e29-aed0-403f-bd2d-b23540a548e9", "comment": "Malware payload (MassLogger)", "value": "3061b95caae416cc2046ad094d8831fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117346, "uuid": "3cb627b2-e529-40f3-91b4-60adc42c6c38", "comment": "Malware payload (MassLogger)", "value": "f7ff10120f9873493a702d4af415eb13d9ccee1915a42b0986fe37bfbe55a8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117346, "uuid": "2f0da8bc-45c9-4388-bfb9-4f0fff1b526c", "comment": "Malware payload (MassLogger)", "value": "e2cd70fa2fce207861cbfa226ca46c1a5117df9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776117346, "uuid": "d47f5f01-9d4c-4033-bf62-52172474a05f", "comment": "Malware payload (MassLogger)", "value": "b13b78bae0b30cf2b1e886192e32b330e1bdb36874b49d500b1114691b4d0a5435986ff2c07a6b57ddb0b1f816bcc72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117346, "uuid": "db731631-3ddd-4b8e-bca0-546738212f14", "value": "T1CB144A2833EC4A14E2BFCFB995B090140672F4ABEC16E79D5D9620EC2D727469861F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117346, "uuid": "21f8e9b9-8aa9-4b0e-a298-a81e74c14e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117346, "uuid": "79d17813-b98d-4e30-9591-ab41fe75ae0c", "value": "3072:6QCLaxeImUupz/qWyPQjs0503f/aJBCyzQ0:6ZrUjWyPTX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776117346, "uuid": "0caea510-e2ac-4ba5-b48c-38f7b2ebc003", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776117346, "uuid": "e8ef968a-4707-45d2-a00c-95b458d07ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776117346, "uuid": "11f763e7-7213-4d3e-a8cb-7ef04ff30ddb", "value": "svchost.zowner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7e63a3-3759-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776099263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099263, "uuid": "53056eab-ad64-410c-9f55-f0fefdc17396", "comment": "Malware payload", "value": "15e4fa2a3a5b69221078dfae2d11ddaf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099263, "uuid": "22fb8cba-b98e-4d20-903a-f64f8a5e06a2", "comment": "Malware payload", "value": "f8ab85e1a9ea16db144e14f3f0fa2e4ef16fc048363fb43a5656b49949b34d43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099263, "uuid": "39cc3586-6077-4541-b1e9-b26efb593bf7", "comment": "Malware payload", "value": "cee32ecfd6d12e1028d156d70cc0db689f395a7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776099263, "uuid": "57ca99ee-77ee-4e0f-8b18-a69e02e5c44f", "comment": "Malware payload", "value": "b9254d44b6f34f4ac888eb57476853c5bf81aaba42777e54bd63290e6af0dad6656b523799deebb440caaa13f3ba6b0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099263, "uuid": "6903378c-86ce-4d41-b365-d485e7ee1855", "value": "T1FA0149837039EBF0664A0474874AA6946C56301759208D2CFB97E93ABFF99563890BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099263, "uuid": "8774645d-c34e-4cf9-ba90-8b61301608ca", "value": "12:BtEBXv5bNW1EF6sS/btHdD1pzWT1dlllM1/XG/ZN0PjU/5DsBhFFD1s88V3iasJL:BtEBXB4N/btHR1pzC1dnlM1/2/H/5DOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776099263, "uuid": "8423ad98-7644-42e7-b407-a061d40a4aef", "value": 679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776099263, "uuid": "91ad2354-add2-4685-a4d3-26422d4efd18", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776099263, "uuid": "5f721f1b-9fa8-4806-a8ed-f53a76d6846b", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4990dfba-3710-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1776067851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776067851, "uuid": "ae5cdc26-7ca8-4d62-995c-9a5d966e1344", "comment": "Malware payload (Socks5Systemz)", "value": "5e1b6d60c6e7a5e1ad38c4f4610266ef", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776067851, "uuid": "c39f7cc0-4e19-4720-aa92-556274bbfae0", "comment": "Malware payload (Socks5Systemz)", "value": "f8c3d6c941e6ba34dbc7a8b690edc70e16ed159b74965f852c6ccaebb626439b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776067851, "uuid": "a92df50f-b4fa-4dc3-8118-eea2105a1820", "comment": "Malware payload (Socks5Systemz)", "value": "35309dfea8cc71b10b995032b3b54193c4c16f94", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776067851, "uuid": "d910534c-04e2-44af-b961-765048694e5b", "comment": "Malware payload (Socks5Systemz)", "value": "ac5f1c8eedec399a8de32d43445efc5123870fc9e0ced4d5229257089b29dd68a683c35290e97dadc7ff3a00b8f79bf1", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776067851, "uuid": "e8923d72-bdaa-4dea-ad0d-bb6a5067bd8b", "value": "T119063304D3B118F1F117B8F72677B9218DFA6B8999B944E03A6D548A3F4F5B0B40938B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776067851, "uuid": "c630b807-bdbe-4a16-9d9e-d6b91213b1e3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776067851, "uuid": "a919e83c-5030-4cb1-83c5-484e94919d84", "value": "98304:Nnkpu0a1uM1A75lPrZeD5ujFMBLJxxRfYeE92XDsD:FkpwuKG5lu5/FJvRQd2Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776067851, "uuid": "9f310680-8af3-4678-a62f-ce2f97ff0afa", "value": 3735285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776067851, "uuid": "d9c53cc5-c16e-47a8-9f34-1197cdd317ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776067851, "uuid": "1cf0fea2-4789-4bcb-aba6-8f904dae7159", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718831a1-3739-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776085528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085528, "uuid": "b55cd4d2-5394-4618-a60c-6480324c2670", "comment": "Malware payload (Formbook)", "value": "5d860e4e435aafea3125f166c545f833", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085528, "uuid": "547703ba-3450-4b8b-88ba-a8c11dc7b9c9", "comment": "Malware payload (Formbook)", "value": "f94ed7fc0a4a13873b63b260ec22beb2393f7d047825c176c66a1de5c73ffc0e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085528, "uuid": "b2e64e57-c968-4582-a439-4e7d40136e80", "comment": "Malware payload (Formbook)", "value": "207d2ae7737d7a961d6e619849f228bf78b66f9d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776085528, "uuid": "f6d8ee37-a4ec-49eb-8f5f-7966f7a262be", "comment": "Malware payload (Formbook)", "value": "be7a28268c7254e0891e7621739df077ee34e0597a531cb58a9f048515fa93dbba18fb4c3e768143f30917f7b010f59f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085528, "uuid": "f0b80265-9717-43df-8b93-21bdbe0b405d", "value": "T165C2B5CFA7C6F294831230B72426A1B2F52E9CC0315581C5F6C4B29DFE78B44DAA55F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085528, "uuid": "66fe92f3-7c5c-4221-b8bd-665865f84cb7", "value": "384:oGLWvUXCpFGtlPxwqQf89e9QWMPKIN5k2OQqcz7LrcK9E4/fzFkamU++TPv0g2Cj:oGLxAcxxwQsq7iczHrc+3x2U+C2QYWOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776085528, "uuid": "01f2bf83-6895-4c4e-9d4c-9a479d9a2332", "value": 27833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776085528, "uuid": "e148425f-25ec-43b8-87ec-2749631e4934", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776085528, "uuid": "67205098-c7c3-4ac0-bb2c-d6e286f0f9ff", "value": "\u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f \u03a4\u03a1\u0391\u03a0\u0395\u0396\u0399\u039a\u039f\u0399 \u039b\u039f\u0393\u0391\u03a1\u0399\u0391\u03a3\u039c\u039f\u0399.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceab061-372f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776081467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081467, "uuid": "bd3dc882-6cb3-40ad-b720-3029a0a0b764", "comment": "Malware payload (Formbook)", "value": "7a21cb9b4036c67d783b1759db2649fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081467, "uuid": "011ada46-5bcd-4e35-94d5-e2cb76066550", "comment": "Malware payload (Formbook)", "value": "f972897482bd05ab19ef8a9a16f1447d40b1935bad096feabc5c294c393602a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081467, "uuid": "ed4c2ba1-7581-4a6d-bbcd-3be7450b6236", "comment": "Malware payload (Formbook)", "value": "967ccb12d0d9055f7f776a30e9a1752ce2e5a1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776081467, "uuid": "236a9e5f-a3d1-4c4e-b911-a3d586a514b6", "comment": "Malware payload (Formbook)", "value": "6a4c8b5fcc5d34f3a866197b048c68e0443d27de224a5917a08af6117b1e601c1983b6ce6c654d2ca4732ccd12da2e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081467, "uuid": "b37dd471-e655-4cbb-a21e-2177edf2c848", "value": "T199944A3ECA98011AE1F6C614BDA60413E5377F57263D8C9822C5124D4AF344DBAAE7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081467, "uuid": "18517075-0926-47c2-b764-7f5c7f05ffc9", "value": "12288:aeSFxao/CgNOcELH6e18QiNoQwdyqr8SBH7zdfWraSks/:a7Fxao/CMc6vZNoQwQqr8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776081467, "uuid": "3d99bcfe-f317-45db-a2b9-0595a6a29fe8", "value": 408390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776081467, "uuid": "2f453f7f-e8eb-4326-bf63-36b122c96099", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776081467, "uuid": "8a490812-723a-4d72-97b8-81b4c8873089", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ccc4e-3706-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776063501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063501, "uuid": "00b97ac9-02d4-47b8-a891-fc6e6d87212d", "comment": "Malware payload", "value": "1b4e5bcfd29bfc00546df85b778d48c8", "object_relation": "md5", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063501, "uuid": "68c0cea8-1256-4038-9017-86cf81ce18b2", "comment": "Malware payload", "value": "f9cd72a5a7bb0e04cf19d6164ee96edde2df25d7183522617deb3fd3f1e65769", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063501, "uuid": "42fadbfb-11f6-40fb-a6ea-fe94550fc1d5", "comment": "Malware payload", "value": "7a34e7d2e54ead22ce331c87043c41347943e9c6", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063501, "uuid": "dbf4e96a-4fb1-4116-9b41-2ea95687c2c0", "comment": "Malware payload", "value": "29af91cac1c4e3f0f6bc33fedbee9113acab3c5e8e9d5caaa675757f19c3d3e16b08f2ec69ed0c2b57e21f244289ff3e", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "kssaprraemdda-com", "colour": "#57C617", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063501, "uuid": "273fc6a2-d46a-4ab1-8b13-47f01e36fbef", "value": "T1C2416A368C14661E9B6340EF2810E950B8DA553B928DBDC9B28C44A9BFC533DC9524B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063501, "uuid": "16e30a95-5c40-4609-b24b-848f78e50e9d", "value": "24:qtUUTH5ygwrHw+HT1//0fj/A0+dXcO1hNwB7QRmvOayyTn2hDOaj8aFdXclGle8A:eTyR/0DA0gSko/BjQOY8CE8Ri5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776063501, "uuid": "d1098e24-0028-4a71-b515-0571c197c22c", "value": 2118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776063501, "uuid": "5fd6aa87-1a19-4509-a523-b9441dba5228", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063501, "uuid": "95aaa04a-7892-457d-b470-db3ec21d10e1", "value": "f9cd72a5a7bb0e04cf19d6164ee96edde2df25d7183522617deb3fd3f1e65769.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5044871-375f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776102016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102016, "uuid": "a49209ce-d634-4228-a4cc-c9a9a70b5495", "comment": "Malware payload", "value": "8d9ba4c4fe77b3d274dd273b3cd00c2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102016, "uuid": "f854b8b5-8ed5-4e5d-b0ad-93e567f451af", "comment": "Malware payload", "value": "fc0fabde06751d72a58e78abbb5082ede0ad705f0b046dc68782e3eb092640f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102016, "uuid": "d01c2466-357d-4d0e-af61-253a79b7878d", "comment": "Malware payload", "value": "ddeda044abfb024c366bc6f3cbf1688957f23353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102016, "uuid": "40b1f943-7322-4e69-8fee-6d8c09826e5f", "comment": "Malware payload", "value": "d860163cf32a2ccf001c6386d91c2e3f680faf905135908902554e26c4e1956e1a37546c949891f673b5f1995cd6d404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102016, "uuid": "7bd62e11-ce0a-48d3-8c71-462371e3d3b1", "value": "T172C45012EA21A02FF49389B1797896467C292D321684EC5BF7801F997070ABBF1F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102016, "uuid": "d5b39b12-2172-4331-a60b-8a119effb032", "value": "940c93898d218af76b1a4f158c83bf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102016, "uuid": "43500f19-2424-4625-a58a-09279b0c8804", "value": "12288:w2l/H1fIy/xDHYuXLPFMqyW/Od+mcyUQ8V8tCtu:RVffxWbe98Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102016, "uuid": "b3c86e1c-3d82-4856-8136-e17140ff7b1d", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102016, "uuid": "dceb31c3-649e-4b2b-8276-60f70dc0b635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102016, "uuid": "b0bbaca3-0411-40e8-bb50-898228cb3a50", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6caba5da-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046865, "uuid": "4933f300-dd80-4f5f-b9cd-e0dd08b3393f", "comment": "Malware payload (Mirai)", "value": "ed3a38822a3e6fe95b2e2fe56976b62b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046865, "uuid": "0ad98798-1a1e-4eec-badd-3af2c7d0a0e6", "comment": "Malware payload (Mirai)", "value": "fc9dbe459470a1a9cb457fc3feb397c065a83619c994a0cd5b2fea84b9a2c4fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046865, "uuid": "a656be1c-0162-4fe5-b002-6433959f6505", "comment": "Malware payload (Mirai)", "value": "967cbe12399dd98e760e788d803345d25eb7e501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046865, "uuid": "fe155727-7338-408e-97d4-d37bbd6f3109", "comment": "Malware payload (Mirai)", "value": "1e3b24458b7b6ab271fd0bdb89c0098b14934385139faa44bf6df47b57fef98d2ad2077386776c56f005ed3371608749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046865, "uuid": "97d55155-f90d-485c-9198-a667e3de407e", "value": "T109934B4377094F47D2A71EF43A7B1BE0879AFE5224F1D584B909BE8683708B26506FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046865, "uuid": "ade96d5c-1d7f-4041-ac30-edc6519bf733", "value": "1536:WTBvIDHBd46BCZQkJzbpTzkvlZ4JrSWGdVuKq3nhXSPFn1gYrTp4d1ednCdRy:wYhd46BCm6y9Z4zSPFCYrF4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046865, "uuid": "317ac161-9832-4f2b-8672-8e29a23e25a0", "value": 94696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046865, "uuid": "ec7016b6-121d-4786-926d-29a5f769c20d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046865, "uuid": "5af2319d-7c1a-4e36-b283-a9c90ce11c71", "value": "SecuriteInfo.com.Linux.Mirai.10456.18349.9387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67500bba-372c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079927, "uuid": "615321e6-de80-4062-aa89-efec9fc59fb9", "comment": "Malware payload", "value": "b215ba0d6dc390a273608b84516161c2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079927, "uuid": "eb0d2ef8-e122-4519-9d52-6be44908a140", "comment": "Malware payload", "value": "fcad364747443b5fb046b9feb6245c8c830fea46969b6cc4b3f0c250dff129f9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079927, "uuid": "328d3dcf-a881-401a-bdb7-aa6917db7aae", "comment": "Malware payload", "value": "b35f8382ecd213ee42e1cb94f4970bd83c6e3071", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079927, "uuid": "873c4ee0-b357-4380-9cf8-a069c535288b", "comment": "Malware payload", "value": "9b5901305a33ce46ec803dca26c0abfb6895f599385f1be260cfac3dc1fff3175e4d901cdf307bba345b4dfc2a5a3460", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079927, "uuid": "b9975531-a4e8-41d1-ad0c-be4be1232ee8", "value": "T1FF81C41A8308A39F7733A7D3F32916C239692FF9BF75A29C884D90006D442979196CDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079927, "uuid": "2bf67399-c120-4a33-9dc5-90c5b771c2b1", "value": "48:MxmTINrnZNp+mD/i8KWCFjGAi6c3WG3Wr3Wo3Wv3Wrld3xNWVLb0UwhIcTP57GiG:Mx8I1jG7HG/0VacTB7+tct2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079927, "uuid": "c68708ec-367a-47c3-bd0e-f5fdaace8a5c", "value": 3836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079927, "uuid": "7e0b3565-f6be-44a3-810d-1aa77784b7b9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079927, "uuid": "13f01270-35b8-45d7-aca1-48dd7a3fc616", "value": "Dekont-21.05.2025-pdf (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020e1206-370b-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776065584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065584, "uuid": "a41f098c-dc7b-4c7a-a47f-5ae44397935b", "comment": "Malware payload (NetSupport)", "value": "3e9cef062c801ee9750f1c7e605371f0", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065584, "uuid": "d8e14b5a-8f68-4a83-924f-87bbc70efac8", "comment": "Malware payload (NetSupport)", "value": "fd7f8fe5c0f96dcecade50415f8421bb71bd700bb843e5fef0d503cffaed39bd", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065584, "uuid": "85bad657-ea80-4eac-ae1c-d0712277dd0e", "comment": "Malware payload (NetSupport)", "value": "5bc1659d8b389bb3c888c3d8c2e3154fccd19e05", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776065584, "uuid": "8ae35271-3045-42cb-a05a-80a4ee77a489", "comment": "Malware payload (NetSupport)", "value": "d6987fd8278f07256b62403c132865029c8bb8164cb9a55de29291817e2421ecb7321ca991c1c3e593e7e7c6c4e618ba", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065584, "uuid": "f5b337e0-c7a5-47db-8914-f3e5e835b1e4", "value": "T120F2F126E06FE146F504703951E2B4709A3ADBA1904684EB3B7BAC70BD59E3A25F307C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065584, "uuid": "fd9cf54f-d66f-42b4-bce8-e846f48e8dad", "value": "768:BX7YoAXZ3B/eqilaC9KFVrMtithFIPs4ilmLwE6xtLIra9jyfQ:BX8Z3B2jaPFfhFveVYQa9qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776065584, "uuid": "0a7def94-d818-495b-aa3b-a08568df2cbd", "value": 37506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776065584, "uuid": "cfc74f39-ebc0-4030-9633-15fc7a2d1229", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776065584, "uuid": "3d7b0ac5-171d-4944-a29b-a584174d49e4", "value": "fd7f8fe5c0f96dcecade50415f8421bb71bd700bb843e5fef0d503cffaed39bd.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7637a-372b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776079522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079522, "uuid": "6e31cd4e-4085-457c-8e4a-aa430542614d", "comment": "Malware payload", "value": "34a0f70ab100c47caaba7a5c85448e3d", "object_relation": "md5", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079522, "uuid": "0f753e52-8e1e-444e-948a-5f25e90f31dc", "comment": "Malware payload", "value": "fdae784b02b22916bf4bac1344b3e8e13f98996e3cd85f2daf171084983247e1", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079522, "uuid": "7fa5bea0-42fd-4524-8446-5d30779a40c4", "comment": "Malware payload", "value": "15efe7c0a510950c753a9ec1a388d699b341a2c4", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776079522, "uuid": "c7228d5e-fa2d-474e-8b60-2581ad801e35", "comment": "Malware payload", "value": "974c9d0aa7d6b004aba036701d51fe60eee919b756ff01575cfc4af89f8f7a3a2147a47b27f24d881e4558181a0885b7", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker-marathon", "colour": "#ADEEFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079522, "uuid": "f24e089a-5341-458a-8fff-7cde30b2adef", "value": "T10886122FA166C7E8D08EC1B414F296B29E70FE900975124A55CAF3376EB6C503E2E54F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079522, "uuid": "37814397-2b19-4084-a9d8-9cc8352a2af9", "value": "a43e53654c9caff09583db72a8891f0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079522, "uuid": "4420ced7-da72-489c-b0b0-c51dcd5d1dff", "value": "98304:bZ/0hvAq4KvDZYbpODh7IBdI+0SkK4UocMHakudJmXuJgTeQTNB/5OsJ4d1I7:VwAEubqsvIUwUfgakIIXuqTZBBhOAqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776079522, "uuid": "9a109c87-4557-451e-a277-a69af5fb45ff", "value": 8539121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776079522, "uuid": "4ee3d830-545e-4c04-addb-121ad1faaf6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776079522, "uuid": "0edd0d9e-86e7-44ff-8be6-37897255aa49", "value": "fdae784b02b22916bf4bac1344b3e8e13f98996e3cd85f2daf171084983247e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf83c7e-3778-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776112525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776112525, "uuid": "dbd39e79-9ac5-4f7d-a908-65df3274d354", "comment": "Malware payload (RemcosRAT)", "value": "f58def27423057f5c146290eff04521c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776112525, "uuid": "d2b7c2f0-85d1-46b6-8f01-e7f623c17798", "comment": "Malware payload (RemcosRAT)", "value": "fdd5178424df3b5abdfdee000b8fb4f8d0d376d92e875a29c3aaae4a8c82d0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776112525, "uuid": "0f5e2df7-d172-4865-9024-1d08726c4b1b", "comment": "Malware payload (RemcosRAT)", "value": "21cd14f6c6c2ddd60c74bd2ec8a42a707be74a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776112525, "uuid": "66c2c3d8-5c29-4cf1-8abe-adef1e76e4ab", "comment": "Malware payload (RemcosRAT)", "value": "13e56ba36921339fd95d2de7172517213755356953536db5bf7a76d3a07c4e7386b0b78e72ab9b532803fd679d00a97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776112525, "uuid": "1f9046a1-20a3-409c-be7f-5175b983a33c", "value": "T115B4BF01B6E2C172D57660300936E735DEBDBD2018369D7BA3DA0D57FE30290A739AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776112525, "uuid": "482ac31b-75ae-46cc-9b81-fb1d0b6948bd", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776112525, "uuid": "d6cf1e90-fbfa-460e-8d6a-a68266536d75", "value": "12288:fg2cpfSUy6oFGNfZvCcXmw0z38qsPZ0Wd:fgdfty6oFQfNwz38JZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776112525, "uuid": "4c4dc704-6b20-4af1-9206-6d3072b3c2d8", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776112525, "uuid": "3afc53c4-fa4a-4289-9f20-73e11f68ad10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776112525, "uuid": "da77b189-3601-49bf-9f1d-3928af989787", "value": "fdd5178424df3b5abdfdee000b8fb4f8d0d376d92e875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13527552-371d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776073344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073344, "uuid": "bac536a4-e2fd-40dd-97e3-be3f01c14313", "comment": "Malware payload (Vidar)", "value": "6746d57dfc71135cdad5d9e3c0b15fc8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073344, "uuid": "e8e16c55-d512-4c32-a915-9d8096c21418", "comment": "Malware payload (Vidar)", "value": "fddcfd6c5ad5f26a127d5eeafea4f45483495184853c427c794b51e7e1592291", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073344, "uuid": "9b7635a1-a24e-4788-a72e-42d421f26aac", "comment": "Malware payload (Vidar)", "value": "b07325c8231857b0ef2de41314a2cada90d0ae50", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776073344, "uuid": "60a0a34f-566b-4e12-b974-dfafda583fc4", "comment": "Malware payload (Vidar)", "value": "c52f6b9b0ab39f9f5fe9d7cf3cc3a8708b8c0343130dd7db4488fffa2adf496e959db4738dd408fba3a2d13f387b5590", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073344, "uuid": "a3816453-7d40-4e0d-810a-a1ca291205c0", "value": "T1DDC59D0F6CA545FAC5AAA33288B75291BB30B8090B3233D32E91B6753F767E05D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073344, "uuid": "845bc81d-3016-415b-a61f-49bc70d12ed3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073344, "uuid": "2ed00d8b-1dcb-4017-b6f5-65b5060122ae", "value": "49152:/WwNMvwEi17oztkWD1TWs4DfLNku5Kw+MEJv:/1plKyHLNfov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776073344, "uuid": "f591f240-3b80-49c6-9d49-2b1aa2c15121", "value": 2647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776073344, "uuid": "9a28e80c-a553-4193-a950-924117cd1491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776073344, "uuid": "1c8c5e46-db20-433e-aaa9-6aae76a0fc50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72588feb-36df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776046874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046874, "uuid": "bb835650-be44-4ba8-9c9d-fe2c7ccc6c63", "comment": "Malware payload (Mirai)", "value": "8b3082155bf6c3e8d24c42beb6b9e981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046874, "uuid": "1ec5d7a0-3c44-42bf-b1b2-01158b904fb4", "comment": "Malware payload (Mirai)", "value": "fe8132c388b3a0c03e9d78f9a4a0773f5954316b174ea1cc023c2ab1fe5210c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046874, "uuid": "8d58f205-2e1c-4280-8764-2ae4e28aad08", "comment": "Malware payload (Mirai)", "value": "858d3fb01d950c7c416bf6dddf6e702c87d4873d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776046874, "uuid": "4a46a797-c709-4c4e-81b5-183a94a0a888", "comment": "Malware payload (Mirai)", "value": "3381cfa52408555b3a13f9e212892a9a87ab1dafd7efc569151894af63cda78f57989926b0da5e85d4c546fdcbd4173b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046874, "uuid": "ed0e610d-ebf9-4957-8eff-387394107f2a", "value": "T115A3F846BD428B13C5D221F6FBAE018C371657B9E6EB3142DD26AFA0274B5D70E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046874, "uuid": "ef41bc36-45be-4347-816b-89f992ceadee", "value": "1536:Ke7r3jv7OI3T5Ent2uFcjfo5CU+7anhLIsurKzC3Vrbi3e6e6QzRSmHI3XTei/Vr:K9Ao8lNb9HI3jl/2ouKEXwPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776046874, "uuid": "905e4005-3e0f-47aa-b576-0b2c09fe139d", "value": 99232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776046874, "uuid": "0adf8cfc-4c67-441a-bc15-600b89724068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776046874, "uuid": "a554a826-daae-492d-a4d8-1ee5f0c4351d", "value": "SecuriteInfo.com.Linux.Mirai.10456.5434.17068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0228411-3706-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776063782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063782, "uuid": "a2ebb459-78fb-4b31-8c03-e1cf26098e2e", "comment": "Malware payload (NetSupport)", "value": "a0c44b1b00d818159d43f318654e4216", "object_relation": "md5", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063782, "uuid": "cdb333b1-7cbe-4000-96b1-6a40b3c7ef24", "comment": "Malware payload (NetSupport)", "value": "ff18a1feea5ee15a64fdb8332483424ea6cc9414db215b0dd6917588bda90d9d", "object_relation": "sha256", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063782, "uuid": "7bbcc1c3-d22f-41cd-9b24-4379f42a0efc", "comment": "Malware payload (NetSupport)", "value": "038a2df43198e0a246e9c40c370ab42e6d4c24a8", "object_relation": "sha1", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776063782, "uuid": "ddfdb29c-3622-48ad-8443-bc80dd42dd3e", "comment": "Malware payload (NetSupport)", "value": "34c0b865c13c7265c686ce4e84f93c3ffddf8307a705cbc98c54d3c5be3477c9c435b9b32defc7d6ced24b9a8eb6ae45", "object_relation": "sha3-384", "Tag": [ { "name": "193-143-1-21", "colour": "#7FAE68", "exportable": true, "hide_tag": false }, { "name": "iridiacheats-dev", "colour": "#19DDD4", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "psosenslsddaev-com", "colour": "#1DAC24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063782, "uuid": "15592e13-8c0d-4b8c-bff8-6b8acac51504", "value": "T111A533B002CFB35AD0571AF333BD820AF51D7280CED2BA4AE9DB141215AD4DFE15D9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063782, "uuid": "40a5d59a-3e98-46e2-b539-421fdcb05ce8", "value": "49152:jBhdMZYnir6iO9NxlA5gOw1nyzV3WWcbmKq2RNE0f2oXw:WrGegRyxmWCmKj5JXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776063782, "uuid": "3790b68a-6c28-4f11-a287-14a8591c29ed", "value": 2257873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776063782, "uuid": "45f15b0f-7a26-46b4-b728-0baa97e55610", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776063782, "uuid": "825f4003-982f-4ae2-a279-4bc2c435858d", "value": "ff18a1feea5ee15a64fdb8332483424ea6cc9414db215b0dd6917588bda90d9d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a632ee6e-3761-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776102796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102796, "uuid": "03f2ee54-c7c9-4d6f-86ef-d4ae1ad4e2f8", "comment": "Malware payload (ConnectWise)", "value": "0cb716cd1c505442c8c42c7c0a1d40ed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102796, "uuid": "8023d202-e55e-4cea-a68e-db0f70e55962", "comment": "Malware payload (ConnectWise)", "value": "ff9be9b75754a2c3e902cc55609a3f467ea82b34e99767fa29bd667938e5ca36", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102796, "uuid": "3a218a63-45af-4932-a143-d0f756f86517", "comment": "Malware payload (ConnectWise)", "value": "4b5e941a1eb40828058251bde6f23fce810c053b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776102796, "uuid": "aeff68f0-f2e2-49d5-a295-8ec9539e6b30", "comment": "Malware payload (ConnectWise)", "value": "7d0577d36e62c54e0e3af30c75079a1ea2bfb3d3fd965af1d01921b2458448d9dd0c534ad2fb8bf9b0360a9f3323408f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102796, "uuid": "5a4ba2a5-4157-4c3b-aeb3-870713b9e416", "value": "T191A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102796, "uuid": "b7506a9a-2c10-4e33-a798-20fc15b973e6", "value": "196608:anCtVYqI5MvbWEpKkq2IJqKwnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqMnCtO:GCXvI5MvHx2JSCXvI5MvHx6CXvI5MvHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776102796, "uuid": "f5fbf1ae-d944-4cb8-a2a7-90dc99e40436", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776102796, "uuid": "f52b97bd-2bee-4028-ad7f-0ea904f9c782", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776102796, "uuid": "2f46036d-951b-4315-83bf-b6ba465f68c0", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }